Edit tour

Windows Analysis Report
https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ

Overview

General Information

Sample URL:	https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ
Analysis ID:	1592045
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

Installs a global event hook (focus changed)

Installs a global keyboard hook

HTML body contains low number of good links

HTML title does not match URL

Installs a global mouse hook

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1920,i,2890419108035875567,11107966622946554112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

osk.exe (PID: 1904 cmdline: "C:\Windows\system32\osk.exe" MD5: 745F2DF5BEED97B8C751DF83938CB418)

osk.exe (PID: 2196 cmdline: "C:\Windows\system32\osk.exe" MD5: 745F2DF5BEED97B8C751DF83938CB418)

explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

HTTP traffic detected: POST /ccm/collect?en=page_view&dr=l.wl.co&dl=https%3A%2F%2Fqr-codes.io%2FahBobi&scrsrc=www.googletagmanager.com&frm=0&rnd=1153948641.1736959358&auid=1381957673.1736959358&navt=n&npa=0&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1736959358072&tfd=2976&apve=1 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://qr-codes.ioX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://qr-codes.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=PJy21mGiYU6QUCRbSAEgwzWSBZuV7b64Bicn4EGA9zIsBv70ecHnf6tAGDPaQkCZz2PZlc4WKQqg0-bNJ-3d27EnUoBDs-IoTc-WSyoopKTsRJmzD7Lt6Y9l22_9MwdywuInuwqvf-waxrPjueWhm-gw2XyKgD-wh58MUyfn7v-QfhEU8a45GJavgG38eLTL

Source: explorer.exe, 00000013.00000002.2463847073.0000000007282000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2215752801.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000088E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000013.00000002.2463847073.0000000007282000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2215752801.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000088E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000013.00000002.2463847073.0000000007282000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2215752801.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000088E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: chromecache_106.1.dr, chromecache_99.1.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_105.1.dr	String found in binary or memory: http://jqueryui.com
Source: explorer.exe, 00000013.00000002.2463847073.0000000007282000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2215752801.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000088E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000013.00000000.2215752801.00000000071CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000013.00000002.2447815240.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000013.00000000.2213690231.00000000025F0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: osk.exe, 00000012.00000002.2459260722.000001DBE4E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or?O
Source: osk.exe, 00000012.00000002.2459260722.000001DBE4E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.orpB
Source: explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppche_16.dbK
Source: chromecache_103.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS0
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS2F
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSdf
Source: explorer.exe, 00000013.00000002.2474666087.0000000008759000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.0000000008710000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000013.00000002.2447815240.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2459186587.0000000002F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2214164002.0000000002F60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2213066851.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000013.00000000.2222954198.0000000008816000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2474666087.000000000881E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=BD3E37D8C4964A928E655AAA177D65C1&timeOut=5000&oc
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2214164002.0000000002F60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000013.00000000.2222954198.00000000087E2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2474666087.0000000008802000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/WindyV2.svg
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://becausemomsays.com/she-wanted-to-keep-her-deceased-husbands-ring-so-she-selfishly-denied-her
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: chromecache_106.1.dr, chromecache_99.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chromecache_113.1.dr, chromecache_101.1.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_109.1.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_113.1.dr, chromecache_101.1.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cookpolitical.com/2020-national-popular-vote-tracker
Source: chromecache_106.1.dr, chromecache_99.1.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comA
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://financebuzz.com/top-signs-of-financial-fitness?utm_source=msn&utm_medium=feed&synd_slide=1&s
Source: chromecache_103.1.dr	String found in binary or memory: https://google.com
Source: chromecache_103.1.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA10WNpO.img
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bAqmF.img
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hMa61.img
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: chromecache_87.1.dr, chromecache_89.1.dr	String found in binary or memory: https://jqueryvalidation.org/
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/333EUydyi8ioCvL.gif)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/7eHlJ0EDZSYjbs0.gif)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/BgnVchebDR5Ds4h.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/CjbL$jCCegyfqZ7.woff)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/FX6h9VM2me5K$H-.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/JJsp0ZvgpfwzJM6.woff)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/TyANmxsujxhrKyt.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/kfKKBuoqcD$AUKL.woff)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/mm6OmirOcWIcIVK.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/mzVbGSgvdBfRLX9.woff)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/o0-5CNwwMa9asQf.gif)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/r9duepjHJT2L7Hf.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/sktJnmT4OU1D7IH.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/tRfJHOgYB6QY-yf.gif)
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/ydDD9hnRfziI$y7.png);
Source: chromecache_108.1.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/yjhdAZvUlA6DD-t.gif)
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://news.gallup.com/poll/247016/conservatives-greatly-outnumber-liberals-states.aspx
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comsoft.A
Source: chromecache_103.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/politics/states-most-conservatives-0
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_106.1.dr, chromecache_99.1.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_109.1.dr	String found in binary or memory: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/?yyy
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wigreports.com/about/
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000013.00000000.2222954198.0000000008AA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/gr.exel
Source: explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com8E
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.270towin.com/
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.financebuzz.com/clever-debt-payoff-55mp?utm_source=msn&utm_medium=feed&synd_slide=1&synd
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.forbes.com/sites/elanagross/2020/10/28/trump-administration-uses-philadelphia-protests-t
Source: chromecache_103.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_93.1.dr, chromecache_91.1.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/None/?random
Source: chromecache_103.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_103.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_109.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-None
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/autos/buying/if-your-old-car-has-any-of-these-16-problems-consider-buying-
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/scientists-reveal-new-findings-about-older-adults-who-take-
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/15-attributes-of-truly-good-men/ss-AA1hJKQY
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/there-are-8-types-of-intelligence-which-one-is-yo
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/if-any-of-these-11-things-describes-you-you-ve-climb
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/george-santos-former-campaign-treasurer-pleads-guilty-to-fed
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/the-state-with-the-most-liberals-isn-t-userfornia-or-new-yor
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-asks-for-jan-6-dismissal-because-coup-attempt-was-part
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/russian-official-proposes-invading-five-nato-countries/ar-AA1hJ
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/the-nobel-peace-prize-will-be-announced-in-oslo-the-laureate-is
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.theatlantic.com/politics/archive/2014/02/the-origin-of-liberalism/283780/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global event hook (focus changed)

Source: C:\Windows\System32\osk.exe

Windows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL

Jump to behavior

Installs a global keyboard hook

Source: C:\Windows\System32\osk.exe	Windows user hook set: 0 keyboard low level C:\Windows\system32\osk.exe	Jump to behavior
Source: C:\Windows\System32\osk.exe	Windows user hook set: 4576 call wnd proc C:\Windows\System32\uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Windows user hook set: 4576 get message C:\Windows\System32\uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Windows user hook set: 0 shell C:\Windows\system32\OskSupport.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Windows user hook set: 0 mouse low level C:\Windows\system32\osk.exe	Jump to behavior
Source: C:\Windows\System32\osk.exe	Windows user hook set: 0 keyboard low level C:\Windows\system32\osk.exe	Jump to behavior

Source: C:\Windows\System32\osk.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\osk.exe

Jump to behavior

Source: classification engine

Classification label: mal60.phis.spyw.win@25/58@44/16

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\osk.exe

Mutant created: \Sessions\1\BaseNamedObjects\OSKRunning

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\osk.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1920,i,2890419108035875567,11107966622946554112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ"
Source: unknown	Process created: C:\Windows\System32\osk.exe "C:\Windows\system32\osk.exe"
Source: unknown	Process created: C:\Windows\System32\osk.exe "C:\Windows\system32\osk.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1920,i,2890419108035875567,11107966622946554112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\osk.exe	Section loaded: osksupport.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: wmsgapi.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: mstextprediction.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\osk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior

Source: C:\Windows\System32\osk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29CE1D46-B481-4AA0-A08A-D3EBC8ACA402}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\explorer.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: explorer.exe, 00000013.00000000.2222954198.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000T
Source: explorer.exe, 00000013.00000000.2215752801.00000000071FF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W6
Source: explorer.exe, 00000013.00000000.2222954198.00000000088E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000nf
Source: explorer.exe, 00000013.00000002.2474666087.000000000879C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.0000000008770000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUSm32\DriverStore\en-US\usb.inf_locK
Source: explorer.exe, 00000013.00000000.2222954198.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00lT8
Source: explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: explorer.exe, 00000013.00000000.2213066851.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000013.00000002.2474666087.00000000088B3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2474666087.00000000088DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000013.00000000.2213066851.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000q;
Source: explorer.exe, 00000013.00000000.2222954198.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}9d2}i
Source: explorer.exe, 00000013.00000000.2213066851.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000013.00000000.2222954198.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000013.00000002.2474666087.000000000893C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: explorer.exe, 00000013.00000002.2456210731.0000000001114000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000013.00000002.2463558690.0000000004550000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000013.00000000.2213539545.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000013.00000002.2447815240.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2213066851.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Progman
Source: explorer.exe, 00000013.00000002.2456210731.000000000111B000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000013.00000000.2213539545.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: bProgram Manager]
Source: explorer.exe, 00000013.00000000.2213539545.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	2 Process Injection	3 Masquerading	1 Credential API Hooking	1 Security Software Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	2 Process Injection	111 Input Capture	1 Process Discovery	Remote Desktop Protocol	111 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.financebuzz.com/clever-debt-payoff-55mp?utm_source=msn&utm_medium=feed&synd_slide=1&synd	0%	Avira URL Cloud	safe
https://wigreports.com/about/	0%	Avira URL Cloud	safe
http://www.w3.orpB	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOSdf	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb	0%	Avira URL Cloud	safe
http://www.w3.or?O	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOS2F	0%	Avira URL Cloud	safe
https://outlook.comsoft.A	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOS0	0%	Avira URL Cloud	safe
https://word.office.com8E	0%	Avira URL Cloud	safe
https://excel.office.comA	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark	0%	Avira URL Cloud	safe
https://becausemomsays.com/she-wanted-to-keep-her-deceased-husbands-ring-so-she-selfishly-denied-her	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.185.110	true	false	high
star.c10r.facebook.com	157.240.0.13	true	false	high
scontent.xx.fbcdn.net	157.240.252.13	true	false	high
verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	104.21.79.87	true	false	high
googleads.g.doubleclick.net	142.250.185.194	true	false	high
qr-codes.io	18.245.46.111	true	false	high
www.google.com	142.250.185.100	true	false	high
td.doubleclick.net	142.250.184.194	true	false	high
googlehosted.l.googleusercontent.com	216.58.212.129	true	false	high
media.amazon.map.fastly.net	151.101.129.16	true	false	high
w3valid.com	unknown	unknown	true	unknown
m.media-amazon.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
l.wl.co	unknown	unknown	false	high
lh7-rt.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png	false	high
https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ	false	high
https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2	false	high
https://connect.facebook.net/en_US/fbevents.js	false	high
https://qr-codes.io/ahBobi	false	high
https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2	false	high
https://l.wl.co/l?u=https://qr-codes.io/ahBobi	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000013.00000000.2222954198.0000000008816000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2474666087.000000000881E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/ydDD9hnRfziI$y7.png);	chromecache_108.1.dr	false		high
https://www.msn.com/en-us/news/politics/trump-asks-for-jan-6-dismissal-because-coup-attempt-was-part	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/TyANmxsujxhrKyt.png);	chromecache_108.1.dr	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2214164002.0000000002F60000.00000004.00000001.00020000.00000000.sdmp	false		high
http://jqueryui.com	chromecache_105.1.dr	false		high
https://news.gallup.com/poll/247016/conservatives-greatly-outnumber-liberals-states.aspx	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/the-state-with-the-most-liberals-isn-t-userfornia-or-new-yor	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000013.00000000.2213690231.00000000025F0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/mm6OmirOcWIcIVK.png);	chromecache_108.1.dr	false		high
https://www.270towin.com/	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/o0-5CNwwMa9asQf.gif)	chromecache_108.1.dr	false		high
https://wns.windows.com/gr.exel	explorer.exe, 00000013.00000000.2222954198.0000000008AA9000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.w3.orpB	osk.exe, 00000012.00000002.2459260722.000001DBE4E11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_103.1.dr	false		high
https://www.msn.com/en-us/news/world/russian-official-proposes-invading-five-nato-countries/ar-AA1hJ	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSdf	explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/sktJnmT4OU1D7IH.png);	chromecache_108.1.dr	false		high
https://m.media-amazon.com/images/S/sash/tRfJHOgYB6QY-yf.gif)	chromecache_108.1.dr	false		high
https://www.theatlantic.com/politics/archive/2014/02/the-origin-of-liberalism/283780/	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.financebuzz.com/clever-debt-payoff-55mp?utm_source=msn&utm_medium=feed&synd_slide=1&synd	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2)	chromecache_108.1.dr	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppche_16.dbK	explorer.exe, 00000013.00000000.2222954198.0000000008888000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/george-santos-former-campaign-treasurer-pleads-guilty-to-fed	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/WindyV2.svg	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.w3.or?O	osk.exe, 00000012.00000002.2459260722.000001DBE4E11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/the-nobel-peace-prize-will-be-announced-in-oslo-the-laureate-is	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS2F	explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jqueryvalidation.org/	chromecache_87.1.dr, chromecache_89.1.dr	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/there-are-8-types-of-intelligence-which-one-is-yo	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/BgnVchebDR5Ds4h.png);	chromecache_108.1.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_106.1.dr, chromecache_99.1.dr	false		high
https://wigreports.com/about/	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.media-amazon.com/images/S/sash/yjhdAZvUlA6DD-t.gif)	chromecache_108.1.dr	false		high
https://m.media-amazon.com/images/S/sash/7eHlJ0EDZSYjbs0.gif)	chromecache_108.1.dr	false		high
https://googleads.g.doubleclick.net	chromecache_103.1.dr	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/15-attributes-of-truly-good-men/ss-AA1hJKQY	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/r9duepjHJT2L7Hf.png);	chromecache_108.1.dr	false		high
https://powerpoint.office.com	explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.comsoft.A	explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micr	explorer.exe, 00000013.00000002.2447815240.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://financebuzz.com/top-signs-of-financial-fitness?utm_source=msn&utm_medium=feed&synd_slide=1&s	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/JJsp0ZvgpfwzJM6.woff)	chromecache_108.1.dr	false		high
https://cct.google/taggy/agent.js	chromecache_107.1.dr, chromecache_103.1.dr	false		high
https://cookpolitical.com/2020-national-popular-vote-tracker	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2)	chromecache_108.1.dr	false		high
https://www.msn.com/en-us/money/personalfinance/if-any-of-these-11-things-describes-you-you-ve-climb	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/CjbL$jCCegyfqZ7.woff)	chromecache_108.1.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_106.1.dr, chromecache_99.1.dr	false		high
https://connect.facebook.net/	chromecache_113.1.dr, chromecache_101.1.dr	false		high
https://m.media-amazon.com/images/S/sash/mzVbGSgvdBfRLX9.woff)	chromecache_108.1.dr	false		high
https://stacker.com/politics/states-most-conservatives-0	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m.media-amazon.com/images/S/sash/FX6h9VM2me5K$H-.png);	chromecache_108.1.dr	false		high
https://m.media-amazon.com/images/S/sash/333EUydyi8ioCvL.gif)	chromecache_108.1.dr	false		high
https://td.doubleclick.net	chromecache_107.1.dr, chromecache_103.1.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	false		high
https://connect.facebook.net/log/fbevents_telemetry/	chromecache_113.1.dr, chromecache_101.1.dr	false		high
https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2)	chromecache_108.1.dr	false		high
https://www.forbes.com/sites/elanagross/2020/10/28/trump-administration-uses-philadelphia-protests-t	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS0	explorer.exe, 00000013.00000000.2232641053.000000000BF18000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.2485604951.000000000BF31000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=BD3E37D8C4964A928E655AAA177D65C1&timeOut=5000&oc	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/pagead/1p-user-list/None/?random	chromecache_93.1.dr, chromecache_91.1.dr	false		high
https://m.media-amazon.com/images/S/sash/kfKKBuoqcD$AUKL.woff)	chromecache_108.1.dr	false		high
https://word.office.com8E	explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/autos/buying/if-your-old-car-has-any-of-these-16-problems-consider-buying-	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000013.00000002.2474666087.0000000008759000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000013.00000000.2222954198.0000000008710000.00000004.00000001.00020000.00000000.sdmp	false		high
https://google.com	chromecache_103.1.dr	false		high
https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2)	chromecache_108.1.dr	false		high
https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png);	chromecache_108.1.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/health/medical/scientists-reveal-new-findings-about-older-adults-who-take-	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comA	explorer.exe, 00000013.00000000.2232641053.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stacker.com/	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://adservice.google.com/pagead/regclk?	chromecache_103.1.dr	false		high
https://m.media-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png);	chromecache_108.1.dr	false		high
https://becausemomsays.com/she-wanted-to-keep-her-deceased-husbands-ring-so-she-selfishly-denied-her	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	explorer.exe, 00000013.00000000.2215752801.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.16	unknown	United States	54113	FASTLYUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
216.58.212.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
151.101.129.16	media.amazon.map.fastly.net	United States	54113	FASTLYUS	false
157.240.252.13	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.184.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.0.13	star.c10r.facebook.com	United States	32934	FACEBOOKUS	false
18.245.46.111	qr-codes.io	United States	16509	AMAZON-02US	false
104.21.79.87	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.97	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.18

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592045
Start date and time:	2025-01-15 17:41:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.spyw.win@25/58@44/16
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, consent.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99, 172.217.16.206, 142.251.168.84, 199.232.214.172, 142.250.185.110, 216.58.206.78, 142.250.181.238, 142.250.184.227, 142.250.185.67, 142.250.186.163, 142.250.185.232, 172.217.16.200, 142.250.181.232, 216.58.206.46, 172.217.16.202, 142.250.185.106, 142.250.184.234, 142.250.184.202, 142.250.186.170, 142.250.185.170, 142.250.186.106, 172.217.18.10, 142.250.185.234, 216.58.206.74, 142.250.185.202, 216.58.206.42, 142.250.185.74, 142.250.186.138, 142.250.185.138, 142.250.181.234, 142.250.185.206, 142.250.186.78, 142.250.184.206, 216.58.212.131, 142.250.185.238, 142.250.186.174, 216.58.212.142, 2.23.242.162, 52.149.20.212, 204.79.197.200, 23.1.33.206, 40.126.32.138, 51.104.15.253, 204.79.197.222, 150.171.84.254, 13.107.246.254
Excluded domains from analysis (whitelisted): clients1.google.com, www.bing.com, fp.msedge.net, p-ring.msedge.net, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, t-ring.msedge.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, www.googletagmanager.com, r.bing.com, update.googleapis.com, clients.l.google.com, browser.pipe.aria.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ

Simulations

Behavior and APIs

Time	Type	Description
11:44:24	API Interceptor	2x Sleep call for process: explorer.exe modified

LLM Input / Output

Input	Output
URL: https://docs.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This is a legitimate Google Docs URL with the official google.com domain. The subdomain 'docs' is a known Google service, and the URL structure is standard for Google's documentation platform." }
URL: https://docs.google.com
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscated code. The script is likely used for legitimate web development purposes and poses a low risk." }
/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g;w.fn=w.prototype={jquery:"3.3.1",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:n.sort,splice:n.splice},w.extend=w.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArray(n)?n:[]):o=n&&w.isPlainObject(n)?n:{},a[t]=w.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},w.extend({expando:"jQuery"+("3.3.1"+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==c.call(e))&&(!(t=i(e))\|\|"function"==typeof(n=f.call(t,"constructor")&&t.constructor)&&p.call(n)===d)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e){m(e)},each:function(e,t){var n,r=0;if(C(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(T,"")},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(C(Object(e))?w.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:u.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r,i=[],o=0,a=e.length,s=!n;o<a;o++)(r=!t(e[o],o))!==s&&i.push(e[o]);return i},map:function(e,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){l["[object "+t+"]"]=t.toLowerCase()});function C(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!g(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b="sizzle"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;re
URL: https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To prevent misuse on Amazon accounts, System requires verification from the original account owner and will immediately match the Information contained in the account to ensure that the account really belongs to you.", "prominent_button_name": "Continue Verification", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ Model: Joe Sandbox AI	{ "brands": [ "Amazon" ] }
	{ "brands": [ "Amazon" ] }
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email or mobile phone number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "brands": [ "Amazon" ] }
	{ "brands": [ "Amazon" ] }
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	```json{ "legit_domain": "amazon.com", "classification": "wellknown", "reasons": [ "The URL 'verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id' does not match the legitimate domain 'amazon.com'.", "The domain contains suspicious elements such as unusual subdomains and a non-standard domain extension '.biz.id'.", "The URL includes multiple concatenated words that are not typically associated with Amazon's legitimate URLs.", "Amazon is a well-known brand, and its legitimate domain is widely recognized as 'amazon.com'.", "The presence of input fields for 'Email or mobile phone number' is common in phishing attempts targeting Amazon users." ], "riskscore": 9} Google indexed: False
URL: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Brands: Amazon Input Fields: Email or mobile phone number
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email or mobile phone number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "brands": [ "Amazon" ] }
	{ "brands": [ "Amazon" ] }
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email or mobile phone number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	{ "brands": [ "Amazon" ] }
	{ "brands": [ "Amazon" ] }
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	```json{ "legit_domain": "amazon.com", "classification": "wellknown", "reasons": [ "The brand 'Amazon' is well-known and typically associated with the domain 'amazon.com'.", "The URL 'verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id' does not match the legitimate domain 'amazon.com'.", "The URL contains suspicious elements such as unusual domain extension '.biz.id' and a long, complex subdomain which is not typical for Amazon.", "The presence of words like 'verify', 'secure', and 'new account' in the URL are common phishing indicators.", "The domain does not have any direct association with Amazon, increasing the likelihood of phishing." ], "riskscore": 9} Google indexed: False
URL: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Brands: Amazon Input Fields: Email or mobile phone number
URL: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Model: Joe Sandbox AI	```json{ "legit_domain": "amazon.com", "classification": "wellknown", "reasons": [ "The URL does not match the legitimate domain name for Amazon, which is amazon.com.", "The domain contains suspicious elements such as 'verifynwebappsecurenewaccmanges', which are not associated with Amazon.", "The domain extension '.biz.id' is unusual for Amazon, which typically uses '.com'.", "The presence of multiple concatenated words and unusual characters in the domain name is a common phishing tactic.", "The input fields 'Email or mobile phone number' are typical for phishing attempts targeting Amazon users." ], "riskscore": 9} Google indexed: False
URL: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Brands: Amazon Input Fields: Email or mobile phone number

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:42:24 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.984810688210726
Encrypted:	false
SSDEEP:	48:8Od5OTZKSRzHbZidAKZdA1FehwiZUklqehNy+3:85nzKy
MD5:	2C0AF5EA3999F61DDE86F20925E38995
SHA1:	E4F3275440F2E3CD710B47BACE283D6CAC5DFC0E
SHA-256:	1E0F9A747403C1E90267CC0764AA0EFFEEA1E581C81460B29F0B4D4AA8E07061
SHA-512:	434F92156F57586DB2EA6488DF115FDDA8C1D02B9E72669C9EA91007DFBABD7319473319345A78C04AC035BE8DE2747F63E09B0FFF9BD796EFBB06F6356D9A0F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....@.8tlg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/ZL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:42:24 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.002187320399339
Encrypted:	false
SSDEEP:	48:8Jd5OTZKSRzHbZidAKZdA1seh/iZUkAQkqeh6y+2:84nd9Q/y
MD5:	91432852D48536508089F3D1293110C8
SHA1:	A89B70F1E40D24624C273694C3885D51DE21B3B1
SHA-256:	FA46B442088FEB1A7EA2847DE6A8EF55C39FC722A0A0BB02A531B141513509A0
SHA-512:	4505C5946616BFF3DD6ED997EC7019A96B75B039FACB127AD14C88F00BB390047671B45660D208556A964FEECC288A46248A05A21E5B5844643FE1AD98584E48
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Vtlg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/ZL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.015350906425909
Encrypted:	false
SSDEEP:	48:8wd5OTZKSRAHbZidAKZdA14meh7sFiZUkmgqeh7s8y+BX:8vn8n2y
MD5:	629D09CC4351C488A4B31BD42108770C
SHA1:	B83D17AB2FA720BE9C55C8778BDB79D6CCD293C3
SHA-256:	54B4B74ADE8A2251B39D5AE1397FABE6BCFA66206EEDBD38BDAC97A2DBA99A5C
SHA-512:	456715B8321EDC978469FEBCE165D667ABF48BE33C409C90D5CDF0D952F0A4AB0CE425FDD9C3AB03CFF487C49C9C99B290E4BB29B05CC467AA5AE18A9D6A1B2C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:42:24 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001545112488019
Encrypted:	false
SSDEEP:	48:8ed5OTZKSRzHbZidAKZdA1TehDiZUkwqehOy+R:8pnu0y
MD5:	DC20B9A872CD6EC572F061C022F15B3D
SHA1:	7474DCEE553FE50DE9623A2A0F1DFA9F85B8D98C
SHA-256:	F5F61D15774BA83728B07CABDCC42A85A14CC80EBA7945A4B729A056127F8483
SHA-512:	1AC9B7AB216B36767417906E4ACA8535A9F1231C1A2AAAE13FE41137656CBA6A9D6B1690E64390E2D69A874D88DEC544B491BB72F345AA9D903CAE4E769A2664
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....[."tlg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/ZL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:42:24 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987944189609457
Encrypted:	false
SSDEEP:	48:8bd5OTZKSRzHbZidAKZdA1dehBiZUk1W1qehYy+C:8On+94y
MD5:	22566171497E4B2F544763E270C3ACD6
SHA1:	D49D0BF68D19A61EBA42C3F42D5B8598EB7E3F1A
SHA-256:	818E07CE7913C0321F0FE997DA9CBE357FA2B90D28C764860E50E3EFBE2CE404
SHA-512:	19F5668B8C0659579C1F90C44C9800D95DF85EA880E59FCB6F1A435B44843B663574EA8B3463BF5F8E7907D4A7780010DF9D9B23891A10D973E29CE57CACD22F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......1tlg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/ZL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:42:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9968634156857745
Encrypted:	false
SSDEEP:	48:8Ld5OTZKSRzHbZidAKZdA1duTeehOuTbbiZUk5OjqehOuTb2y+yT+:8en0TfTbxWOvTb2y7T
MD5:	EB65B42FE8A7E6F5F2A2E747C1123C1B
SHA1:	60C6F1340E600A422F54A3A04044D43F23C14127
SHA-256:	D0EDA27A8B67D6514A64E17B7BEEB939A09125C862C15D1BD8FCFD81820994B8
SHA-512:	303F533B52D136D589F7210BEE0DC031C00726EE0B5C8072876A6092AFDCEE75F6A3E2B98DB5A9A455A5C71E323A2AB186B2AF84BB75CCFEB4B830F1F0334B55
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....U.tlg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZB.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/ZK.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/ZK.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/ZK............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/ZL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............j......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 750, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	27972
Entropy (8bit):	7.9746563718982335
Encrypted:	false
SSDEEP:	768:PYh3ZcLbZnL3Azzh2/99/KL6sFxvjCENS:A8397Afhgjq6yv9NS
MD5:	1B5A1FB097715B1604B21ABA92EF6A3E
SHA1:	C4A765AEDD886DC04D89E7E93B6A02C59ECB7013
SHA-256:	437E95A363A4291060E34BA170E043274E0155821E9BE374F35DE3C4F13CBAA5
SHA-512:	0DD02CB398A22092732CFAE2B141F5327360A42E931AFD27AAF8EAE402C8C36EF0BB5EDEA82EB39E66567DAED1CAA79B70CA4BF41D30387653563D0A78AB9B0E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................PLTE...AC.38.'0")0!"NT[......333............dim/8@/8A`goWVS. !...QV\...bejeee>AC......[bj}..PW`YtS............mwxjpv...MSY`fi;=@KR[......_di......djr....................................V]e...u....8,3..!..2..:...u..v....=?A,..j.......8...m.02.u..@).ojBGL0....."....8>D.n...2..9;=.>/..B..[........@@A.v......D4.)."..J.B? ..H..432...\.[..:H..#)-....* ...............................B.......................#......G.......P..J..:.................B..9..int.s..d.5g....I..9..I..jqwqz}.]I.. ..D.....E..$.......T....]...=..............cgk.....L...t.vm.OM.+......+.g...#........'..Q.ZY.%.f@.y................................P.1..<...N./..>......................s.i...P.........}...y...........;..;.F5.G6........%.............(Z"....tRNS..................<.......{...%Zk.I....F~.......................Z<.......]...t..}.`'......h.....;....{..K..........L......^..e....B.*b.\|..............d.....O....................

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9330)
Category:	downloaded
Size (bytes):	245409
Entropy (8bit):	5.454168929252601
Encrypted:	false
SSDEEP:	3072:yFLeYH8nXWJy37Oeu8NteqZEbkxZNsucrl0xYurPK7d3NK:yFLeYcXWJyg8NNfFcrHurPK7d3o
MD5:	F547D747E9E60D71AA3807DDC2850E00
SHA1:	D39E913B4011358F3BE7FCCCC95EFB2BA4C6C5E0
SHA-256:	A02ACCE44F2C6DF068972D20E54F5B2632F994DB79A2ED7F907FD378033411EF
SHA-512:	76B5EBE74800CD5E30AED9874DF4CACDEA55032DC1952F0C8A5FD625263F74582DFFAE0BFF3D6906D85B59D79C46C61876394EE8523DA9F24F059EA045403FCE
Malicious:	false
Reputation:	low
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	2.247918084411713
Encrypted:	false
SSDEEP:	192:9dLhJ6/f2dh+xQLeZ10TLwhwOHae6nmErcglsIZS3F:3jaOdhQQu0TLwaOHEr6IZ
MD5:	CA6619B86C2F6E6068B69BA3AADDB7E4
SHA1:	C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
SHA-256:	17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
SHA-512:	30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
Malicious:	false
Reputation:	low
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2319)
Category:	dropped
Size (bytes):	260251
Entropy (8bit):	5.549638126225851
Encrypted:	false
SSDEEP:	3072:L23a49wyIJ/rt0H2w0xPG62WL+vvAf2zBOe95YtQ/nOqSFjGgMShTVLsiTQ7QG7:isyIJDt0HUuICv9KtyCFjGgMShpQf
MD5:	4F6BD69F0C414557707695BDABA62FAF
SHA1:	D92210BAA3268B18909FBC4217BA8156F90AFE4A
SHA-256:	B5862A3B79D6B55361938CF51E4867F16FBA4639250E05FECDF247F7D30458A2
SHA-512:	5D38C935CEADC99A59335597AD7FE3C5BE5AFC423C863C6497AC7276B081F86B096D3125CE226E593306364646A5AC5685AF0D39EC0CD91AAF66CCA136A0C46D
Malicious:	false
Reputation:	low
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	312625
Entropy (8bit):	4.963942571669202
Encrypted:	false
SSDEEP:	6144:tSDeU0O25fHOCyPJJpU1xBVTOB8wMYvXQ++JPBVegy0:tSDeU0O25fHOCyPJJpU1xBVTOB8wM6Ad
MD5:	A6115498F2B7DE2DEEA929F08706A659
SHA1:	787D1B60B9F7BCFDB51B863FFAFD4DD3EA661AFE
SHA-256:	0FAD9833603F368C1C73E4ED2AC59CCEA1E1C05EBA98B635AFE5656FA1D8E3CC
SHA-512:	62FFC92FE4CBE7203F4185BF25514B1E8F0E1FD0DF03E638E183E3629644D4058B280C694F45AE36366739498354F9CC7323B1FD8C31DE5E89D069D388EADD30
Malicious:	false
Reputation:	low
URL:	https://docs.google.com/static/drawings/client/css/3590561575-preview_css_ltr.css
Preview:	.jfk-butterBar{border-radius:2px;box-shadow:0 2px 4px rgba(0,0,0,.2);transition:all 0s linear 1s,opacity 1s;border-style:solid;border-width:0;font-size:11px;height:0;opacity:0;visibility:hidden;overflow:hidden;padding:0;text-align:center}.jfk-butterBar-info{background-color:#f9edbe;border-color:#f0c36d;color:#333}.jfk-butterBar-error{background-color:#484848;border-color:#202020;color:#fff}.jfk-butterBar-promo{background-color:#d6e9f8;border-color:#4d90f0;color:#333}.jfk-butterBar-warning{background-color:#dd4b39;border-color:#602019;color:#fff}.jfk-butterBar-shown{transition:opacity .218s;border-width:1px;min-height:14px;height:auto;opacity:1;visibility:visible;padding:6px 16px}.jfk-butterBar-mini.jfk-butterBar-shown{padding:2px 16px}.docs-butterbar-container{font-weight:500;height:0;position:absolute;text-align:center;top:32px;width:100%;z-index:1004}.docs-hub-butterbar{top:57px}.docs-gm .docs-butterbar-container{font-weight:400}.docs-butterbar-container.docs-butterbar-container-comp

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	44615
Entropy (8bit):	5.1084376622888845
Encrypted:	false
SSDEEP:	384:bbrOlO0WiHRWou6lfN/GyukwQmgZpEimDCD77TVeyIV:Q3fNQQmgZpEimDCDHTVeyIV
MD5:	DDC57095E72F26D3B1AC81E4CBD72BF3
SHA1:	80E613DBB5630EB700F9E3270EBFBF082744D283
SHA-256:	ED3B195F7EE2EB721B73C6EBBA1D4E6ED3FC326DFC25A0837D39DD590E9DE748
SHA-512:	470281ED0EA7EC6185F1E1722B7FCD6C0BB59CA163EBB534EC4FD3DC71C76A38F1E78D15DC4C35E075AC78D6FF47509DB67D277E56148804FDBF4A2F03896454
Malicious:	false
Reputation:	low
URL:	https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/css/style.sign-desktop.css
Preview:	.ui-helper-hidden {.. display: none;..}...ui-helper-hidden-accessible {.. border: 0;.. clip: rect(0 0 0 0);.. height: 1px;.. margin: -1px;.. overflow: hidden;.. padding: 0;.. position: absolute;.. width: 1px;..}...ui-helper-reset {.. margin: 0;.. padding: 0;.. border: 0;.. outline: 0;.. line-height: 1.3;.. text-decoration: none;.. font-size: 100%;.. list-style: none;..}...ui-helper-clearfix:after,...ui-helper-clearfix:before {.. content: "";.. display: table;.. border-collapse: collapse;..}...ui-helper-clearfix:after {.. clear: both;..}...ui-helper-clearfix {.. min-height: 0;..}...ui-helper-zfix {.. width: 100%;.. height: 100%;.. top: 0;.. left: 0;.. position: absolute;.. opacity: 0;.. filter: Alpha(Opacity=0);..}...ui-front {.. z-index: 100;..}...ui-state-disabled {.. cursor: default !important;..}...ui-icon {.. display: block;.. text-indent: -99999px;.. overflow: hidden;.. background-repeat: no-repeat;..}...ui-widget-overlay {.. position: fixed;..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3855)
Category:	downloaded
Size (bytes):	142466
Entropy (8bit):	5.469910909891601
Encrypted:	false
SSDEEP:	1536:kyG2Qq1GjpgMaEkuKImeaEMKJV9BR1mUzxVZG15EMg0BuIy2lX7Dkkl43hbIabO:k6EboeQUtXG3lu8b4tO
MD5:	406995DB3B77760B7BF9E0845A4A4018
SHA1:	2BCB02F8FD8007B6F5E7B6DC66804B57206000C2
SHA-256:	DE2F36278164EE094BEBD92A203D14B232F99B28CB1358679465AF9E321791E8
SHA-512:	2BA1C53F304BB9EBB39EA9C79C7B8DB3B4425B39C19CAA45D5BFD302803405F1543C6596018A5418F67AAE8B12BCA419D2667EADCD6D061D18D49AAFADF3F5E4
Malicious:	false
Reputation:	low
URL:	https://docs.google.com/static/drawings/client/js/2566868265-preview_core.js
Preview:	function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="Edge",ba="Error in protected function: ",ca="Missing error cause.",da="Not available",ea="SCRIPT",fa="_/wa/",ha="apps_telemetry.processed",ia="attributionsrc",ja="bigint",ka="boolean",la="buildLabel",ma="complete",na="error",pa="fatal",n="function",qa="gssmodulesetproto",ra="iPad",sa="iPod",ua="incident",va="jsaction",wa="kaspersky-labs",xa="neurosurgeonundergo",r="number",u="object",ya="prerender",za="severity",Aa="severity-unprefixed",w="string",Ba="success",Ca="true",Da="unhandledrejection";.function Ea(){return function(a){return a}}function x(){return function(){}}function Fa(a){return function(){return this[a]}}function Ga(a){return function(){return a}}var y;function Ha(a){var c=0;return function(){return c<a.length?{done:!1,value:a

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2319)
Category:	downloaded
Size (bytes):	260251
Entropy (8bit):	5.549638126225851
Encrypted:	false
SSDEEP:	3072:L23a49wyIJ/rt0H2w0xPG62WL+vvAf2zBOe95YtQ/nOqSFjGgMShTVLsiTQ7QG7:isyIJDt0HUuICv9KtyCFjGgMShpQf
MD5:	4F6BD69F0C414557707695BDABA62FAF
SHA1:	D92210BAA3268B18909FBC4217BA8156F90AFE4A
SHA-256:	B5862A3B79D6B55361938CF51E4867F16FBA4639250E05FECDF247F7D30458A2
SHA-512:	5D38C935CEADC99A59335597AD7FE3C5BE5AFC423C863C6497AC7276B081F86B096D3125CE226E593306364646A5AC5685AF0D39EC0CD91AAF66CCA136A0C46D
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=AW-None
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	164060
Entropy (8bit):	5.042562451647561
Encrypted:	false
SSDEEP:	3072:8Z27NNRBx5Flwm/QKo5gEZTcuKt75IKJT8jY1UfqKuFiIpVlM:8Z27NNRBx/KuFfO
MD5:	B1416059599B53FD00EDC1FF854DF185
SHA1:	A2571381CB930F314A5F0A6B5E1B0FF1BC3230AF
SHA-256:	80ED31BAE4CA3B2B76812E36647B853B5B0EE0460C76625F772487F7CA32CDCD
SHA-512:	9E55EA5A58D8B3C6C49176AD4EC4CBF633267458FA0D88EE2552E732BAB299217D3758672C27A77986DEEB62D6A899F8F508B722C32880A8FC898F67AAFA1719
Malicious:	false
Reputation:	low
URL:	https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/css/sign-dekstop.css
Preview:	* {.. -moz-box-sizing: border-box;.. -webkit-box-sizing: border-box;.. box-sizing: border-box;..}..body {.. min-height: 100%;..}..article,..aside,..details,..figcaption,..figure,..footer,..header,..hgroup,..nav,..section {.. display: block;..}..audio,..canvas,..video {.. display: inline-block;..}..audio:not([controls]) {.. display: none;..}..html {.. font-size: 100%;.. -webkit-text-size-adjust: 100%;..}..pre {.. margin: 0;..}..a:focus {.. outline: thin dotted #333;.. outline: 5px auto -webkit-focus-ring-color;.. outline-offset: -2px;..}..a:active,..a:hover {.. outline: 0;..}..sub,..sup {.. position: relative;.. font-size: 75%;.. line-height: 0;.. vertical-align: baseline;..}..sup {.. top: -0.5em;..}..sub {.. bottom: -0.25em;..}..abbr {.. border-bottom: 0 none;..}..img {.. max-width: 100%;.. border: 0;..}..button,..input,..select,..textarea {.. margin: 0;.. font-size: 100%;.. vertical-align: middle;..}..button,..input {.. line-height: normal;..}..button::-moz-

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	3222
Entropy (8bit):	4.750619341540391
Encrypted:	false
SSDEEP:	48:9acfiSZmwsiKjY/1+dDFr5jEite6dZA3Q31jZdlmxdSQY3hQfLUbiKIvy7KrKqk:IoZhrf/1+lYiQ6cA/nmwREIbidE
MD5:	927B9A7B25E96961A0EDE6E4D05CED9E
SHA1:	1BCF26466CE80D3CE32067BAD060964F6C1AB15B
SHA-256:	41669450AA4520FF9E028CAB84708E1F809DC577D2B0EDEF7BFAF1D48D63570F
SHA-512:	5CFEA7762365F60F3D8F49ADC0EE06C580EA08168D3C953B8F500D36443246EDD9E079C9969A4506F2A00E1DEB48A25BC002418D62A73206E76E918EF83A0946
Malicious:	false
Reputation:	low
URL:	https://qr-codes.io/ahBobi
Preview:	<html lang="en">.<head>. Google Analytics -->. .. . End of Google Analytics -->.. Facebook Pixel Code -->. . <script>. !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?. n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;. n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;. t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,. document,'script','https://connect.facebook.net/en_US/fbevents.js');. fbq('init', 'None'); // Insert your pixel ID here.. fbq('track', 'UniqodeQRScans');. var my_event_type = "None";. . fbq('track', my_event_type);. . </script>. <noscript>. <img height="1" width="1" style="display:none". src="https://www.facebook.com/tr?id=None&ev=UniqodeQRScans&noscript=1". /></nosc

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	2.6405445103388026
Encrypted:	false
SSDEEP:	6:a6nvQhIhIhIhIhIhIhIhIhIhIhIhIh6NQhIhIhIhIhIhIhIhIhIhIhIhIhIhIhIL:XvPN5ZNZX5hV
MD5:	45E6383ED6764BCF66BB7CDA685BDEF8
SHA1:	321AE49DC907E998D30E89BFE19B611CFEF2B222
SHA-256:	9FEA566760E23830FB440B59122AFE4636A63E1997DBEAFC60A701BBE213B165
SHA-512:	D1F29A7F13C231AFFD42DACA34E142AE225A50E97D173033F38E977F255B83C78B4AF30969474E59E269310D045DEB2712AA307D4E3301F04496BDD0CAD12B7A
Malicious:	false
Reputation:	low
URL:	https://ssl.gstatic.com/docs/drawings/images/favicon5.ico
Preview:	............ .h.......(....... ..... .....@...................7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..P[..........7D......................7D..7D..7D..7D..7D..7D..v...............7D......................7D..7D..7D..7D..7D..7D..................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..........................P[..7D..7D..7D..7D..7D..7D..7D..7D..7D..DP..................v...7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	107631
Entropy (8bit):	5.372925032739221
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t9fc:5kn6x2xe9NK6nC6jUV
MD5:	D532C905D593A7F16EFF99F24F27621E
SHA1:	EA0F0D16F78EC4BBAF7866213A2F012D2793E14C
SHA-256:	97ECD42DEA3BC998C5EFD456BC13E2C45C700FBA1C581961CA1481676BF08B42
SHA-512:	81D727042F98245DB1A8B66CCA98AB7898E8F98D774E8B3930273F66F3ECE6DB3B20D47598ECF88CF14F96553AB676DC3FCE663BD34F299C72D71BBB82EB245A
Malicious:	false
Reputation:	low
URL:	https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/js/jquery-3.3.1.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9330)
Category:	dropped
Size (bytes):	245409
Entropy (8bit):	5.454168929252601
Encrypted:	false
SSDEEP:	3072:yFLeYH8nXWJy37Oeu8NteqZEbkxZNsucrl0xYurPK7d3NK:yFLeYcXWJyg8NNfFcrHurPK7d3o
MD5:	F547D747E9E60D71AA3807DDC2850E00
SHA1:	D39E913B4011358F3BE7FCCCC95EFB2BA4C6C5E0
SHA-256:	A02ACCE44F2C6DF068972D20E54F5B2632F994DB79A2ED7F907FD378033411EF
SHA-512:	76B5EBE74800CD5E30AED9874DF4CACDEA55032DC1952F0C8A5FD625263F74582DFFAE0BFF3D6906D85B59D79C46C61876394EE8523DA9F24F059EA045403FCE
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	107631
Entropy (8bit):	5.372925032739221
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t9fc:5kn6x2xe9NK6nC6jUV
MD5:	D532C905D593A7F16EFF99F24F27621E
SHA1:	EA0F0D16F78EC4BBAF7866213A2F012D2793E14C
SHA-256:	97ECD42DEA3BC998C5EFD456BC13E2C45C700FBA1C581961CA1481676BF08B42
SHA-512:	81D727042F98245DB1A8B66CCA98AB7898E8F98D774E8B3930273F66F3ECE6DB3B20D47598ECF88CF14F96553AB676DC3FCE663BD34F299C72D71BBB82EB245A
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.6405445103388026
Encrypted:	false
SSDEEP:	6:a6nvQhIhIhIhIhIhIhIhIhIhIhIhIh6NQhIhIhIhIhIhIhIhIhIhIhIhIhIhIhIL:XvPN5ZNZX5hV
MD5:	45E6383ED6764BCF66BB7CDA685BDEF8
SHA1:	321AE49DC907E998D30E89BFE19B611CFEF2B222
SHA-256:	9FEA566760E23830FB440B59122AFE4636A63E1997DBEAFC60A701BBE213B165
SHA-512:	D1F29A7F13C231AFFD42DACA34E142AE225A50E97D173033F38E977F255B83C78B4AF30969474E59E269310D045DEB2712AA307D4E3301F04496BDD0CAD12B7A
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .....@...................7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..P[..........7D......................7D..7D..7D..7D..7D..7D..v...............7D......................7D..7D..7D..7D..7D..7D..................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..........................P[..7D..7D..7D..7D..7D..7D..7D..7D..7D..DP..................v...7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	17542
Entropy (8bit):	2.247918084411713
Encrypted:	false
SSDEEP:	192:9dLhJ6/f2dh+xQLeZ10TLwhwOHae6nmErcglsIZS3F:3jaOdhQQu0TLwaOHEr6IZ
MD5:	CA6619B86C2F6E6068B69BA3AADDB7E4
SHA1:	C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
SHA-256:	17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
SHA-512:	30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
Malicious:	false
Reputation:	low
URL:	https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/images/favicon.ico
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 75x75, segment length 16, progressive, precision 8, 390x671, components 3
Category:	downloaded
Size (bytes):	37001
Entropy (8bit):	7.907491715344534
Encrypted:	false
SSDEEP:	768:BLLLWypPCGlIZvzFo50kUTzGiWXTs3zJCG+gQv0KFlOnZ+LbM4n:BLLLWyU/vRoqnTzGcjJdvz1nZ+s4n
MD5:	B7B32D85A9D4F3B95BFF3603A5CC43B7
SHA1:	92C0633028759D37988234FE96BBCB80D23AE583
SHA-256:	D939B80DA2A8DA73AC8AC03083FDD11698A380ADB6431C19648DFAFBE14EA87B
SHA-512:	A7D31B2DC2ECC7F98C08D1E3B9EB2A81BFC2FF2883CB763570D57F2163927CA8F36DF2EA7566FEA79AEAE1720E8F527E9771116652227FEAFC68908221DFC177
Malicious:	false
Reputation:	low
URL:	https://lh7-rt.googleusercontent.com/drawingsz/AHiSRb2AUu8o4_LUOezQOJL6RHRd8vT_UkeGI4mWJc3XY7rrFw6Z5t6znqT6LS8UJIULLhm5RcLFi9YFaK9wm5FFOdeAFt3A4fOi0ioQguZQj8LmvHyhcXPnrq7eY_TLGJLlrPY?key=Y8-OnGBlH3ztkqWZFlad5skm
Preview:	......JFIF.....K.K......ICC_PROFILE............@..mntrRGB XYZ ............acsp.......................................-Qt..................................................rXYZ........gXYZ........bXYZ........wtpt...,....cprt...@....rTRC...L... gTRC...L... bTRC...L... desc...l..._XYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ .......O........text....N/A.para..........ff......Y.......[desc........sRGB..................................................................................C....................................................................C............................................................................"..................................................................................K..................H..K.......!.~s.'K~n.~.p......u~g..Q~w..I.............R..........q.2..R`...D.m.Nm.h..f..yn.....{..}..,.........b. ........f..............u...}.............b. ...................b.!....l......k...l......k...l......k...l......k...l......k..........R.<.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (829), with CRLF line terminators
Category:	dropped
Size (bytes):	36756
Entropy (8bit):	4.500491663672276
Encrypted:	false
SSDEEP:	768:UjelKP3m5/1/3zrRwRfpM2gHvoOBKfGOiyOkH8DGt6ZkQQJ59/4:UKlKPE/N3HRwRfpM2zPiyOuwGYkQQ4
MD5:	1CDEEB8EACA2A1357DE0A82BD5E5526F
SHA1:	F0474EE246D33979152B20BFBEA49045581792F3
SHA-256:	1327E703FCF1311DE11818F1FEDCEF1EC0BA4F60734962C6955FDFFC408D5287
SHA-512:	46B7110E8C0A6D6AC5BACA79402E934582FCB901E4B976B9A2FB61AE57CA6E03DE1B35B2B8FBDF227A72E55D0752FE9A2213BA13D0728F4BF1A9D4D0F879896A
Malicious:	false
Reputation:	low
Preview:	/! jQuery Validation Plugin - v1.19.0 - 11/28/2018.. https://jqueryvalidation.org/.. * Copyright (c) 2018 J.rn Zaefferer; Licensed MIT */..! function(a) {.. "function" == typeof define && define.amd ? define(["jquery"], a) : "object" == typeof module && module.exports ? module.exports = a(require("jquery")) : a(jQuery)..}(function(a) {.. a.extend(a.fn, {.. validate: function(b) {.. if (!this.length) return void(b && b.debug && window.console && console.warn("Nothing selected, can't validate, returning nothing."));.. var c = a.data(this[0], "validator");.. return c ? c : (this.attr("novalidate", "novalidate"), c = new a.validator(b, this[0]), a.data(this[0], "validator", c), c.settings.onsubmit && (this.on("click.validate", ":submit", function(b) {.. c.submitButton = b.currentTarget, a(this).hasClass("cancel") && (c.cancelSubmit = !0), void 0 !== a(this).attr("formnovalidate") && (c.cancelSubmit = !0).. }), this

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16460, version 1.655
Category:	downloaded
Size (bytes):	16460
Entropy (8bit):	7.987708256804987
Encrypted:	false
SSDEEP:	192:pvO6xEw4Jj9HYfGbtieHqP0l4S7NVXfU3xqJvzJmPnC1LiTNNIb0QAZtcnlclz0n:bWzHqP7S7Na3SJmKNyElcUuMXqGN3v
MD5:	15E17F26C664EE0518F82972282E6FF3
SHA1:	46B91BDA68161C14E554A779643EF4957431987B
SHA-256:	4065B43BA3DB8DA5390BA0708555889F78E86483FE0226EF79EA22D07C306B89
SHA-512:	54EADB53589C5386A724C8EEA2603481EBB23E7062FD7BFAB0EAFE55C9E1344F96320259412FB0DC7A6F5B6E09B32F6907F9AAA66BCA5812D45157E3771C902F
Malicious:	false
Reputation:	low
URL:	https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2
Preview:	wOF2......@L..........?.........................?FFTM..8..j..@.`..~.....h..i.6.$..F..<.. .....a?webf..}...6..........n.......fE.q. ..Y...9.2d.$.}[..0.H....j.k....U..#"-SM.t..."D....+....t.8f...s...g636\|..g._.....EB.T.!.B..!..y...k....Ya..G~.Y.;+....)...k...=it.........k_.^.z.#.).).....Y?....}..&N.s....1..=A.FXSG...`C...00..5l..#6...w....-...hkJ. .-...$D..1j..F.]..ny^..]..:.\...2......^n...5P......_.6..k..2..K..i......y....K...?..6...q>.. .....a9...........4/.c.E.........q...8N..$.$....z.?.d..v.QmY..D....s...:Y...S.\|..\|...[..@...4...V..n..s....t....A....\.v..X...M..O4.!=$..35m1\..wT"..w.c.s(...]t.?....."Q....1(.p..%0<-v..b.^R.)E:$..0<.....R.B.TY...K..n\..{#...kd.-.8..#.........t;..3.....IT[..2.L...........H..$..._.j.....b<B..uN.,*....k....@.k.k.....[.........6....U.1bDDD..Qu....R..+a......^.iS..qb.^..U.uU.sj..-<D....H..Y.J..[......8....V}........}.$^...CE..jc. d`.^..q..Nw.....`...1...S19.u....`H..WT.1.....y...c.A..op`..V..I....

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (829), with CRLF line terminators
Category:	downloaded
Size (bytes):	36756
Entropy (8bit):	4.500491663672276
Encrypted:	false
SSDEEP:	768:UjelKP3m5/1/3zrRwRfpM2gHvoOBKfGOiyOkH8DGt6ZkQQJ59/4:UKlKPE/N3HRwRfpM2zPiyOuwGYkQQ4
MD5:	1CDEEB8EACA2A1357DE0A82BD5E5526F
SHA1:	F0474EE246D33979152B20BFBEA49045581792F3
SHA-256:	1327E703FCF1311DE11818F1FEDCEF1EC0BA4F60734962C6955FDFFC408D5287
SHA-512:	46B7110E8C0A6D6AC5BACA79402E934582FCB901E4B976B9A2FB61AE57CA6E03DE1B35B2B8FBDF227A72E55D0752FE9A2213BA13D0728F4BF1A9D4D0F879896A
Malicious:	false
Reputation:	low
URL:	https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/js/jquery.validate.min.js
Preview:	/! jQuery Validation Plugin - v1.19.0 - 11/28/2018.. https://jqueryvalidation.org/.. * Copyright (c) 2018 J.rn Zaefferer; Licensed MIT */..! function(a) {.. "function" == typeof define && define.amd ? define(["jquery"], a) : "object" == typeof module && module.exports ? module.exports = a(require("jquery")) : a(jQuery)..}(function(a) {.. a.extend(a.fn, {.. validate: function(b) {.. if (!this.length) return void(b && b.debug && window.console && console.warn("Nothing selected, can't validate, returning nothing."));.. var c = a.data(this[0], "validator");.. return c ? c : (this.attr("novalidate", "novalidate"), c = new a.validator(b, this[0]), a.data(this[0], "validator", c), c.settings.onsubmit && (this.on("click.validate", ":submit", function(b) {.. c.submitButton = b.currentTarget, a(this).hasClass("cancel") && (c.cancelSubmit = !0), void 0 !== a(this).attr("formnovalidate") && (c.cancelSubmit = !0).. }), this

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 750, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	27972
Entropy (8bit):	7.9746563718982335
Encrypted:	false
SSDEEP:	768:PYh3ZcLbZnL3Azzh2/99/KL6sFxvjCENS:A8397Afhgjq6yv9NS
MD5:	1B5A1FB097715B1604B21ABA92EF6A3E
SHA1:	C4A765AEDD886DC04D89E7E93B6A02C59ECB7013
SHA-256:	437E95A363A4291060E34BA170E043274E0155821E9BE374F35DE3C4F13CBAA5
SHA-512:	0DD02CB398A22092732CFAE2B141F5327360A42E931AFD27AAF8EAE402C8C36EF0BB5EDEA82EB39E66567DAED1CAA79B70CA4BF41D30387653563D0A78AB9B0E
Malicious:	false
Reputation:	low
URL:	https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Preview:	.PNG........IHDR.....................PLTE...AC.38.'0")0!"NT[......333............dim/8@/8A`goWVS. !...QV\...bejeee>AC......[bj}..PW`YtS............mwxjpv...MSY`fi;=@KR[......_di......djr....................................V]e...u....8,3..!..2..:...u..v....=?A,..j.......8...m.02.u..@).ojBGL0....."....8>D.n...2..9;=.>/..B..[........@@A.v......D4.)."..J.B? ..H..432...\.[..:H..#)-....* ...............................B.......................#......G.......P..J..:.................B..9..int.s..d.5g....I..9..I..jqwqz}.]I.. ..D.....E..$.......T....]...=..............cgk.....L...t.vm.OM.+......+.g...#........'..Q.ZY.%.f@.y................................P.1..<...N./..>......................s.i...P.........}...y...........;..;.F5.G6........%.............(Z"....tRNS..................<.......{...%Zk.I....F~.......................Z<.......]...t..}.`'......h.....;....{..K..........L......^..e....B.*b.\|..............d.....O....................

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4567), with no line terminators
Category:	downloaded
Size (bytes):	4567
Entropy (8bit):	5.800236904475187
Encrypted:	false
SSDEEP:	96:1g2VilZtckx+9DgTlPJdiLW+iSah8vf1dtzlTaXe48gh:12cV9sT3AW7NIzae49h
MD5:	AC079AEBAB7F04FFD7D0B330A3600C90
SHA1:	23F7BAC5F4391E6A7800763512FFFB3E5A912942
SHA-256:	4E8EE685F07D221D636D7B8EC892D4C6232AADD2617B57FD7B6E918E01878A0D
SHA-512:	9611616C3571CBC63ED3C12467A62B7F8ADBC257A37B551380D7F8BBC2C32A4EFC4F71368241440A8E41D0CAFDE481EB830DD8F87D8B9BB361B6F23257C812FC
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/None/?random=1736959358060&cv=11&fst=1736959358060&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(a,b,c){if(!c\|\|a!=null){c=t[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} function v(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],g;!a&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;b=b(c);b!=null&&(a?h(q,d,{configurable:!0,writable:!0,value:b}):b!==c&&(t[d]===void 0&&(a=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+a+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 75x75, segment length 16, progressive, precision 8, 390x671, components 3
Category:	dropped
Size (bytes):	37001
Entropy (8bit):	7.907491715344534
Encrypted:	false
SSDEEP:	768:BLLLWypPCGlIZvzFo50kUTzGiWXTs3zJCG+gQv0KFlOnZ+LbM4n:BLLLWyU/vRoqnTzGcjJdvz1nZ+s4n
MD5:	B7B32D85A9D4F3B95BFF3603A5CC43B7
SHA1:	92C0633028759D37988234FE96BBCB80D23AE583
SHA-256:	D939B80DA2A8DA73AC8AC03083FDD11698A380ADB6431C19648DFAFBE14EA87B
SHA-512:	A7D31B2DC2ECC7F98C08D1E3B9EB2A81BFC2FF2883CB763570D57F2163927CA8F36DF2EA7566FEA79AEAE1720E8F527E9771116652227FEAFC68908221DFC177
Malicious:	false
Reputation:	low
Preview:	......JFIF.....K.K......ICC_PROFILE............@..mntrRGB XYZ ............acsp.......................................-Qt..................................................rXYZ........gXYZ........bXYZ........wtpt...,....cprt...@....rTRC...L... gTRC...L... bTRC...L... desc...l..._XYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ .......O........text....N/A.para..........ff......Y.......[desc........sRGB..................................................................................C....................................................................C............................................................................"..................................................................................K..................H..K.......!.~s.'K~n.~.p......u~g..Q~w..I.............R..........q.2..R`...D.m.Nm.h..f..yn.....{..}..,.........b. ........f..............u...}.............b. ...................b.!....l......k...l......k...l......k...l......k...l......k..........R.<.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4584), with no line terminators
Category:	dropped
Size (bytes):	4584
Entropy (8bit):	5.804640262173072
Encrypted:	false
SSDEEP:	96:1g2VilZtckx+9DgTlPJdiLW+iSah8vf1dtzlTaXe484:12cV9sT3AW7NIzae4d
MD5:	88B59F157EF180E183ACC7C8DBB273B2
SHA1:	D06386D0290F5B68853B78A9FC8C5D7C2DE37749
SHA-256:	C1B61EBD82F95153A21FFEB62A06D44AF4430AE69608A4FD164F0293BCD45C5E
SHA-512:	61A2A31A0B277B23E42961A467A75D63BC2485D6EC3C476EB87F497C578278B471CC36EF094FD1E8E483330465CE4775E3DC166CF2590333483705DFB9B457F0
Malicious:	false
Reputation:	low
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(a,b,c){if(!c\|\|a!=null){c=t[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} function v(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],g;!a&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;b=b(c);b!=null&&(a?h(q,d,{configurable:!0,writable:!0,value:b}):b!==c&&(t[d]===void 0&&(a=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+a+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16616, version 1.655
Category:	downloaded
Size (bytes):	16616
Entropy (8bit):	7.986966282975233
Encrypted:	false
SSDEEP:	384:0qJzQ61qLjMj2JfDC3uq2B/YgduJyovfw4TQRJGL7VGhX8aJl/hObP:x8LHMjGbCeqEFuBwkqJGLhGhVLsP
MD5:	4AFCD3B79B78D33386F497877A29C518
SHA1:	CC7EBAA05A2CD3B02C0929AC0475A44AB30B7EFA
SHA-256:	CDED49F94FC16DC0A14923975E159FBF4B14844593E612C1342C9E34E2F96821
SHA-512:	2DC9FFF1D57D5529C9C7BFF26FA9F3F94ADC47E9CEF51D782E55ECF93045200140706AB5816DFD4A0B49B8DB2263320FA2F0FA31A04E12D0C91FEA79B127255D
Malicious:	false
Reputation:	low
URL:	https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2
Preview:	wOF2......@........l..@.........................?FFTM..8..z..@.`..~.....P..9.6.$..F..<.. ..,..a?webf....5l.F..VU..#7.Q...d......k...r....{.T....2KuI.1.+j...(..kvf8...7.+.&.....t..!Z..C...>..=.....v.9_.% .L.....z..........0.e....;.7>.d..S..[..&/....=.9w.n...=.FH.h$...<....s.s.F..`...c....@...}.MP.@.A`T+..J.,F..XT....@..c......TH....OZ..u.....V..u..g...#..~"...Df.\M..-...n.Cu..{f..@.b{B...x......2..;.B...Ah.).....m...Q`!V.IH.pG...T.mb..p.[.v....Z=..P...I.,....m....;..Hva.*..@..x..:.....=&'G. ..0.....Mi...LC...t6..N5..m.........TH.....mY#..g..#.$...7..}...cS{..!.'..n..3...0......lw..D.,l..x...hH.I..lZ.]...4h/..>-A...wAv....W..KeYj{.V[c..d...d/..1.g.(:..5......h.(;@..........0..]+my.qdQ.>..JGu5.v2.3/.)..h.I2.P.. ....P..l......UU..#.d......R..x...)..d...2.....ov..%'..R5.97jA.._...m#..:.Z..r..5.!1.a.`..o.\<.4..j..._.......+Y)E......."A$..-._........c.C-.\....C../C..>..;T.@K...aB.o}t.>..~...>............uP\|..\\|.....1.. x....-%.....<>.$M..(..e......Un.rf0

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.280394654123195
Encrypted:	false
SSDEEP:	3:lku5dSrMyYn:lkuDSrMLn
MD5:	96BEC8A0E35B69F3E3B370A07E1B69AB
SHA1:	1766CAC154015AA19FC2D27354B43CDB9393763C
SHA-256:	A561BC103DD792F83B0B2F824C97E38B87D2E10E66FB1D9A423DD946396724C2
SHA-512:	202F0D3AA9549DACAE7E1195287B7F453090D5E4B0F2A303B9676E7B3F4328129195237C4DF86CE2092AF82BB3890DAC4101B50A11FC328CA719D000A13B5636
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlyok2_mvvi3BIFDVC5-lISBQ0k8wNi?alt=proto
Preview:	ChIKBw1QufpSGgAKBw0k8wNiGgA=

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:	96:EI5cZUiKliCJ86U+QTEVWfeLwTauSEegdkZ5edOIC:EI5hiWNJ8kQTEVWfeUauRfdkZ5edO1
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/static/service_worker/5190/sw_iframe.html?origin=https%3A%2F%2Fqr-codes.io
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1234)
Category:	downloaded
Size (bytes):	21351
Entropy (8bit):	5.503622110294562
Encrypted:	false
SSDEEP:	384:HdQm0XyQHiUtmxKLjL9jRiKPS4XYunqu9MVkWth5nXg5d7yFsiTtgfgelMBS5So2:HdR6yeiUtmELjTiMSQ5ndSVkWb5CduFn
MD5:	AC43CF3B4914E73C29910415BD19DB97
SHA1:	AB38BFA238B44E53F05AA778721D9585D0C6EA9D
SHA-256:	FA98E49ACB4BA980865779FA22B7CE1C48BDD56CB44A0FE19A8D6899F5FFE077
SHA-512:	8E36FC6B94073AA48C729342AC02287B0965A4375DB8A6F056F034044F43BCA51CE449FDD581B49839BE592BB4375D3891C90C0AFCCF6C326ED0CD43E27C43C1
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/static/service_worker/5190/sw.js?origin=https%3A%2F%2Fqr-codes.io
Preview:	'use strict';var ca=function(a){function b(d){return a.next(d)}function c(d){return a.throw(d)}return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}f(a.next())})},h=function(a){return ca(a())};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var p=this\|\|self;var t,y;a:{for(var da=["CLOSURE_FLAGS"],A=p,B=0;B<da.length;B++)if(A=A[da[B]],A==null){y=null;break a}y=A}var ea=y&&y[610401301];t=ea!=null?ea:!1;var E;const fa=p.navigator;E=fa?fa.userAgentData\|\|null:null;function F(a){return t?E?E.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function G(a){var b;a:{const c=p.navigator;if(c){const d=c.userAgent;if(d){b=d;break a}}b=""}return b.indexOf(a)!=-1};function H(){return t?!!E&&E.brands.length>0:!1}function I(){return H()?F("Chromium"):(G("Chrome")\|\|G("CriOS"))&&!(H()?0:G("Edge"))\|\|G("Silk")};!G("Android")\|\|I();I();G("Safari")&&(I()\|\|(H()?0:G("Coast"))\|\|(H()?0:G("Opera"))\|\|(H()?0:G("Edge"))\|\|(

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/None?random=1736959358060&cv=11&fst=1736959358060&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Preview:	<html></html>

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3855)
Category:	dropped
Size (bytes):	142466
Entropy (8bit):	5.469910909891601
Encrypted:	false
SSDEEP:	1536:kyG2Qq1GjpgMaEkuKImeaEMKJV9BR1mUzxVZG15EMg0BuIy2lX7Dkkl43hbIabO:k6EboeQUtXG3lu8b4tO
MD5:	406995DB3B77760B7BF9E0845A4A4018
SHA1:	2BCB02F8FD8007B6F5E7B6DC66804B57206000C2
SHA-256:	DE2F36278164EE094BEBD92A203D14B232F99B28CB1358679465AF9E321791E8
SHA-512:	2BA1C53F304BB9EBB39EA9C79C7B8DB3B4425B39C19CAA45D5BFD302803405F1543C6596018A5418F67AAE8B12BCA419D2667EADCD6D061D18D49AAFADF3F5E4
Malicious:	false
Reputation:	low
Preview:	function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="Edge",ba="Error in protected function: ",ca="Missing error cause.",da="Not available",ea="SCRIPT",fa="_/wa/",ha="apps_telemetry.processed",ia="attributionsrc",ja="bigint",ka="boolean",la="buildLabel",ma="complete",na="error",pa="fatal",n="function",qa="gssmodulesetproto",ra="iPad",sa="iPod",ua="incident",va="jsaction",wa="kaspersky-labs",xa="neurosurgeonundergo",r="number",u="object",ya="prerender",za="severity",Aa="severity-unprefixed",w="string",Ba="success",Ca="true",Da="unhandledrejection";.function Ea(){return function(a){return a}}function x(){return function(){}}function Fa(a){return function(){return this[a]}}function Ga(a){return function(){return a}}var y;function Ha(a){var c=0;return function(){return c<a.length?{done:!1,value:a

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:42:20.426698923 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:20.728262901 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:21.334362984 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:22.547259092 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:23.092962980 CET	49689	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:24.950278044 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:26.369968891 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:26.370047092 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:26.370130062 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:26.370454073 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:26.370487928 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:26.997442961 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:26.997544050 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:26.997708082 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:26.997867107 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:26.997894049 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.130413055 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.130748034 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.130779982 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.131273031 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.131284952 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.131345987 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.131352901 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.131392002 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.132195950 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.133147001 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.133228064 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.133359909 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.133371115 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.179415941 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.509481907 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.509520054 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.509583950 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.509646893 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.512604952 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.512795925 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.512857914 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.518742085 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.518810034 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.518826008 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.525270939 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.525326014 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.525332928 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.531308889 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.531373024 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.531378984 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.537585974 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.537647009 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.537652016 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.543853998 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.543922901 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.543927908 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.550251007 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.550302982 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.550307989 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.593355894 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.599875927 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.599947929 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.599972963 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.599998951 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.600012064 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.600059986 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.605251074 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.611320972 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.611345053 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.611383915 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.611392975 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.611432076 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.617662907 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.623836994 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.623867035 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.623914003 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.623927116 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.623989105 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.624000072 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.624021053 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.624078989 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.624279022 CET	49713	443	192.168.2.16	216.58.212.129
Jan 15, 2025 17:42:27.624310017 CET	443	49713	216.58.212.129	192.168.2.16
Jan 15, 2025 17:42:27.638057947 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:27.638113976 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:27.638205051 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:27.638385057 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:27.638422012 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:27.647732973 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.648061991 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:27.648097038 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.649087906 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.649174929 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:27.652861118 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:27.652930021 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.704340935 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:27.704374075 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:27.751377106 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:28.357846022 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.358146906 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.358211040 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.358711958 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.358732939 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.358793974 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.358815908 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.359175920 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.359339952 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.359513044 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.359586000 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.359638929 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.399271965 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.399338961 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.447276115 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.598155975 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:28.738080025 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.738121033 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.738173008 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.738195896 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.741018057 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.741087914 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.741106033 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.747364998 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.747420073 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.747428894 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.753829956 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.753969908 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.753978968 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.758833885 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.758964062 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.758974075 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.765132904 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.765286922 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.765296936 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.773190022 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.773274899 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.773286104 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.780397892 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.780592918 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.780610085 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.825066090 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.825171947 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.825191021 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.826491117 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.826574087 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.826589108 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.833425045 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.833528996 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.833544970 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.844011068 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.844079018 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.844094992 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.855978966 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.856066942 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.856086016 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.861862898 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.861954927 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.862046003 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.862205029 CET	49717	443	192.168.2.16	142.250.185.97
Jan 15, 2025 17:42:28.862236977 CET	443	49717	142.250.185.97	192.168.2.16
Jan 15, 2025 17:42:28.907269001 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:29.513279915 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:29.753268957 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:30.724287987 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:33.063482046 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:33.127368927 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:33.378264904 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:33.985301018 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:34.479022980 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.479068041 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:34.479142904 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.479727030 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.479738951 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:34.479778051 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.479824066 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:34.479969025 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.480366945 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:34.480382919 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.111068010 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.111388922 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.111414909 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.112360001 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.112504959 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.112797022 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.113102913 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.113156080 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.113820076 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.113888025 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.113959074 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.116225004 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.116298914 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.116657019 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.116751909 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.159333944 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.163292885 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.163321972 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.163340092 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.163403034 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.195285082 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:35.211311102 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.211471081 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.577382088 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.577470064 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.577568054 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.577584982 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.577605009 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.577687979 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.579077005 CET	49723	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:42:35.579093933 CET	443	49723	157.240.0.13	192.168.2.16
Jan 15, 2025 17:42:35.650396109 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.650446892 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:35.650512934 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.650628090 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.650727034 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:35.650813103 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.650892973 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.650909901 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:35.651134968 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:35.651166916 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.409399986 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.409775019 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.409801960 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.410820007 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.410891056 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.414102077 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.414211988 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.414350986 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.414365053 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.415770054 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.416003942 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.416038036 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.417318106 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.417392969 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.424096107 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.424207926 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.469893932 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.469918013 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:36.470081091 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:36.517409086 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.161838055 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.161870003 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.161916971 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.161950111 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.161992073 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.162128925 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.162225008 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.162316084 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.163101912 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.163101912 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.163124084 CET	443	49724	18.245.46.111	192.168.2.16
Jan 15, 2025 17:42:37.163211107 CET	49724	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:42:37.205259085 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.205307961 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.205372095 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.206383944 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.206414938 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.567852974 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:37.567929983 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:37.568061113 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:37.599308014 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:37.907043934 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.907375097 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.907439947 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.908523083 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.908607006 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.909873009 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.909954071 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.910075903 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.933321953 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:37.949346066 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:37.949371099 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:37.950159073 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.950226068 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:37.950318098 CET	49716	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:42:37.950346947 CET	443	49716	142.250.185.100	192.168.2.16
Jan 15, 2025 17:42:37.950368881 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.950588942 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.950681925 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:37.950818062 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.950862885 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.950895071 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:37.951003075 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:37.951033115 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:37.997380972 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.178214073 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.178281069 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.178303957 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.178345919 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.178397894 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.268935919 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.268949986 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.268965006 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.268980980 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.268990040 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.268996954 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.269023895 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.269041061 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.269073009 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.307703018 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.307729006 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.307777882 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.307796955 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.307811975 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.343924046 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.343946934 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.344012022 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.344088078 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.344130993 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.369714022 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.369734049 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.369801044 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.369832993 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.376266003 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.376326084 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.376346111 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.404020071 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.404047966 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.404081106 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.404099941 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.404124022 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.404172897 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.414975882 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.415236950 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.415251017 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.416316032 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.416371107 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.417433023 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.417493105 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.417718887 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.417726040 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.421719074 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.421750069 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.421792030 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.421809912 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.421833992 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.421854019 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.450056076 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.450083971 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.450134039 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.450144053 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.450171947 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.450201988 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.450773954 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.451162100 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.451195955 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.452325106 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.452389002 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.452807903 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.452893972 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.460331917 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.461657047 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.461709023 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.461741924 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.461752892 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.461783886 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.463639021 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.463696957 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.463705063 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.463757992 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.472184896 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.472220898 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.472266912 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.472275972 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.472302914 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.472316980 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.484472990 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.484507084 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.484582901 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.484652996 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.484690905 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.484793901 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.495834112 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.495909929 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.495918036 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.495951891 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.495965958 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.495996952 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.507333994 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.507375956 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.508219957 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.508270979 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.508297920 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.508308887 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.508339882 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.508363962 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.512296915 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.512362003 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.520983934 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.521045923 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.521076918 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.521102905 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.521126986 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.532685041 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.532716036 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.532762051 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.532795906 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.532814980 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.543339968 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.543370008 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.543416977 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.543446064 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.543464899 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.545430899 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.545500994 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.545523882 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.545545101 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.545604944 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.545802116 CET	49727	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.545820951 CET	443	49727	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.555324078 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.556613922 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.556663990 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.557043076 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.557252884 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:38.557271004 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:38.602742910 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:38.602859974 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:38.602941990 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:38.603146076 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:38.603177071 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:38.615417004 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:38.615474939 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:38.615571976 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:38.616535902 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:38.616569996 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:38.630212069 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:38.630271912 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:38.630342007 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:38.630567074 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:38.630589962 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:38.964576960 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.964658976 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:38.964741945 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.970169067 CET	49728	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:38.970204115 CET	443	49728	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.194022894 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.195719004 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.195754051 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.196862936 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.196933031 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.197199106 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.197272062 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.197313070 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.239327908 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.240329027 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.240355015 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.252865076 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.253535986 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.253998041 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.254046917 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.254149914 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.254168034 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.255166054 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.255286932 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.255707979 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.255779028 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.256056070 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.256145954 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.256210089 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.256361008 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.256439924 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.256572962 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.256591082 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.265918016 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.267746925 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.267764091 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.269191980 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.269315004 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.270407915 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.270488024 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.270558119 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.288322926 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.303338051 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.304290056 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.304303885 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.304335117 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.311350107 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.320305109 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.320329905 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.352299929 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.368336916 CET	49673	443	192.168.2.16	204.79.197.203
Jan 15, 2025 17:42:39.368369102 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.475348949 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.475415945 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.475431919 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.475450993 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.475481033 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.475490093 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.527309895 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.530436039 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530479908 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530514956 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530527115 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.530544996 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530586004 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.530592918 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530766964 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.530817032 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.531415939 CET	49733	443	192.168.2.16	142.250.185.194
Jan 15, 2025 17:42:39.531435013 CET	443	49733	142.250.185.194	192.168.2.16
Jan 15, 2025 17:42:39.535476923 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.535521984 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.535586119 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.535813093 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.535826921 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.537049055 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.537163973 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.537201881 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.537564993 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.537581921 CET	443	49732	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:39.537594080 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.537633896 CET	49732	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:39.542181969 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:39.542191982 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:39.542242050 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:39.542412043 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:39.542422056 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:39.544707060 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.544855118 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.544892073 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.545454979 CET	49734	443	192.168.2.16	142.250.184.194
Jan 15, 2025 17:42:39.545469046 CET	443	49734	142.250.184.194	192.168.2.16
Jan 15, 2025 17:42:39.563955069 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.563977957 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.563986063 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.564009905 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.564013958 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.564022064 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.564078093 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.564089060 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598020077 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598033905 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598053932 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598063946 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598087072 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.598117113 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.598134041 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.632575035 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.632618904 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.632627964 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.632652044 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.632652998 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.632683992 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.632713079 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.666034937 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.666048050 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.666062117 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.666069031 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.666099072 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.666126013 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.666141987 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.670954943 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.671008110 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.671030998 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694216967 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694248915 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694257975 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694286108 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694314957 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.694346905 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.694360018 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.694390059 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.720288992 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.720300913 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.720345020 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.720366955 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.720371008 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.720381975 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.720405102 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.720424891 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.725919962 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.741859913 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.741880894 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.741946936 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.741972923 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.742022991 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.757307053 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.757344007 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.757378101 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.757390022 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.757404089 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.759553909 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.759602070 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.759610891 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.759660006 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.768146038 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.768186092 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.768219948 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.768229961 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.768263102 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.768276930 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.771348953 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.780733109 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.780755043 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.780797958 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.780803919 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.780833006 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.780853033 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.792829037 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.792853117 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.792907953 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.792916059 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.792968035 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.804635048 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.804656982 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.804692030 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.804699898 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.804723978 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.804744959 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.808815002 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.808864117 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.816056013 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.816092014 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.816132069 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.816143990 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.816162109 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.826797962 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.826818943 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.826878071 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.826888084 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.837418079 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.837438107 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.837481022 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.837491989 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.837507963 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.839390039 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.839433908 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.839443922 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.839466095 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.839513063 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.839656115 CET	49730	443	192.168.2.16	157.240.252.13
Jan 15, 2025 17:42:39.839672089 CET	443	49730	157.240.252.13	192.168.2.16
Jan 15, 2025 17:42:39.956063986 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956119061 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956151009 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956187010 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.956192970 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956233025 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956253052 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.956382036 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956408024 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956423044 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.956432104 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.956470013 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.956624031 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.957027912 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.957084894 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.957159042 CET	49729	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.957178116 CET	443	49729	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.968416929 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.968458891 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.968545914 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.969122887 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.969134092 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.973232031 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.973279953 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.973351002 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.973620892 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.973658085 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.973716021 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.973912954 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.973922014 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.973972082 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.974195957 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.974209070 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.974354982 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.974370956 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:39.974514008 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:39.974522114 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.164345980 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:40.164694071 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:40.164726019 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:40.165083885 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:40.165404081 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:40.165476084 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:40.171452045 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.171627045 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.171648979 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.172683954 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.172759056 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.172998905 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.173060894 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.173119068 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.173129082 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.208333969 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:40.223366976 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.429620981 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.429984093 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.430013895 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.431042910 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.431121111 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.431585073 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.431648016 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.431752920 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.431766987 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.457942963 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.457994938 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.458023071 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.458051920 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.458071947 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.458106041 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.458121061 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.458281994 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.458334923 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.459239960 CET	49737	443	192.168.2.16	142.250.185.226
Jan 15, 2025 17:42:40.459261894 CET	443	49737	142.250.185.226	192.168.2.16
Jan 15, 2025 17:42:40.464818001 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.465276957 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.465343952 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.465818882 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.466212034 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.466289997 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.466362953 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.468736887 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.469001055 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.469019890 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.470066071 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.470146894 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.470494032 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.470552921 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.470623016 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.477641106 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.477905989 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.477925062 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.478312016 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.478672981 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.478741884 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.478955984 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.479336023 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.507338047 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.510329962 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.510466099 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.510478973 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.519332886 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.526348114 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.558365107 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794213057 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794261932 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794307947 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794349909 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794373989 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794387102 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794395924 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794395924 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794434071 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794445992 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794500113 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794543028 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794548035 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794627905 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794667006 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.794673920 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.794678926 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.795814991 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.798865080 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807080984 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807116032 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807152987 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807179928 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807207108 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807213068 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.807248116 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807260036 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807270050 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.807308912 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.807334900 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807389021 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.807707071 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807789087 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807810068 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.807842970 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.807858944 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.808768034 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.811829090 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.833888054 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.833965063 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834013939 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834047079 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.834073067 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834122896 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834160089 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834166050 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.834176064 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834203959 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.834222078 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834296942 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834336996 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834340096 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.834350109 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.834377050 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.838566065 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.838628054 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.838637114 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.844325066 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.860354900 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.880671978 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.880744934 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.880778074 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.880805969 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.880825996 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.880856991 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.880918026 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881186962 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881238937 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881270885 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881302118 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881310940 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881325960 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881357908 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881397009 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881453037 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881464005 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881498098 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881863117 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881889105 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881922007 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881923914 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.881927967 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881937027 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.881977081 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.882203102 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882253885 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882283926 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882299900 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.882314920 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882348061 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882379055 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882388115 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.882396936 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.882412910 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.883186102 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.883209944 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.883238077 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.883260012 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.883311033 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.883354902 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.883378029 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.883569002 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.885725975 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.885766983 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.885807991 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.885821104 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.885889053 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.892352104 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.899403095 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899485111 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899524927 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899566889 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899607897 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.899651051 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899678946 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.899949074 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.899991989 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.900019884 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.900026083 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.900077105 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.900130033 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.900136948 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.900182009 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.900774002 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.900866985 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901158094 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.901164055 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901360035 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901411057 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901475906 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.901482105 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901520967 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.901598930 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.901788950 CET	49739	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.901803970 CET	443	49739	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922120094 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922333956 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922430992 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922512054 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.922528028 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922671080 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922734976 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.922741890 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922832966 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922889948 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.922894001 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.922995090 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.923052073 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.923057079 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.923101902 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.923105955 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.923763990 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.923831940 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.923836946 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.923923969 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924034119 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924082994 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924089909 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.924096107 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924123049 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.924514055 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924561024 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924571037 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.924575090 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924616098 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.924619913 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924743891 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.924798012 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.925785065 CET	49740	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.925798893 CET	443	49740	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967690945 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967749119 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967772961 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967797041 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967820883 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967847109 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967849970 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.967868090 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967878103 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.967901945 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.967926979 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.967938900 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968081951 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968101025 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968122959 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.968132019 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968154907 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.968765974 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968889952 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968915939 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968938112 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968947887 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968962908 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968972921 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968988895 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.968991995 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969013929 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969018936 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969031096 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969036102 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969049931 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969053030 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969073057 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969767094 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969798088 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969816923 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969818115 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969846964 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969851971 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969856977 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969861984 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969906092 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969906092 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969927073 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969950914 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.969955921 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.969991922 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970542908 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970586061 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970612049 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970630884 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970634937 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970642090 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970653057 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970681906 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970681906 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970706940 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970707893 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970712900 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970722914 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970735073 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970738888 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970762968 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.970772028 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.970787048 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.971455097 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971486092 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971494913 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971523046 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971558094 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971560955 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.971565962 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971612930 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.971611023 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:40.971632004 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:40.971678019 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.055335999 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.055387974 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.055522919 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.055555105 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.055581093 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056026936 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056054115 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056076050 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056078911 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056088924 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056107044 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056133032 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056137085 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056143999 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056169987 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056180000 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056186914 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056205988 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056227922 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056889057 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056915998 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056942940 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.056946993 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.056982040 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057176113 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057235003 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057257891 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057281971 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057282925 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057301044 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057306051 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057320118 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057323933 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057342052 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057363033 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057367086 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057367086 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057374954 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057379007 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057389975 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057423115 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057630062 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057677031 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057704926 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057738066 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057758093 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057774067 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057779074 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057787895 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.057816029 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.057831049 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058157921 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058198929 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058222055 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058249950 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058271885 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058276892 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058310032 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058322906 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058615923 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058648109 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058670044 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058671951 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058676004 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058686972 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058696032 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058712959 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.058716059 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.058737040 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.059139013 CET	49741	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.059159994 CET	443	49741	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.059423923 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.059448004 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.059463024 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.059469938 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.059489965 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.060491085 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.060514927 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.060533047 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.060537100 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.060554981 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.060558081 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.060591936 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.060596943 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.060631990 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.075911999 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.075951099 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.076030970 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.076214075 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.076230049 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.107002974 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107079029 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.107158899 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107439995 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107472897 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.107526064 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107683897 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107712984 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.107850075 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.107861996 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.144558907 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.144634962 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.144673109 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.144695044 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.144741058 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.145086050 CET	49742	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.145097017 CET	443	49742	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.552268028 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.552495003 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.552519083 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.553483963 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.553550959 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.554343939 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.554421902 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.554502010 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.554511070 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.590058088 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.590348005 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.590377092 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.591542006 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.591646910 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.591931105 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.592017889 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.592086077 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.592097044 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.594358921 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.594573975 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.594604969 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.595366001 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.596065998 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.596200943 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.596412897 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.596503019 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.596522093 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.639344931 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.643341064 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.643353939 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.643388033 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652662039 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652741909 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652780056 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652817011 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652846098 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.652869940 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.652880907 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.653240919 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.653295040 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.653302908 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.653615952 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.653656006 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.653659105 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.653673887 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.653717995 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.653724909 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.668600082 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.668719053 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.668731928 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.689888954 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.689980984 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690032005 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.690061092 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690159082 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690196037 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.690206051 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690314054 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.690610886 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690648079 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690649986 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.690660000 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.690702915 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.691235065 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693002939 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693394899 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693474054 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693486929 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.693505049 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693547010 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.693562984 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693914890 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.693969965 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.693977118 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694638968 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694705009 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.694711924 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694791079 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694844007 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.694849968 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694902897 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694943905 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.694956064 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.694978952 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.695019960 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.705857992 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.705965042 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.706046104 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.706300020 CET	49745	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.706319094 CET	443	49745	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.708985090 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.709078074 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.709084988 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.709178925 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.709225893 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.709512949 CET	49744	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.709531069 CET	443	49744	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.722398996 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.743871927 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.743942022 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.743978977 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744004965 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744029999 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744070053 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744075060 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744081974 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744127035 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744134903 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744142056 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744200945 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744658947 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744741917 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744790077 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744889021 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744904041 CET	443	49743	151.101.129.16	192.168.2.16
Jan 15, 2025 17:42:41.744939089 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.744972944 CET	49743	443	192.168.2.16	151.101.129.16
Jan 15, 2025 17:42:41.749732018 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.749783039 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.749887943 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.750294924 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:41.750309944 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:41.756454945 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:41.756488085 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:41.756572962 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:41.756805897 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:41.756818056 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.214724064 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.215337992 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.215362072 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.218208075 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.218296051 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.218610048 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.218754053 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.218755960 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.228432894 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.228658915 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.228679895 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.228998899 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.229255915 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.229315996 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.229342937 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.263330936 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.265351057 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.265384912 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.275325060 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.281675100 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.314922094 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.314980984 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.314990044 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.315006971 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.315087080 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.315125942 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.315160036 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.315160036 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.315180063 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321300030 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321348906 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321384907 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321419001 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321420908 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.321420908 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.321433067 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.321588039 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.322057962 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.329366922 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.330168962 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.330183029 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.377324104 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.382524967 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382569075 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382594109 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382618904 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382642984 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382643938 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.382662058 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382682085 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.382693052 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382698059 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.382735968 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382776022 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.382777929 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382787943 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.382816076 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.382822037 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.387430906 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.387506962 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.387521029 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.408396959 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:42:42.409758091 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.409838915 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.409876108 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.409890890 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.409909010 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.409955025 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.409964085 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.410079956 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.410125017 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.410146952 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.410155058 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.410228014 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.410237074 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.410293102 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.410492897 CET	49748	443	192.168.2.16	151.101.1.16
Jan 15, 2025 17:42:42.410497904 CET	443	49748	151.101.1.16	192.168.2.16
Jan 15, 2025 17:42:42.440336943 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.468580961 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.468713045 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.468789101 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.469099045 CET	49747	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.469118118 CET	443	49747	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.889333010 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.889379025 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.889448881 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.889621973 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.889630079 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.889678001 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.889996052 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.890007973 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.890182972 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.890188932 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.891372919 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.891401052 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:42.891561031 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.891681910 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:42.891693115 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.372620106 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.372956991 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.372989893 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.374341011 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.374434948 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.375680923 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.375718117 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.375761032 CET	443	49749	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.375803947 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.375818014 CET	49749	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.376213074 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.376313925 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.376404047 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.376662016 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.376694918 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.377119064 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.377338886 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.377358913 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.378622055 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.378694057 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379112959 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379127979 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379173040 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379179955 CET	443	49750	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.379228115 CET	49750	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379472017 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379520893 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.379584074 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379808903 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.379826069 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.412452936 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.412798882 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.412836075 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.415967941 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.416079044 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.416568995 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.416583061 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.416640043 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.416654110 CET	443	49751	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.416707993 CET	49751	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.417033911 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.417076111 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.417160988 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.417372942 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.417383909 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.874209881 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.874547958 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.874577999 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.875612974 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.875693083 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.876022100 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.876090050 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.876213074 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.876230955 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.895714998 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.896029949 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.896095991 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.897171974 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.897250891 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.897648096 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.897721052 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.897814035 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.897833109 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.904381037 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.904637098 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.904652119 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.906107903 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.906183958 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.906514883 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.906605005 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.906666994 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.906673908 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:43.923357964 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.939372063 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:43.955333948 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.036571980 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.036613941 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.036667109 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.036669016 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.036700010 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.036731958 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.036750078 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.037106991 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.037152052 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.037203074 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.037219048 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.041276932 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.041306019 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.041338921 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.041340113 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.041352034 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.041390896 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.124124050 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.124296904 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.124363899 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.124378920 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.124404907 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.124470949 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.124489069 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125117064 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125186920 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.125212908 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125307083 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125355005 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.125368118 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125601053 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125659943 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.125674009 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125804901 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.125853062 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.125864029 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.126430035 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.126487970 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.126506090 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.126673937 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.126729965 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.126815081 CET	49753	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.126846075 CET	443	49753	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238272905 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238415003 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238504887 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.238540888 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238662958 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238727093 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.238740921 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238868952 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.238929033 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.238940001 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.239063978 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.239109993 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.239120960 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.242772102 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.242832899 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.242846012 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.242980957 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.243033886 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.243046045 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.271922112 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.271962881 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272012949 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272020102 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.272043943 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272089958 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272102118 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.272116899 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272164106 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272172928 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.272186995 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272245884 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.272259951 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272631884 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.272680998 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.272696018 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.276643991 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.276705980 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.276722908 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.290328979 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.322324991 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.324394941 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.324677944 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.324738026 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.324870110 CET	49754	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.324897051 CET	443	49754	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362263918 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362396955 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362448931 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.362485886 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362596989 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362627983 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362632036 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.362643003 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.362684965 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.363096952 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.363217115 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.363245964 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.363272905 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.363277912 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.363290071 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.363322973 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.364011049 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364130020 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.364139080 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364173889 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364197969 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364227057 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364237070 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.364249945 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.364275932 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.365025043 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.365057945 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.365072966 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.365084887 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.365120888 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.365122080 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.365134001 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.365176916 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.410593033 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.410634995 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.410697937 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.410765886 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453272104 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453311920 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453335047 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453339100 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.453382015 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453408003 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.453764915 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453811884 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.453828096 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.453876019 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.454044104 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454111099 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.454125881 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454166889 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454190016 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.454209089 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454231977 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.454926014 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454961061 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454989910 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.454993963 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.455009937 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.455039978 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.455060959 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.455739021 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.455791950 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.455815077 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.455838919 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.455868959 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.455887079 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.456543922 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.456604004 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.456666946 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.456698895 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.456711054 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.456728935 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.456763983 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457521915 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.457560062 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.457576036 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457600117 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.457623959 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457638025 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:44.457644939 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457695007 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457835913 CET	49752	443	192.168.2.16	104.21.79.87
Jan 15, 2025 17:42:44.457866907 CET	443	49752	104.21.79.87	192.168.2.16
Jan 15, 2025 17:42:47.534327030 CET	49678	443	192.168.2.16	20.189.173.10
Jan 15, 2025 17:42:50.087302923 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:50.087378979 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:50.087439060 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:50.478658915 CET	49736	443	192.168.2.16	216.58.206.36
Jan 15, 2025 17:42:50.478703022 CET	443	49736	216.58.206.36	192.168.2.16
Jan 15, 2025 17:42:52.008374929 CET	49680	80	192.168.2.16	192.229.211.108
Jan 15, 2025 17:43:06.209893942 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:43:06.209980965 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:43:06.210037947 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:43:06.485827923 CET	49725	443	192.168.2.16	18.245.46.111
Jan 15, 2025 17:43:06.485858917 CET	443	49725	18.245.46.111	192.168.2.16
Jan 15, 2025 17:43:20.178478956 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:43:20.178538084 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:43:27.046519995 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:27.046560049 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.046648026 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:27.046899080 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:27.046915054 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.686515093 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.686847925 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:27.686867952 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.687210083 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.687544107 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:27.687603951 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:27.732479095 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:36.486323118 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:43:36.486466885 CET	443	49722	157.240.0.13	192.168.2.16
Jan 15, 2025 17:43:36.486532927 CET	49722	443	192.168.2.16	157.240.0.13
Jan 15, 2025 17:43:37.612068892 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:37.612143040 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:43:37.612200975 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:38.480500937 CET	49757	443	192.168.2.16	142.250.185.100
Jan 15, 2025 17:43:38.480530024 CET	443	49757	142.250.185.100	192.168.2.16
Jan 15, 2025 17:44:27.117938995 CET	49792	443	192.168.2.16	142.250.186.100
Jan 15, 2025 17:44:27.118031025 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.118128061 CET	49792	443	192.168.2.16	142.250.186.100
Jan 15, 2025 17:44:27.118382931 CET	49792	443	192.168.2.16	142.250.186.100
Jan 15, 2025 17:44:27.118421078 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.778281927 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.778603077 CET	49792	443	192.168.2.16	142.250.186.100
Jan 15, 2025 17:44:27.778667927 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.779144049 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.779577971 CET	49792	443	192.168.2.16	142.250.186.100
Jan 15, 2025 17:44:27.779668093 CET	443	49792	142.250.186.100	192.168.2.16
Jan 15, 2025 17:44:27.827743053 CET	49792	443	192.168.2.16	142.250.186.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:42:22.161604881 CET	53	63590	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:22.258198023 CET	53	49592	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:23.074148893 CET	50097	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:23.074347019 CET	65094	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:23.080925941 CET	53	50097	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:23.081459045 CET	53	65094	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:23.251688957 CET	53	52295	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.349831104 CET	61312	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.349945068 CET	57382	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.356671095 CET	53	61312	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.357582092 CET	53	57382	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.360761881 CET	61231	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.360894918 CET	55017	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.367969036 CET	53	61231	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.368838072 CET	53	55017	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.988270998 CET	52997	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.988636971 CET	52502	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:26.996125937 CET	53	52997	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:26.996587038 CET	53	52502	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:27.630156994 CET	59593	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:27.630283117 CET	51079	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:27.637515068 CET	53	59593	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:27.637629032 CET	53	51079	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:27.638245106 CET	53	60361	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:28.612910032 CET	53	55805	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:34.470293045 CET	58898	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:34.470683098 CET	57849	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:34.477798939 CET	53	58898	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:34.478049994 CET	53	57849	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:35.623018026 CET	53051	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:35.623326063 CET	62848	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:35.636404991 CET	53	62848	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:35.649679899 CET	53	53051	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:37.183959961 CET	53	61041	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:37.197292089 CET	60988	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:37.197792053 CET	58510	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:37.204304934 CET	53	60988	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:37.204657078 CET	53	58510	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:37.209395885 CET	52140	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:37.209686995 CET	56125	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:37.883411884 CET	53	52140	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.480469942 CET	53	56125	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.548866987 CET	65201	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.549010992 CET	57499	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.555790901 CET	53	65201	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.555978060 CET	53	57499	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.559148073 CET	53	61831	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.595046997 CET	60532	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.595242023 CET	51525	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.601999044 CET	53	60532	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.602119923 CET	53	51525	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.605982065 CET	60436	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.606607914 CET	61566	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.612782955 CET	53	60436	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.613595963 CET	53	61566	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.622229099 CET	64466	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.622452021 CET	50333	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.629048109 CET	53	64466	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.629585028 CET	53	50333	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.639697075 CET	53	52786	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:38.970838070 CET	55163	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:38.970993042 CET	53065	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:39.534526110 CET	60575	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:39.534902096 CET	50742	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:39.541174889 CET	53	60575	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:39.541774988 CET	53	50742	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:39.723710060 CET	53	53065	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:40.277427912 CET	53	53865	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:40.904840946 CET	64500	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:40.904973984 CET	54576	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:40.913265944 CET	53	54576	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.065737963 CET	58782	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:41.065989017 CET	64049	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:41.072335005 CET	53	58782	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.072963953 CET	53	64049	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.175873041 CET	53	58165	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.748972893 CET	52668	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:41.749109983 CET	59881	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:41.755784988 CET	53	59881	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.755968094 CET	53	52668	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:41.929820061 CET	55235	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:42.026985884 CET	53	55163	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:42.888674021 CET	53	55235	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:43.108620882 CET	53	64500	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:48.220202923 CET	53	60970	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:56.373333931 CET	61853	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:56.373462915 CET	57980	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:56.383712053 CET	53	57980	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:56.541661978 CET	53	61853	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:56.542545080 CET	60427	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:42:56.551625013 CET	53	60427	1.1.1.1	192.168.2.16
Jan 15, 2025 17:42:59.311573029 CET	53	54373	1.1.1.1	192.168.2.16
Jan 15, 2025 17:43:14.384279013 CET	55026	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:43:14.394467115 CET	53	55026	1.1.1.1	192.168.2.16
Jan 15, 2025 17:43:21.626650095 CET	53	63181	1.1.1.1	192.168.2.16
Jan 15, 2025 17:43:22.155138969 CET	53	56601	1.1.1.1	192.168.2.16
Jan 15, 2025 17:43:24.767883062 CET	138	138	192.168.2.16	192.168.2.255
Jan 15, 2025 17:43:35.239599943 CET	55632	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:43:35.250216007 CET	53	55632	1.1.1.1	192.168.2.16
Jan 15, 2025 17:43:51.232245922 CET	53	56434	1.1.1.1	192.168.2.16
Jan 15, 2025 17:44:27.110310078 CET	53968	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:44:27.110426903 CET	49360	53	192.168.2.16	1.1.1.1
Jan 15, 2025 17:44:27.116986990 CET	53	53968	1.1.1.1	192.168.2.16
Jan 15, 2025 17:44:27.117207050 CET	53	49360	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 15, 2025 17:42:38.480587006 CET	192.168.2.16	1.1.1.1	c2a7	(Port unreachable)	Destination Unreachable
Jan 15, 2025 17:42:42.027137995 CET	192.168.2.16	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Jan 15, 2025 17:42:43.108746052 CET	192.168.2.16	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 17:42:23.074148893 CET	192.168.2.16	1.1.1.1	0xdde0	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:23.074347019 CET	192.168.2.16	1.1.1.1	0xf973	Standard query (0)	docs.google.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:26.349831104 CET	192.168.2.16	1.1.1.1	0x2603	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.349945068 CET	192.168.2.16	1.1.1.1	0x7343	Standard query (0)	docs.google.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:26.360761881 CET	192.168.2.16	1.1.1.1	0x5cea	Standard query (0)	lh7-rt.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.360894918 CET	192.168.2.16	1.1.1.1	0x563d	Standard query (0)	lh7-rt.googleusercontent.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:26.988270998 CET	192.168.2.16	1.1.1.1	0x940b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.988636971 CET	192.168.2.16	1.1.1.1	0xa02e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:27.630156994 CET	192.168.2.16	1.1.1.1	0x4843	Standard query (0)	lh7-rt.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:27.630283117 CET	192.168.2.16	1.1.1.1	0x71f7	Standard query (0)	lh7-rt.googleusercontent.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:34.470293045 CET	192.168.2.16	1.1.1.1	0xdcee	Standard query (0)	l.wl.co	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:34.470683098 CET	192.168.2.16	1.1.1.1	0xd526	Standard query (0)	l.wl.co	65	IN (0x0001)	false
Jan 15, 2025 17:42:35.623018026 CET	192.168.2.16	1.1.1.1	0x315c	Standard query (0)	qr-codes.io	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:35.623326063 CET	192.168.2.16	1.1.1.1	0xd267	Standard query (0)	qr-codes.io	65	IN (0x0001)	false
Jan 15, 2025 17:42:37.197292089 CET	192.168.2.16	1.1.1.1	0x5ce3	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:37.197792053 CET	192.168.2.16	1.1.1.1	0xc9a6	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Jan 15, 2025 17:42:37.209395885 CET	192.168.2.16	1.1.1.1	0x5ab3	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:37.209686995 CET	192.168.2.16	1.1.1.1	0xed8e	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	65	IN (0x0001)	false
Jan 15, 2025 17:42:38.548866987 CET	192.168.2.16	1.1.1.1	0x7835	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.549010992 CET	192.168.2.16	1.1.1.1	0x7495	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Jan 15, 2025 17:42:38.595046997 CET	192.168.2.16	1.1.1.1	0x4655	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.595242023 CET	192.168.2.16	1.1.1.1	0x69c7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:38.605982065 CET	192.168.2.16	1.1.1.1	0x972b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.606607914 CET	192.168.2.16	1.1.1.1	0xb82d	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 15, 2025 17:42:38.622229099 CET	192.168.2.16	1.1.1.1	0xff1d	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.622452021 CET	192.168.2.16	1.1.1.1	0xa127	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Jan 15, 2025 17:42:38.970838070 CET	192.168.2.16	1.1.1.1	0x9803	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.970993042 CET	192.168.2.16	1.1.1.1	0xfc2	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	65	IN (0x0001)	false
Jan 15, 2025 17:42:39.534526110 CET	192.168.2.16	1.1.1.1	0xd1f9	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:39.534902096 CET	192.168.2.16	1.1.1.1	0x231	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 15, 2025 17:42:40.904840946 CET	192.168.2.16	1.1.1.1	0x20d8	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:40.904973984 CET	192.168.2.16	1.1.1.1	0x677f	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	65	IN (0x0001)	false
Jan 15, 2025 17:42:41.065737963 CET	192.168.2.16	1.1.1.1	0xc55c	Standard query (0)	m.media-amazon.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.065989017 CET	192.168.2.16	1.1.1.1	0xa4e9	Standard query (0)	m.media-amazon.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:41.748972893 CET	192.168.2.16	1.1.1.1	0x89bf	Standard query (0)	m.media-amazon.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.749109983 CET	192.168.2.16	1.1.1.1	0x6769	Standard query (0)	m.media-amazon.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:41.929820061 CET	192.168.2.16	1.1.1.1	0x539a	Standard query (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:56.373333931 CET	192.168.2.16	1.1.1.1	0x589a	Standard query (0)	w3valid.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:56.373462915 CET	192.168.2.16	1.1.1.1	0x583d	Standard query (0)	w3valid.com	65	IN (0x0001)	false
Jan 15, 2025 17:42:56.542545080 CET	192.168.2.16	1.1.1.1	0xbecc	Standard query (0)	w3valid.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:43:14.384279013 CET	192.168.2.16	1.1.1.1	0x8088	Standard query (0)	w3valid.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:43:35.239599943 CET	192.168.2.16	1.1.1.1	0x9883	Standard query (0)	w3valid.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:44:27.110310078 CET	192.168.2.16	1.1.1.1	0x7bdd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:44:27.110426903 CET	192.168.2.16	1.1.1.1	0x3bad	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 17:42:23.080925941 CET	1.1.1.1	192.168.2.16	0xdde0	No error (0)	docs.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.356671095 CET	1.1.1.1	192.168.2.16	0x2603	No error (0)	docs.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.367969036 CET	1.1.1.1	192.168.2.16	0x5cea	No error (0)	lh7-rt.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:26.367969036 CET	1.1.1.1	192.168.2.16	0x5cea	No error (0)	googlehosted.l.googleusercontent.com		216.58.212.129	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.368838072 CET	1.1.1.1	192.168.2.16	0x563d	No error (0)	lh7-rt.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:26.996125937 CET	1.1.1.1	192.168.2.16	0x940b	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:26.996587038 CET	1.1.1.1	192.168.2.16	0xa02e	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 17:42:27.637515068 CET	1.1.1.1	192.168.2.16	0x4843	No error (0)	lh7-rt.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:27.637515068 CET	1.1.1.1	192.168.2.16	0x4843	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.97	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:27.637629032 CET	1.1.1.1	192.168.2.16	0x71f7	No error (0)	lh7-rt.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:34.477798939 CET	1.1.1.1	192.168.2.16	0xdcee	No error (0)	l.wl.co	star.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:34.477798939 CET	1.1.1.1	192.168.2.16	0xdcee	No error (0)	star.c10r.facebook.com		157.240.0.13	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:34.478049994 CET	1.1.1.1	192.168.2.16	0xd526	No error (0)	l.wl.co	star.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:34.478049994 CET	1.1.1.1	192.168.2.16	0xd526	No error (0)	star.c10r.facebook.com			65	IN (0x0001)	false
Jan 15, 2025 17:42:34.478049994 CET	1.1.1.1	192.168.2.16	0xd526	No error (0)	star.c10r.facebook.com			65	IN (0x0001)	false
Jan 15, 2025 17:42:35.649679899 CET	1.1.1.1	192.168.2.16	0x315c	No error (0)	qr-codes.io		18.245.46.111	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:35.649679899 CET	1.1.1.1	192.168.2.16	0x315c	No error (0)	qr-codes.io		18.245.46.109	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:35.649679899 CET	1.1.1.1	192.168.2.16	0x315c	No error (0)	qr-codes.io		18.245.46.54	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:35.649679899 CET	1.1.1.1	192.168.2.16	0x315c	No error (0)	qr-codes.io		18.245.46.25	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:37.204304934 CET	1.1.1.1	192.168.2.16	0x5ce3	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:37.204304934 CET	1.1.1.1	192.168.2.16	0x5ce3	No error (0)	scontent.xx.fbcdn.net		157.240.252.13	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:37.204657078 CET	1.1.1.1	192.168.2.16	0xc9a6	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:37.204657078 CET	1.1.1.1	192.168.2.16	0xc9a6	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:37.204657078 CET	1.1.1.1	192.168.2.16	0xc9a6	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:37.883411884 CET	1.1.1.1	192.168.2.16	0x5ab3	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		104.21.79.87	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:37.883411884 CET	1.1.1.1	192.168.2.16	0x5ab3	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		172.67.169.107	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.480469942 CET	1.1.1.1	192.168.2.16	0xed8e	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id			65	IN (0x0001)	false
Jan 15, 2025 17:42:38.555790901 CET	1.1.1.1	192.168.2.16	0x7835	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:38.555790901 CET	1.1.1.1	192.168.2.16	0x7835	No error (0)	scontent.xx.fbcdn.net		157.240.252.13	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.555978060 CET	1.1.1.1	192.168.2.16	0x7495	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:38.555978060 CET	1.1.1.1	192.168.2.16	0x7495	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:38.555978060 CET	1.1.1.1	192.168.2.16	0x7495	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:38.601999044 CET	1.1.1.1	192.168.2.16	0x4655	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.602119923 CET	1.1.1.1	192.168.2.16	0x69c7	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 17:42:38.612782955 CET	1.1.1.1	192.168.2.16	0x972b	No error (0)	googleads.g.doubleclick.net		142.250.185.194	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:38.613595963 CET	1.1.1.1	192.168.2.16	0xb82d	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:38.629048109 CET	1.1.1.1	192.168.2.16	0xff1d	No error (0)	td.doubleclick.net		142.250.184.194	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:39.541174889 CET	1.1.1.1	192.168.2.16	0xd1f9	No error (0)	googleads.g.doubleclick.net		142.250.185.226	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:39.541774988 CET	1.1.1.1	192.168.2.16	0x231	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jan 15, 2025 17:42:39.723710060 CET	1.1.1.1	192.168.2.16	0xfc2	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id			65	IN (0x0001)	false
Jan 15, 2025 17:42:40.913265944 CET	1.1.1.1	192.168.2.16	0x677f	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id			65	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	m.media-amazon.com	tp.c47710ee9-frontier.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	tp.c47710ee9-frontier.media-amazon.com	f.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	f.media-amazon.com	media.amazon.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	media.amazon.map.fastly.net		151.101.129.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	media.amazon.map.fastly.net		151.101.65.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	media.amazon.map.fastly.net		151.101.1.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072335005 CET	1.1.1.1	192.168.2.16	0xc55c	No error (0)	media.amazon.map.fastly.net		151.101.193.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072963953 CET	1.1.1.1	192.168.2.16	0xa4e9	No error (0)	m.media-amazon.com	tp.c47710ee9-frontier.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.072963953 CET	1.1.1.1	192.168.2.16	0xa4e9	No error (0)	tp.c47710ee9-frontier.media-amazon.com	c.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755784988 CET	1.1.1.1	192.168.2.16	0x6769	No error (0)	m.media-amazon.com	tp.c47710ee9-frontier.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755784988 CET	1.1.1.1	192.168.2.16	0x6769	No error (0)	tp.c47710ee9-frontier.media-amazon.com	c.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	m.media-amazon.com	tp.c47710ee9-frontier.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	tp.c47710ee9-frontier.media-amazon.com	f.media-amazon.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	f.media-amazon.com	media.amazon.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	media.amazon.map.fastly.net		151.101.1.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	media.amazon.map.fastly.net		151.101.193.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	media.amazon.map.fastly.net		151.101.65.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:41.755968094 CET	1.1.1.1	192.168.2.16	0x89bf	No error (0)	media.amazon.map.fastly.net		151.101.129.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:42.026985884 CET	1.1.1.1	192.168.2.16	0x9803	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		104.21.79.87	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:42.026985884 CET	1.1.1.1	192.168.2.16	0x9803	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		172.67.169.107	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:42.888674021 CET	1.1.1.1	192.168.2.16	0x539a	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		104.21.79.87	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:42.888674021 CET	1.1.1.1	192.168.2.16	0x539a	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		172.67.169.107	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:43.108620882 CET	1.1.1.1	192.168.2.16	0x20d8	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		104.21.79.87	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:43.108620882 CET	1.1.1.1	192.168.2.16	0x20d8	No error (0)	verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id		172.67.169.107	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:56.383712053 CET	1.1.1.1	192.168.2.16	0x583d	Name error (3)	w3valid.com	none	none	65	IN (0x0001)	false
Jan 15, 2025 17:42:56.541661978 CET	1.1.1.1	192.168.2.16	0x589a	Name error (3)	w3valid.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:42:56.551625013 CET	1.1.1.1	192.168.2.16	0xbecc	Name error (3)	w3valid.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:43:14.394467115 CET	1.1.1.1	192.168.2.16	0x8088	Name error (3)	w3valid.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:43:35.250216007 CET	1.1.1.1	192.168.2.16	0x9883	Name error (3)	w3valid.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:44:27.116986990 CET	1.1.1.1	192.168.2.16	0x7bdd	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:44:27.117207050 CET	1.1.1.1	192.168.2.16	0x3bad	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

https:

lh7-rt.googleusercontent.com

l.wl.co

qr-codes.io

connect.facebook.net

verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id

www.google.com

googleads.g.doubleclick.net

td.doubleclick.net

m.media-amazon.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49713	216.58.212.129	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:27 UTC	1241	OUT	GET /drawingsz/AHiSRb2AUu8o4_LUOezQOJL6RHRd8vT_UkeGI4mWJc3XY7rrFw6Z5t6znqT6LS8UJIULLhm5RcLFi9YFaK9wm5FFOdeAFt3A4fOi0ioQguZQj8LmvHyhcXPnrq7eY_TLGJLlrPY?key=Y8-OnGBlH3ztkqWZFlad5skm HTTP/1.1 Host: lh7-rt.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://docs.google.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: image Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:27 UTC	606	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Vary: Origin Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://docs.google.com Timing-Allow-Origin: https://docs.google.com Access-Control-Expose-Headers: Content-Length ETag: "v0" Expires: Thu, 16 Jan 2025 16:42:27 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="unnamed.jpg" X-Content-Type-Options: nosniff Date: Wed, 15 Jan 2025 16:42:27 GMT Server: fife Content-Length: 37001 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-15 16:42:27 UTC	784	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 4b 00 4b 00 00 ff e2 01 db 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 cb 00 00 00 00 02 40 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 00 00 00 00 00 00 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 51 74 05 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 72 58 59 5a 00 00 00 f0 00 00 00 14 67 58 59 5a 00 00 01 04 00 00 00 14 62 58 59 5a 00 00 01 18 00 00 00 14 77 74 70 74 00 00 01 2c 00 00 00 14 63 70 72 74 00 00 01 40 00 00 00 0c 72 54 52 43 00 00 01 4c 00 00 00 20 67 54 52 43 00 00 01 4c 00 00 00 20 62 Data Ascii: JFIFKKICC_PROFILE@mntrRGB XYZ acsp-QtrXYZgXYZbXYZwtpt,cprt@rTRCL gTRCL b
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: 51 7e 77 bb 1d 49 f9 b7 b2 96 d0 00 00 00 00 00 12 03 ec 52 c4 00 00 00 00 00 0a a5 ae ae 71 c9 32 ac 98 52 60 e8 11 e5 44 b2 6d b0 4e 6d dd 68 9b d8 66 81 eb 79 6e 84 b5 9c e6 c9 7b ba 15 7d b6 e3 2c bb 80 00 00 00 00 00 90 1f 62 96 20 00 00 00 00 00 01 14 ac 66 bf e2 c7 0f 99 b9 af f7 1f 8a a7 f2 1d 9e 75 b0 d0 ef be 7d db d7 0d 9a 80 00 00 00 00 00 00 90 1f 62 96 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 1f 62 96 21 8d 93 e4 c6 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af f5 9d 01 e8 12 03 ec 52 c4 3c fa f2 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 04 f0 1e 81 20 3e c5 2c 43 cf af 24 e0 00 01 4d 2e 4e 7f 62 37 ca Data Ascii: Q~wIRq2R`DmNmhfyn{},b fu}b b!lklklklklkR<N >,C$M.Nb7
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: 19 8f 1e e3 f8 66 b0 bc 99 ec 5c 73 64 d3 65 19 ed 67 a3 62 d4 e4 99 ac 3d 19 68 6b f0 4d f3 49 98 67 a2 d4 1b c6 ae 53 3d ab 94 cf 60 65 9f 35 3b 18 cc e6 27 c3 30 08 27 80 f4 09 01 f6 29 62 1e 7d 79 27 03 96 f5 2d 31 cc 33 ba d7 c3 9f e4 de 07 0e dc f5 81 c9 f1 bb 08 e4 9b 8e 85 f4 a2 6c 2c 79 07 1d 9b ae 0a 2d 17 ba 0e 30 ec e3 84 ed fa f8 e3 19 5d 77 4c 62 d3 3a b0 e7 55 0e e8 39 04 5d 92 b2 50 3a 36 f4 72 ac 2e 99 b8 38 c5 d6 e3 f4 01 04 f0 1e 81 20 3e c5 2c 43 cf af 24 e0 1c 34 ee 4e 53 f0 ea ee 45 bb 3a 16 1f 25 90 ec 4a 15 7c eb ae 30 3b 3b 8b 6b 4e f6 e5 d8 47 4e d8 70 8e aa 6f 75 1c cf 62 75 77 0e bc 97 87 34 c4 3a b3 91 63 9d 97 5f c6 36 c7 55 f5 c6 76 47 5e 72 8f 67 48 8e b1 50 3b 33 8b f5 a3 38 08 27 80 f4 09 01 f6 29 62 1e 7d 79 27 03 59 b3 Data Ascii: f\sdegb=hkMIgS=`e5;'0')b}y'-13l,y-0]wLb:U9]P:6r.8 >,C$4NSE:%J\|0;;kNGNpoubuw4:c_6UvG^rgHP;38')b}y'Y
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: 9b 5d e6 d7 79 b5 de 6d 77 9b 5d e6 d7 79 b5 de 6d 77 9b 58 99 3b bd a1 cf ea 67 cf b4 39 fd 4c f9 f6 87 3f a9 9f 3e d0 e7 f5 33 e7 da 1c fb e6 e2 60 cc 6f 19 cd 41 2e 91 0b 03 b5 8c 25 1b 94 64 bc 6e d1 92 ff 00 d8 ab 74 5b 74 82 15 d8 13 61 56 fd 73 0d 3b 15 9f d5 db e7 49 71 dc ad e3 33 d4 75 b8 c3 57 29 27 93 5b a8 18 ca f1 08 80 97 48 88 09 bc 07 c7 2b 07 19 b1 85 9e 02 8e 2d d2 ca a3 b7 4c d0 35 92 ab e4 d7 83 8e ab ed 02 fc 55 68 4e 07 de 7c fb 43 9f 7b a4 0e 6b 8c a0 7f ec c4 45 8c 09 85 4f 83 39 92 bb 9b 21 1a cb 5b 32 fe c2 aa 8c a8 3a 25 f2 ba 53 01 f4 86 e3 56 ed 28 cd 85 dc 12 65 71 15 69 e5 ac 7d b8 48 64 37 8c 91 3e bd 8a 89 9f 0c 57 0e 50 b0 b0 80 8a df d3 7e 00 82 86 c6 5c 99 19 d3 78 35 8c 2c 57 29 6c 9f cb 03 ad 06 20 8e 3d e7 cf b4 39 Data Ascii: ]ymw]ymwX;g9L?>3`oA.%dnt[taVs;Iq3uW)'[H+-L5UhN\|C{kEO9![2:%SV(eqi}Hd7>WP~\x5,W)l =9
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: d1 92 79 05 76 00 d0 29 f6 44 6a 29 4e 52 a1 29 20 5a 4c b1 9c d2 94 d8 cd 77 f2 5f 49 f3 ed 0e 7f 53 3e 7d a1 cf ce 2e 8b 39 92 fe 70 8b 17 8c 0c b1 b1 67 36 ea db 9a 6e a7 74 6c 83 17 d9 9a fe 7f 38 85 6b 6c 31 72 ed a7 8e 65 4b 23 95 d6 1a 6a 37 b4 f7 2c c6 be 77 f2 8e 1a 36 57 5e 37 d9 11 3c c9 41 1f 32 60 45 7b 63 49 91 dc ee 21 fd 80 fd 95 cd 36 6b 52 59 99 5b 55 ed 8d 26 6c 1f ca 79 9f 50 c8 62 95 f4 96 16 6e 4e 15 1f b5 fa 46 f3 46 cc 2b 9f fb d1 b0 b1 7a 23 15 b1 be d0 6e 18 93 7d 3e cb 2d d6 7c cf 9f 68 73 f2 2a eb 15 70 4a 67 72 b7 8d 2e d9 6a 1b cc d3 a5 65 77 2a aa 0e 89 0d d3 e4 20 e1 44 71 0a bd 36 e1 61 63 50 77 09 35 27 9b 66 54 34 ac c5 50 78 55 e3 a6 a5 09 db 28 47 ab ff 00 ae 98 a4 2d 75 8d 88 49 5f 61 62 20 a2 f9 db 05 3d 94 45 9a 83 Data Ascii: yv)Dj)NR) ZLw_IS>}.9pg6ntl8kl1reK#j7,w6W^7<A2`E{cI!6kRY[U&lyPbnNFF+z#n}>-\|hspJgr.jew Dq6acPw5'fT4PxU(G-uI_ab =E
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: 74 d7 67 27 4d 76 b3 b5 0d cc 2a 0c 46 be 9c 09 8f eb 07 38 82 4b 0c 18 49 6c 44 cb c4 ba 42 93 2a b4 55 c4 c6 be b0 76 ca 92 c7 27 a4 f9 f6 87 3e a6 2c 40 23 5a 2a 09 46 58 9c 75 93 43 05 5c f0 68 3f e7 4f 9f 68 73 f3 16 0f 99 95 97 ce 23 ef 4b 4e 42 51 64 58 25 93 0d 92 6d 49 3f e5 c7 ea e6 7b 3d 40 8c b7 9a 6e f1 9f 64 ad 92 b8 cc 58 36 09 9c 49 25 82 b2 b7 d9 b0 30 1e 29 c0 db c5 38 5b ff 00 16 7c fb 43 9f 9c 22 be 1d 25 2a 25 63 28 2f 28 ce b5 62 69 8a 64 5b c9 69 91 31 45 50 98 75 2a 44 66 18 57 2a 2d 09 61 84 83 e9 e5 ca 71 aa 21 1c 54 a8 81 8f 0c 8f d9 cd 2a 32 64 b4 88 1c e5 a4 40 e7 ff 00 16 7c fb 43 9f d4 cf 9f 68 73 fa 99 f3 ed 0e 7f 53 3e 7d a1 cf ea 67 cf b4 39 fd 4c f9 f6 87 3f 1e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 af 30 0d 79 80 6b cc 03 Data Ascii: tg'MvF8KIlDBUv'>,@#ZFXuC\h?Ohs#KNBQdX%mI?{=@ndX6I%0)8[\|C"%%c(/(bid[i1EPuDfW-aq!T*2d@\|ChsS>}g9L?`50yk
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: bd 97 62 30 ef 40 99 1d 5f 37 7e 2e 9d fe cd db 7e ac cd 71 46 52 00 5f 25 c5 b5 cf 95 cc 9e f4 cc 5b 4c 9e cf af f9 e0 9e 44 34 f1 90 c9 5c 5b 73 1f c4 91 8a 6c cc 9b ed f1 5c 59 27 a4 59 08 c6 36 4c e4 9a 89 69 ae 52 be 5e 1d 5f 37 7e 2e 9d fd 7c bc ea a1 d9 65 e7 55 0e cb 2f 3a a8 76 59 79 d5 43 b2 cb ce aa 1d 96 5e 75 50 ec b2 f3 aa 87 65 97 9d 54 3b 2c bc ea a1 d9 65 e7 55 0e cb 2f 3a a8 76 59 79 d5 43 b2 cb ce aa 1d 96 5e 75 50 ec b2 f3 aa 87 65 97 9d 54 3b 2c bc ea a1 d9 65 e7 55 0e ca 07 c9 ec c0 74 ba 2d 4e 7f b6 7f ff c4 00 4f 10 00 02 01 03 01 03 09 05 05 05 04 08 04 05 05 00 01 02 03 00 04 11 12 13 21 31 05 14 22 32 41 51 71 91 c1 20 23 33 61 81 42 50 a1 a2 b1 10 24 30 52 d1 06 15 62 72 25 34 40 53 73 92 e1 f0 63 82 b2 f1 43 54 60 70 74 75 80 Data Ascii: b0@_7~.~qFR_%[LD4\[sl\Y'Y6LiR^_7~.\|eU/:vYyC^uPeT;,eU/:vYyC^uPeT;,eUt-NO!1"2AQq #3aBP$0Rbr%4@SscCT`ptu
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: 51 e9 92 60 b9 ce ef 96 77 57 28 dc c3 69 3a c6 d6 f1 c2 aa f1 90 d2 10 f9 ea d1 97 66 74 73 20 9a f1 bb 3a f8 57 26 ce eb 7b 0a 8b 3d 93 73 78 83 3a 1d 59 de a5 4d 1d 6b 32 34 b2 34 84 4c 46 ad e7 e4 06 3c 2a e3 16 d3 3e c3 94 f9 ce 9d 1d 74 ff 00 0f 7f 7d 4f 7b b0 96 08 36 0b 10 da a6 92 e7 24 e7 1f 5a d4 92 cb 67 1d a4 58 49 02 03 a9 9b 8e 35 0e e1 4d 60 d1 cb 32 41 ca 30 c8 92 6c f7 32 16 0c 7c 8e 6b 97 98 42 de f6 d9 15 0e 9e bf 45 aa 18 de 3b b8 a3 e6 91 05 e6 d0 8c b9 c6 f0 cc 47 47 f0 ae 4d e4 d9 ed af 22 80 42 39 d3 2d b3 9c e3 76 8d c3 b7 f4 a8 6f d2 d2 e1 ad 5e d7 62 02 c0 75 46 43 7f 2f 1a e4 e9 25 81 d1 5a f6 79 f4 63 e1 86 56 c6 7b ab 95 99 91 95 5e 74 2a 48 e3 ee d6 a6 5e 57 e4 b7 9c 03 fb bc f6 f0 96 3a 7b b2 37 83 56 13 cc 6f 02 c1 34 bb Data Ascii: Q`wW(i:fts :W&{=sx:YMk244LF<>t}O{6$ZgXI5M`2A0l2\|kBE;GGM"B9-vo^buFC/%ZycV{^tH^W:{7Vo4
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: f2 9d a0 19 2a a8 cf 81 f3 c7 0a 59 60 71 24 6e 32 ac 3b 7f 64 6b 23 85 32 1d 28 0f 69 fe 00 83 3e f4 a6 bc 63 b3 db b6 3b 43 fb c8 cc 43 43 64 ff 00 4a 49 61 39 47 5d 4a 71 8d df b2 34 76 01 e4 38 41 df 5a e2 39 5d 45 78 63 78 38 3e da 78 fa 7b 6f e3 e9 ec 5c 5e 5a 4b 7a fb 3b 90 bb 4d a0 48 47 4c 0d 3a 73 d2 ee e1 5c a7 71 27 28 4b 67 cd a6 29 1e 1b a1 18 50 37 91 db f5 ae 52 b9 7e 51 96 cf 9b 4c 52 3d 2d d0 40 a0 6f 23 b7 eb 5c ad 74 6f a6 b7 6b 47 65 89 51 f0 ab a5 41 c9 1d b9 f9 d4 ad 33 10 1a ca de 4d 19 dc a4 ea cd 72 54 72 dd dc 04 7b 16 95 f4 ca 41 73 a8 76 f1 ed ae 4b 17 13 4d 21 8f 94 66 87 56 d0 82 55 75 e3 38 ed dd c6 84 f7 73 dd 6c 9a eb 0b 34 52 87 80 ae ac 04 2b 9d dd de 3f b2 fe 7e 45 ba 85 9c ba 8b 88 27 8c e3 50 51 c1 bc 2a ce f1 63 e6 Data Ascii: Y`q$n2;dk#2(i>c;CCCdJIa9G]Jq4v8AZ9]Excx8>x{o\^ZKz;MHGL:s\q'(Kg)P7R~QLR=-@o#\tokGeQA3MrTr{AsvKM!fVUu8sl4R+?~E'PQc
2025-01-15 16:42:27 UTC	1390	IN	Data Raw: e1 9a b0 ff 00 84 2a cd b9 d9 ba 8e 79 f6 6e 16 db 4c 23 39 ea be 37 fe 35 1d f4 77 31 ac 4f 2f fa bb 26 ed 9e ac 71 e3 aa a3 be 8e e6 35 89 e5 ff 00 57 64 dd b3 d5 8e 3c 75 53 f2 b0 b8 1b 15 90 fe ed b3 1d 40 fa 78 f1 cd 72 f3 ed 3a 56 a5 b6 5b 87 47 dd 06 fd 4d 4d 14 37 dc d9 23 b6 89 f2 23 53 d2 60 7b fc 2b 91 6e 9e 62 ad 2d 93 bb 28 03 1f 63 3e 75 67 65 69 2f 37 33 07 77 93 48 24 05 c7 0c f8 d0 8e e2 50 e2 de f9 60 99 c2 81 ad 1d 7a 27 e5 bd 85 08 8c 98 9a e2 ee 36 84 e9 1b a0 6c b7 e8 ad 53 5f f3 ce 84 57 6d 18 87 66 b8 65 da e9 df db 57 bc d6 59 a3 e6 ef a2 38 e3 b2 69 43 90 3e d3 62 9d 4c 86 de 08 e1 86 46 8b 46 fc b6 72 bf 85 5b a4 77 5c d7 68 c7 3a 61 da 48 df e5 5c 1a 50 92 e9 b8 fe f0 16 db 47 87 07 4f cd 6a ea cf 9c 0b 89 75 5b ac 32 bc 60 69 Data Ascii: *ynL#975w1O/&q5Wd<uS@xr:V[GMM7##S`{+nb-(c>ugei/73wH$P`z'6lS_WmfeWY8iC>bLFFr[w\h:aH\PGOju[2`i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49717	142.250.185.97	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:28 UTC	619	OUT	GET /drawingsz/AHiSRb2AUu8o4_LUOezQOJL6RHRd8vT_UkeGI4mWJc3XY7rrFw6Z5t6znqT6LS8UJIULLhm5RcLFi9YFaK9wm5FFOdeAFt3A4fOi0ioQguZQj8LmvHyhcXPnrq7eY_TLGJLlrPY?key=Y8-OnGBlH3ztkqWZFlad5skm HTTP/1.1 Host: lh7-rt.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:28 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v0" Expires: Thu, 16 Jan 2025 16:42:28 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="unnamed.jpg" X-Content-Type-Options: nosniff Date: Wed, 15 Jan 2025 16:42:28 GMT Server: fife Content-Length: 37001 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-15 16:42:28 UTC	868	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 4b 00 4b 00 00 ff e2 01 db 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 cb 00 00 00 00 02 40 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 00 00 00 00 00 00 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 51 74 05 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 72 58 59 5a 00 00 00 f0 00 00 00 14 67 58 59 5a 00 00 01 04 00 00 00 14 62 58 59 5a 00 00 01 18 00 00 00 14 77 74 70 74 00 00 01 2c 00 00 00 14 63 70 72 74 00 00 01 40 00 00 00 0c 72 54 52 43 00 00 01 4c 00 00 00 20 67 54 52 43 00 00 01 4c 00 00 00 20 62 Data Ascii: JFIFKKICC_PROFILE@mntrRGB XYZ acsp-QtrXYZgXYZbXYZwtpt,cprt@rTRCL gTRCL b
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: 01 14 ac 66 bf e2 c7 0f 99 b9 af f7 1f 8a a7 f2 1d 9e 75 b0 d0 ef be 7d db d7 0d 9a 80 00 00 00 00 00 00 90 1f 62 96 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 1f 62 96 21 8d 93 e4 c6 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af 6c 06 bd b0 1a f6 c0 6b db 01 af f5 9d 01 e8 12 03 ec 52 c4 3c fa f2 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 04 f0 1e 81 20 3e c5 2c 43 cf af 24 e0 00 01 4d 2e 4e 7f 62 37 ca ce 41 be 57 f1 8b 4b 47 b1 32 d5 1d d1 b4 56 25 2c 4a ae 61 be 68 a3 2c 2d 06 69 b2 52 f6 65 85 a3 1b c6 a7 48 5c 5a 1d 91 98 00 00 41 3c 07 a0 48 0f b1 4b 10 f3 eb c9 38 00 01 cd ba 48 e6 ba 5e c8 39 8c bd 24 72 7b 85 a0 71 9e 81 66 1c ae c7 71 14 5d Data Ascii: fu}b b!lklklklklkR<N >,C$M.Nb7AWKG2V%,Jah,-iReH\ZA<HK8H^9$r{qfq]
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: f5 81 c9 f1 bb 08 e4 9b 8e 85 f4 a2 6c 2c 79 07 1d 9b ae 0a 2d 17 ba 0e 30 ec e3 84 ed fa f8 e3 19 5d 77 4c 62 d3 3a b0 e7 55 0e e8 39 04 5d 92 b2 50 3a 36 f4 72 ac 2e 99 b8 38 c5 d6 e3 f4 01 04 f0 1e 81 20 3e c5 2c 43 cf af 24 e0 1c 34 ee 4e 53 f0 ea ee 45 bb 3a 16 1f 25 90 ec 4a 15 7c eb ae 30 3b 3b 8b 6b 4e f6 e5 d8 47 4e d8 70 8e aa 6f 75 1c cf 62 75 77 0e bc 97 87 34 c4 3a b3 91 63 9d 97 5f c6 36 c7 55 f5 c6 76 47 5e 72 8f 67 48 8e b1 50 3b 33 8b f5 a3 38 08 27 80 f4 09 01 f6 29 62 1e 7d 79 27 03 59 b3 1a ff 00 59 d0 10 7c c5 db 18 fe 33 a0 35 b9 72 e4 9a df 5b 01 80 cf 18 53 4e 35 d9 92 8d 64 f9 83 06 79 c6 0b 38 41 1e 58 ae 6e 72 86 07 cd 80 c3 ac dc 86 37 9c b1 83 9c 00 20 9e 03 d0 24 07 d8 a5 88 79 f5 e4 9c 0e 63 d3 b5 c7 2d da 5b f3 4e 6d b5 b8 Data Ascii: l,y-0]wLb:U9]P:6r.8 >,C$4NSE:%J\|0;;kNGNpoubuw4:c_6UvG^rgHP;38')b}y'YY\|35r[SN5dy8AXnr7 $yc-[Nm
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: 0d 3b 15 9f d5 db e7 49 71 dc ad e3 33 d4 75 b8 c3 57 29 27 93 5b a8 18 ca f1 08 80 97 48 88 09 bc 07 c7 2b 07 19 b1 85 9e 02 8e 2d d2 ca a3 b7 4c d0 35 92 ab e4 d7 83 8e ab ed 02 fc 55 68 4e 07 de 7c fb 43 9f 7b a4 0e 6b 8c a0 7f ec c4 45 8c 09 85 4f 83 39 92 bb 9b 21 1a cb 5b 32 fe c2 aa 8c a8 3a 25 f2 ba 53 01 f4 86 e3 56 ed 28 cd 85 dc 12 65 71 15 69 e5 ac 7d b8 48 64 37 8c 91 3e bd 8a 89 9f 0c 57 0e 50 b0 b0 80 8a df d3 7e 00 82 86 c6 5c 99 19 d3 78 35 8c 2c 57 29 6c 9f cb 03 ad 06 20 8e 3d e7 cf b4 39 fd 01 51 09 d9 fc 13 e7 da 1c fe a6 7c fb 43 9f d4 cf 9f 68 73 f3 5d 77 07 dd 56 d0 66 5d cb 95 13 09 1d 58 33 ce 7f 8d 08 b0 38 ff 00 41 3e 7d a1 cf c8 93 21 82 99 c4 41 92 42 ec 77 b6 2c 2b 1c 89 25 08 03 2d fa 09 f3 ed 0e 7f 53 3e 7d a1 cf ea 67 cf Data Ascii: ;Iq3uW)'[H+-L5UhN\|C{kEO9![2:%SV(eqi}Hd7>WP~\x5,W)l =9Q\|Chs]wVf]X38A>}!ABw,+%-S>}g
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: f7 2c c6 be 77 f2 8e 1a 36 57 5e 37 d9 11 3c c9 41 1f 32 60 45 7b 63 49 91 dc ee 21 fd 80 fd 95 cd 36 6b 52 59 99 5b 55 ed 8d 26 6c 1f ca 79 9f 50 c8 62 95 f4 96 16 6e 4e 15 1f b5 fa 46 f3 46 cc 2b 9f fb d1 b0 b1 7a 23 15 b1 be d0 6e 18 93 7d 3e cb 2d d6 7c cf 9f 68 73 f2 2a eb 15 70 4a 67 72 b7 8d 2e d9 6a 1b cc d3 a5 65 77 2a aa 0e 89 0d d3 e4 20 e1 44 71 0a bd 36 e1 61 63 50 77 09 35 27 9b 66 54 34 ac c5 50 78 55 e3 a6 a5 09 db 28 47 ab ff 00 ae 98 a4 2d 75 8d 88 49 5f 61 62 20 a2 f9 db 05 3d 94 45 9a 83 e6 a1 65 0c 0b 27 aa 48 e3 41 45 f3 b7 73 55 9b 1c 8a 8c b0 13 35 cd 4d 8c 74 f1 f2 13 56 59 3a 6b 0a 5c b5 1a 84 24 80 5d a9 65 89 58 d6 19 b6 93 a5 65 77 29 d4 32 29 7c cf 9f 68 73 fa 99 f3 ed 0e 7e 67 7c cf 64 2e d7 ec 52 d6 0d 1d db 28 a6 4f 38 bf Data Ascii: ,w6W^7<A2`E{cI!6kRY[U&lyPbnNFF+z#n}>-\|hspJgr.jew Dq6acPw5'fT4PxU(G-uI_ab =Ee'HAEsU5MtVY:k\$]eXew)2)\|hs~g\|d.R(O8
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: 51 64 58 25 93 0d 92 6d 49 3f e5 c7 ea e6 7b 3d 40 8c b7 9a 6e f1 9f 64 ad 92 b8 cc 58 36 09 9c 49 25 82 b2 b7 d9 b0 30 1e 29 c0 db c5 38 5b ff 00 16 7c fb 43 9f 9c 22 be 1d 25 2a 25 63 28 2f 28 ce b5 62 69 8a 64 5b c9 69 91 31 45 50 98 75 2a 44 66 18 57 2a 2d 09 61 84 83 e9 e5 ca 71 aa 21 1c 54 a8 81 8f 0c 8f d9 cd 2a 32 64 b4 88 1c e5 a4 40 e7 ff 00 16 7c fb 43 9f d4 cf 9f 68 73 fa 99 f3 ed 0e 7f 53 3e 7d a1 cf ea 67 cf b4 39 fd 4c f9 f6 87 3f 1e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 af 30 0d 79 80 6b cc 03 5e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 af 30 0d 79 80 6b cc 03 5e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 af 30 0d 79 80 6b cc 03 5e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 af 30 0d 79 80 6b cc 03 5e 60 1a f3 00 d7 98 06 bc c0 35 e6 01 f3 3e 7d a1 cf ea 67 cf Data Ascii: QdX%mI?{=@ndX6I%0)8[\|C"%%c(/(bid[i1EPuDfW-aq!T2d@\|ChsS>}g9L?`50yk^`50yk^`50yk^`50yk^`5>}g
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: ea a1 d9 65 e7 55 0e cb 2f 3a a8 76 59 79 d5 43 b2 cb ce aa 1d 96 5e 75 50 ec b2 f3 aa 87 65 97 9d 54 3b 2c bc ea a1 d9 65 e7 55 0e cb 2f 3a a8 76 59 79 d5 43 b2 cb ce aa 1d 96 5e 75 50 ec b2 f3 aa 87 65 97 9d 54 3b 2c bc ea a1 d9 65 e7 55 0e ca 07 c9 ec c0 74 ba 2d 4e 7f b6 7f ff c4 00 4f 10 00 02 01 03 01 03 09 05 05 05 04 08 04 05 05 00 01 02 03 00 04 11 12 13 21 31 05 14 22 32 41 51 71 91 c1 20 23 33 61 81 42 50 a1 a2 b1 10 24 30 52 d1 06 15 62 72 25 34 40 53 73 92 e1 f0 63 82 b2 f1 43 54 60 70 74 75 80 93 c2 d2 ff da 00 08 01 01 00 06 3f 02 ff 00 ed 24 d7 4c ba f6 63 72 f7 9a 97 94 2d 74 c7 69 1e 49 d2 8b eb be ae 0d c2 a8 b8 b7 e2 47 03 ff 00 78 a9 61 b6 81 67 b8 3d 4d 11 f5 6a 5b 69 20 e7 37 8d ba 2c 26 f0 7e 62 92 c7 95 d4 7b c7 d0 46 8d 25 0d 47 Data Ascii: eU/:vYyC^uPeT;,eU/:vYyC^uPeT;,eUt-NO!1"2AQq #3aBP$0Rbr%4@SscCT`ptu?$Lcr-tiIGxag=Mj[i 7,&~b{F%G
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: 7f 7d 4f 7b b0 96 08 36 0b 10 da a6 92 e7 24 e7 1f 5a d4 92 cb 67 1d a4 58 49 02 03 a9 9b 8e 35 0e e1 4d 60 d1 cb 32 41 ca 30 c8 92 6c f7 32 16 0c 7c 8e 6b 97 98 42 de f6 d9 15 0e 9e bf 45 aa 18 de 3b b8 a3 e6 91 05 e6 d0 8c b9 c6 f0 cc 47 47 f0 ae 4d e4 d9 ed af 22 80 42 39 d3 2d b3 9c e3 76 8d c3 b7 f4 a8 6f d2 d2 e1 ad 5e d7 62 02 c0 75 46 43 7f 2f 1a e4 e9 25 81 d1 5a f6 79 f4 63 e1 86 56 c6 7b ab 95 99 91 95 5e 74 2a 48 e3 ee d6 a6 5e 57 e4 b7 9c 03 fb bc f6 f0 96 3a 7b b2 37 83 56 13 cc 6f 02 c1 34 bb 93 12 4c 91 b7 57 8e 73 ff 00 5a 5b fd 8d e4 da 6f 16 47 59 82 ed 1d 42 15 d5 a0 01 df e3 ba 85 dc 5c 9d 2a 2c 57 71 39 f7 78 92 45 03 79 d3 c7 76 6b 97 1d 2d 2e 02 4b 1d ba c6 1e 32 0b e0 9c ee a9 36 71 b1 07 93 a5 40 71 bb 56 46 ea e4 ab 9b 34 78 ee Data Ascii: }O{6$ZgXI5M`2A0l2\|kBE;GGM"B9-vo^buFC/%ZycV{^tH^W:{7Vo4LWsZ[oGYB\,Wq9xEyvk-.K26q@qVF4x
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: e9 ec 5c 5e 5a 4b 7a fb 3b 90 bb 4d a0 48 47 4c 0d 3a 73 d2 ee e1 5c a7 71 27 28 4b 67 cd a6 29 1e 1b a1 18 50 37 91 db f5 ae 52 b9 7e 51 96 cf 9b 4c 52 3d 2d d0 40 a0 6f 23 b7 eb 5c ad 74 6f a6 b7 6b 47 65 89 51 f0 ab a5 41 c9 1d b9 f9 d4 ad 33 10 1a ca de 4d 19 dc a4 ea cd 72 54 72 dd dc 04 7b 16 95 f4 ca 41 73 a8 76 f1 ed ae 4b 17 13 4d 21 8f 94 66 87 56 d0 82 55 75 e3 38 ed dd c6 84 f7 73 dd 6c 9a eb 0b 34 52 87 80 ae ac 04 2b 9d dd de 3f b2 fe 7e 45 ba 85 9c ba 8b 88 27 8c e3 50 51 c1 bc 2a ce f1 63 e6 70 c3 76 f0 5d 46 1f a1 92 70 5b fe 6a b4 99 64 95 b9 d4 af 3b 40 97 1b 39 0a 1e a8 52 7b 86 2b 92 73 35 db 94 bd 78 ce d5 8a ba f4 18 e0 e3 b7 e7 4f 7d 18 bc 13 6d ce 93 ce 23 58 00 0f 8d 25 4b 7a 67 35 cb d7 49 79 73 1b 5a 30 d8 aa c9 d1 1e ed 4f 0a Data Ascii: \^ZKz;MHGL:s\q'(Kg)P7R~QLR=-@o#\tokGeQA3MrTr{AsvKM!fVUu8sl4R+?~E'PQ*cpv]Fp[jd;@9R{+s5xO}m#X%Kzg5IysZ0O
2025-01-15 16:42:28 UTC	1390	IN	Data Raw: dd 06 fd 4d 4d 14 37 dc d9 23 b6 89 f2 23 53 d2 60 7b fc 2b 91 6e 9e 62 ad 2d 93 bb 28 03 1f 63 3e 75 67 65 69 2f 37 33 07 77 93 48 24 05 c7 0c f8 d0 8e e2 50 e2 de f9 60 99 c2 81 ad 1d 7a 27 e5 bd 85 08 8c 98 9a e2 ee 36 84 e9 1b a0 6c b7 e8 ad 53 5f f3 ce 84 57 6d 18 87 66 b8 65 da e9 df db 57 bc d6 59 a3 e6 ef a2 38 e3 b2 69 43 90 3e d3 62 9d 4c 86 de 08 e1 86 46 8b 46 fc b6 72 bf 85 5b a4 77 5c d7 68 c7 3a 61 da 48 df e5 5c 1a 50 92 e9 b8 fe f0 16 db 47 87 07 4f cd 6a ea cf 9c 0b 89 75 5b ac 32 bc 60 69 da 12 37 81 e1 48 b7 77 1c e4 73 16 2a e5 02 9e ba f7 7b 69 e3 e9 ed bf 8f a7 b1 d6 93 fd 6b 9d 71 fb 7f d2 b6 e9 3c f6 b2 b2 68 76 85 b1 a8 7c ea 19 2d f2 9b 18 0c 2a b9 dd a7 20 fa 55 bc 01 a4 d1 04 db 65 df db 92 7d 68 45 23 bc 78 75 75 64 e2 08 39 Data Ascii: MM7##S`{+nb-(c>ugei/73wH$P`z'6lS_WmfeWY8iC>bLFFr[w\h:aH\PGOju[2`i7Hws{ikq<hv\|- Ue}hE#xuud9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49723	157.240.0.13	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:35 UTC	721	OUT	GET /l?u=https://qr-codes.io/ahBobi HTTP/1.1 Host: l.wl.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:35 UTC	1160	IN	HTTP/1.1 200 OK Vary: Accept-Encoding refresh: 1;URL=https://qr-codes.io/ahBobi referrer-policy: origin x-robots-tag: noindex, nofollow reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: https://.wl.co https://.fbcdn.net;script-src 'self' 'nonce-4aQ2N192' data: blob: https://.wl.co https://.fbcdn.net;style-src 'self' 'unsafe-inline' data: blob: https://.wl.co https://.fbcdn.net;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top
2025-01-15 16:42:35 UTC	1669	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-15 16:42:35 UTC	171	IN	Data Raw: 64 63 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 34 61 51 32 4e 31 39 32 22 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 22 68 74 Data Ascii: dc<html><head><meta charset="utf-8" /><meta name="referrer" content="origin" /></head><body><script type="text/javascript" nonce="4aQ2N192">document.location.replace("ht
2025-01-15 16:42:35 UTC	60	IN	Data Raw: 74 70 73 3a 5c 2f 5c 2f 71 72 2d 63 6f 64 65 73 2e 69 6f 5c 2f 61 68 42 6f 62 69 22 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: tps:\/\/qr-codes.io\/ahBobi");</script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49724	18.245.46.111	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:36 UTC	673	OUT	GET /ahBobi HTTP/1.1 Host: qr-codes.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://l.wl.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:37 UTC	1418	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 3222 Connection: close Date: Wed, 15 Jan 2025 16:42:36 GMT Server: nginx Cache-Control: private, max-age=1 Content-Security-Policy: frame-ancestors 'self'; Access-Control-Allow-Origin: https://qr-codes.io Access-Control-Allow-Headers: Authorization, Content-Type, x-csrftoken Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS, PATCH Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: geolocation=*, microphone=(), camera=() Content-Language: en Vary: Accept-Encoding,Origin,Cookie,Accept-Language,Accept-Encoding Set-Cookie: visitor-id=1736959356bvJh51; expires=Thu, 15 Jan 2026 16:42:36 GMT; Max-Age=31536000; Path=/ Set-Cookie: mappable_id=1736959356bvJh51_1736959356; expires=Wed, 15 Jan 2025 17:42:36 GMT; Max-Age=3600; Path=/ Set-Cookie: access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXBwYWJsZUlEIjoiMTczNjk1OTM1NmJ2Smg1MV8xNzM2OTU5MzU2IiwidGltZXN0YW1wIjoxNzM2OTU5MzU2OTYwLCJpYXQiOjE3MzY5NTkzMjYsImV4cCI6MTczNjk1OTY1Nn0.pS7KsM-iFHrbEMLdWW8LJhxMy9vhAv_bP4_i66eyAbo; expires=Wed, 15 Jan 2025 16:47:36 GMT; Max-Age=300; Path=/ X-Cache: Miss from cloudfront Via: 1.1 e999795aa400a9b7027a66ec4ada5728.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P9 X-Amz-Cf-Id: bvXEThfVOQnBLyAxGzhjDHSGseC3IOJAdQp7U-XLoehljQWxj2PgJw==
2025-01-15 16:42:37 UTC	3222	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 41 6e 61 6c 79 74 69 63 73 20 2d 2d 3e 0a 20 20 20 20 0a 0a 20 20 20 20 0a 3c 21 2d 2d 20 45 6e 64 20 6f 66 20 47 6f 6f 67 6c 65 20 41 6e 61 6c 79 74 69 63 73 20 2d 2d 3e 0a 0a 3c 21 2d 2d 20 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 20 43 6f 64 65 20 2d 2d 3e 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 21 66 75 6e 63 74 69 6f 6e 28 66 2c 62 2c 65 2c 76 2c 6e 2c 74 2c 73 29 7b 69 66 28 66 2e 66 62 71 29 72 65 74 75 72 6e 3b 6e 3d 66 2e 66 62 71 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 63 61 6c 6c 4d 65 74 68 6f 64 3f 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 2e 63 61 6c 6c 4d Data Ascii: <html lang="en"><head> ... Google Analytics --> ... End of Google Analytics -->... Facebook Pixel Code --> <script> !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49727	157.240.252.13	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:37 UTC	532	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qr-codes.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:38 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-sBf4v58O' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-15 16:42:38 UTC	1671	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-15 16:42:38 UTC	1	IN	Data Raw: 2f Data Ascii: /
2025-01-15 16:42:38 UTC	14680	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2025-01-15 16:42:38 UTC	16384	IN	Data Raw: 7c 64 3d 3d 3d 22 47 54 4d 22 7c 7c 64 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 7c 7c 64 3d 3d 3d 22 4d 45 54 41 5f 54 41 47 22 7c 7c 64 3d 3d 3d 22 4f 50 45 4e 5f 47 52 41 50 48 22 7c 7c 64 3d 3d 3d 22 52 44 46 41 22 7c 7c 64 3d 3d 3d 22 53 43 48 45 4d 41 5f 44 4f 54 5f 4f 52 47 22 7c 7c 64 3d 3d 3d 22 55 52 49 22 3f 64 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 26 26 64 21 3d 6e 75 6c 6c 3f 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e Data Ascii: \|d==="GTM"\|\|d==="JSON_LD"\|\|d==="META_TAG"\|\|d==="OPEN_GRAPH"\|\|d==="RDFA"\|\|d==="SCHEMA_DOT_ORG"\|\|d==="URI"?d:null;return b!=null&&c!=null&&a!=null&&d!=null?{domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefin
2025-01-15 16:42:38 UTC	16384	IN	Data Raw: 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f Data Ascii: urn j.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsExperimentsTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enfo
2025-01-15 16:42:38 UTC	16384	IN	Data Raw: 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 2c 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 64 3d 63 2e 54 79 70 65 64 2c 65 3d 63 2e 63 6f 65 72 63 65 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 63 2c 66 2c 67 2c 68 29 7b 61 3d 65 28 61 2c 62 29 3b 63 3d 65 28 63 2c 64 2e 73 74 72 69 6e 67 28 29 29 3b 76 61 72 Data Ascii: ;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsPixelTypedef"),c=f.getFbeventsModules("SignalsFBEventsTyped"),d=c.Typed,e=c.coerce;function g(a,c,f,g,h){a=e(a,b);c=e(c,d.string());var
2025-01-15 16:42:38 UTC	1703	IN	Data Raw: 61 6c 6c 28 6a 5b 61 5b 30 5d 5d 2c 61 5b 31 5d 29 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 62 3d 67 5b 6b 28 61 29 5d 3b 62 3d 62 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 2e 63 61 6c 6c 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3d 3d 3d 64 3f 62 3a 6e 75 6c 6c 3b 62 21 3d 3d 6e 75 6c 6c 26 26 28 6a 5b 61 5b 30 5d 5d 3d 6a 5b 61 5b 30 5d 5d 7c 7c 7b 7d 2c 6a 5b 61 5b 30 5d 5d 5b 61 5b 31 5d 5d 3d 62 29 3b 72 65 74 75 72 6e 20 62 21 3d 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 61 3d 6a 5b 61 2e 69 64 5d 7c 7c 7b 7d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 Data Ascii: all(j[a[0]],a[1]))return!0;var b=g[k(a)];b=b&&b.getProtocol.call&&b.getProtocol()===d?b:null;b!==null&&(j[a[0]]=j[a[0]]\|\|{},j[a[0]][a[1]]=b);return b!==null}function n(a){var b=[];a=j[a.id]\|\|{};for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b.p
2025-01-15 16:42:38 UTC	14681	IN	Data Raw: 6c 65 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 62 28 61 2c 63 29 3b 61 21 3d 6e 75 6c 6c 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 61 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 69 66 28 67 2e 66 62 71 3d 3d 6e 75 6c 6c 7c 7c 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 69 66 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 76 61 72 20 66 3d 62 28 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 Data Ascii: leEncodings",value:function(a){a=b(a,c);a!=null&&(this.moduleEncodings=a)}},{key:"addEncodings",value:function(a){var c=this;if(g.fbq==null\|\|g.fbq.__fbeventsResolvedModules==null)return;if(this.moduleEncodings==null)return;var f=b(g.fbq.__fbeventsResolved
2025-01-15 16:42:38 UTC	16384	IN	Data Raw: 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 42 61 74 63 68 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 74 63 68 Data Ascii: ["boolean"]()))});k.exports=a})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsSendBatch",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsBatch
2025-01-15 16:42:38 UTC	16384	IN	Data Raw: 69 6f 6e 20 61 28 29 7b 76 61 72 20 62 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 21 3d 3d 76 6f 69 64 20 30 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 22 22 3b 6e 28 74 68 69 73 2c 61 29 3b 76 61 72 20 63 3d 6a 28 74 68 69 73 2c 28 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 61 29 29 2e 63 61 6c 6c 28 74 68 69 73 2c 62 29 29 3b 63 2e 6e 61 6d 65 3d 22 46 42 45 76 65 6e 74 73 43 6f 65 72 63 69 6f 6e 45 72 72 6f 72 22 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 20 61 7d 28 45 72 72 6f 72 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 76 61 6c 75 65 73 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 Data Ascii: ion a(){var b=arguments.length>0&&arguments[0]!==void 0?arguments[0]:"";n(this,a);var c=j(this,(a.__proto__\|\|Object.getPrototypeOf(a)).call(this,b));c.name="FBEventsCoercionError";return c}return a}(Error);function h(a){return Object.values(a)}function m(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49728	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:38 UTC	713	OUT	GET /?yyy HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://qr-codes.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:38 UTC	1123	IN	HTTP/1.1 307 Temporary Redirect Date: Wed, 15 Jan 2025 16:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9; path=/ cf-cache-status: DYNAMIC Location: http://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uwvm5BU6BZ0CxVCQUfXu2nosVQqM%2B3KBnxZDaoqyeXQczOEK4tE5JtDMisV9AdfrE5%2F3%2BBocvg7hPdofe4MpOpK7rpFgjwBNTIGkz%2FF4z1V2MFUbgxmcHmOwOPNaEyv0hmJSRKEXebtNfTAy%2BLDiNUIJGYhrx1Rnk%2FGCc5PQ%2Fl5WaYBU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902751f6adda420b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1723&min_rtt=1712&rtt_var=664&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1291&delivery_rate=1621321&cwnd=136&unsent_bytes=0&cid=49ce07f52c832ae3&ts=564&x=0"
2025-01-15 16:42:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49730	157.240.252.13	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:39 UTC	361	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:39 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-sBf4v58O' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-15 16:42:39 UTC	1670	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-15 16:42:39 UTC	1	IN	Data Raw: 2f Data Ascii: /
2025-01-15 16:42:39 UTC	14680	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2025-01-15 16:42:39 UTC	16384	IN	Data Raw: 7c 64 3d 3d 3d 22 47 54 4d 22 7c 7c 64 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 7c 7c 64 3d 3d 3d 22 4d 45 54 41 5f 54 41 47 22 7c 7c 64 3d 3d 3d 22 4f 50 45 4e 5f 47 52 41 50 48 22 7c 7c 64 3d 3d 3d 22 52 44 46 41 22 7c 7c 64 3d 3d 3d 22 53 43 48 45 4d 41 5f 44 4f 54 5f 4f 52 47 22 7c 7c 64 3d 3d 3d 22 55 52 49 22 3f 64 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 26 26 64 21 3d 6e 75 6c 6c 3f 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e Data Ascii: \|d==="GTM"\|\|d==="JSON_LD"\|\|d==="META_TAG"\|\|d==="OPEN_GRAPH"\|\|d==="RDFA"\|\|d==="SCHEMA_DOT_ORG"\|\|d==="URI"?d:null;return b!=null&&c!=null&&a!=null&&d!=null?{domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefin
2025-01-15 16:42:39 UTC	16384	IN	Data Raw: 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f Data Ascii: urn j.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsExperimentsTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enfo
2025-01-15 16:42:39 UTC	16384	IN	Data Raw: 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 2c 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 64 3d 63 2e 54 79 70 65 64 2c 65 3d 63 2e 63 6f 65 72 63 65 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 63 2c 66 2c 67 2c 68 29 7b 61 3d 65 28 61 2c 62 29 3b 63 3d 65 28 63 2c 64 2e 73 74 72 69 6e 67 28 29 29 3b 76 61 72 Data Ascii: ;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsPixelTypedef"),c=f.getFbeventsModules("SignalsFBEventsTyped"),d=c.Typed,e=c.coerce;function g(a,c,f,g,h){a=e(a,b);c=e(c,d.string());var
2025-01-15 16:42:39 UTC	1703	IN	Data Raw: 61 6c 6c 28 6a 5b 61 5b 30 5d 5d 2c 61 5b 31 5d 29 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 62 3d 67 5b 6b 28 61 29 5d 3b 62 3d 62 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 2e 63 61 6c 6c 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3d 3d 3d 64 3f 62 3a 6e 75 6c 6c 3b 62 21 3d 3d 6e 75 6c 6c 26 26 28 6a 5b 61 5b 30 5d 5d 3d 6a 5b 61 5b 30 5d 5d 7c 7c 7b 7d 2c 6a 5b 61 5b 30 5d 5d 5b 61 5b 31 5d 5d 3d 62 29 3b 72 65 74 75 72 6e 20 62 21 3d 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 61 3d 6a 5b 61 2e 69 64 5d 7c 7c 7b 7d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 Data Ascii: all(j[a[0]],a[1]))return!0;var b=g[k(a)];b=b&&b.getProtocol.call&&b.getProtocol()===d?b:null;b!==null&&(j[a[0]]=j[a[0]]\|\|{},j[a[0]][a[1]]=b);return b!==null}function n(a){var b=[];a=j[a.id]\|\|{};for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b.p
2025-01-15 16:42:39 UTC	14681	IN	Data Raw: 6c 65 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 62 28 61 2c 63 29 3b 61 21 3d 6e 75 6c 6c 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 61 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 69 66 28 67 2e 66 62 71 3d 3d 6e 75 6c 6c 7c 7c 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 69 66 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 76 61 72 20 66 3d 62 28 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 Data Ascii: leEncodings",value:function(a){a=b(a,c);a!=null&&(this.moduleEncodings=a)}},{key:"addEncodings",value:function(a){var c=this;if(g.fbq==null\|\|g.fbq.__fbeventsResolvedModules==null)return;if(this.moduleEncodings==null)return;var f=b(g.fbq.__fbeventsResolved
2025-01-15 16:42:39 UTC	16384	IN	Data Raw: 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 42 61 74 63 68 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 74 63 68 Data Ascii: ["boolean"]()))});k.exports=a})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsSendBatch",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsBatch
2025-01-15 16:42:39 UTC	16384	IN	Data Raw: 69 6f 6e 20 61 28 29 7b 76 61 72 20 62 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 21 3d 3d 76 6f 69 64 20 30 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 22 22 3b 6e 28 74 68 69 73 2c 61 29 3b 76 61 72 20 63 3d 6a 28 74 68 69 73 2c 28 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 61 29 29 2e 63 61 6c 6c 28 74 68 69 73 2c 62 29 29 3b 63 2e 6e 61 6d 65 3d 22 46 42 45 76 65 6e 74 73 43 6f 65 72 63 69 6f 6e 45 72 72 6f 72 22 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 20 61 7d 28 45 72 72 6f 72 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 76 61 6c 75 65 73 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 Data Ascii: ion a(){var b=arguments.length>0&&arguments[0]!==void 0?arguments[0]:"";n(this,a);var c=j(this,(a.__proto__\|\|Object.getPrototypeOf(a)).call(this,b));c.name="FBEventsCoercionError";return c}return a}(Error);function h(a){return Object.values(a)}function m(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49732	216.58.206.36	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:39 UTC	1170	OUT	POST /ccm/collect?en=page_view&dr=l.wl.co&dl=https%3A%2F%2Fqr-codes.io%2FahBobi&scrsrc=www.googletagmanager.com&frm=0&rnd=1153948641.1736959358&auid=1381957673.1736959358&navt=n&npa=0&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1736959358072&tfd=2976&apve=1 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://qr-codes.io X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://qr-codes.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=PJy21mGiYU6QUCRbSAEgwzWSBZuV7b64Bicn4EGA9zIsBv70ecHnf6tAGDPaQkCZz2PZlc4WKQqg0-bNJ-3d27EnUoBDs-IoTc-WSyoopKTsRJmzD7Lt6Y9l22_9MwdywuInuwqvf-waxrPjueWhm-gw2XyKgD-wh58MUyfn7v-QfhEU8a45GJavgG38eLTL
2025-01-15 16:42:39 UTC	575	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:39 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/plain Expires: Fri, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Vary: Origin Vary: X-Origin Vary: Referer Server: scaffolding on HTTPServer2 Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://qr-codes.io Access-Control-Expose-Headers: date,vary,vary,vary,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49733	142.250.185.194	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:39 UTC	1189	OUT	GET /pagead/viewthroughconversion/None/?random=1736959358060&cv=11&fst=1736959358060&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qr-codes.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:39 UTC	842	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 15 Jan 2025 16:42:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 15-Jan-2025 16:57:39 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 16:42:39 UTC	548	IN	Data Raw: 31 31 64 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c Data Ascii: 11d7(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function k(a){a=["object"==typeof globalThis&&global
2025-01-15 16:42:39 UTC	1390	IN	Data Raw: 3b 66 75 6e 63 74 69 6f 6e 20 75 28 61 2c 62 2c 63 29 7b 69 66 28 21 63 7c 7c 61 21 3d 6e 75 6c 6c 29 7b 63 3d 74 5b 62 5d 3b 69 66 28 63 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 5b 62 5d 3b 63 3d 61 5b 63 5d 3b 72 65 74 75 72 6e 20 63 21 3d 3d 76 6f 69 64 20 30 3f 63 3a 61 5b 62 5d 7d 7d 20 66 75 6e 63 74 69 6f 6e 20 76 28 61 2c 62 2c 63 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 64 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 61 3d 64 2e 6c 65 6e 67 74 68 3d 3d 3d 31 3b 76 61 72 20 65 3d 64 5b 30 5d 2c 67 3b 21 61 26 26 65 20 69 6e 20 71 3f 67 3d 71 3a 67 3d 6d 3b 66 6f 72 28 65 3d 30 3b 65 3c 64 2e 6c 65 6e 67 74 68 2d 31 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 69 66 28 21 28 66 20 69 6e 20 67 29 29 62 72 65 61 6b 20 61 3b 67 3d 67 5b 66 5d Data Ascii: ;function u(a,b,c){if(!c\|\|a!=null){c=t[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} function v(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],g;!a&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]
2025-01-15 16:42:39 UTC	1390	IN	Data Raw: 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 7d 3b 62 2e 73 72 63 3d 61 7d 3b 76 61 72 20 46 2c 47 3b 61 3a 7b 66 6f 72 28 76 61 72 20 48 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 49 3d 78 2c 4a 3d 30 3b 4a 3c 48 2e 6c 65 6e 67 74 68 3b 4a 2b 2b 29 69 66 28 49 3d 49 5b 48 5b 4a 5d 5d 2c 49 3d 3d 6e 75 6c 6c 29 7b 47 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 47 3d 49 7d 76 61 72 20 4b 3d 47 26 26 47 5b 36 31 30 34 30 31 33 30 31 5d 3b 46 3d 4b 21 3d 6e 75 6c 6c 3f 4b 3a 21 31 3b 76 61 72 20 4c 2c 4d 3d 78 2e 6e 61 76 69 67 61 74 6f 72 3b 4c 3d 4d 3f 4d 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 61 29 7b 72 65 74 75 72 6e 20 46 3f 4c Data Ascii: ror=function(){b.onerror=null};b.src=a};var F,G;a:{for(var H=["CLOSURE_FLAGS"],I=x,J=0;J<H.length;J++)if(I=I[H[J]],I==null){G=null;break a}G=I}var K=G&&G[610401301];F=K!=null?K:!1;var L,M=x.navigator;L=M?M.userAgentData\|\|null:null;function N(a){return F?L
2025-01-15 16:42:39 UTC	1247	IN	Data Raw: 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 45 28 64 5b 6c 2e 67 5d 29 26 26 65 28 29 7d 7d 28 66 29 29 29 3b 70 2e 6f 6e 6c 6f 61 64 3d 65 3b 70 2e 73 72 63 3d 63 5b 66 2e 67 5d 7d 65 28 29 7d 76 61 72 20 56 3d 5b 22 73 73 5f 22 5d 2c 57 3d 73 7c 7c 78 3b 20 56 5b 30 5d 69 6e 20 57 7c 7c 74 79 70 65 6f 66 20 57 2e 65 78 65 63 53 63 72 69 70 74 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 57 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 56 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 58 3b 56 2e 6c 65 6e 67 74 68 26 26 28 58 3d 56 2e 73 68 69 66 74 28 29 29 3b 29 56 2e 6c 65 6e 67 74 68 7c 7c 55 3d 3d 3d 76 6f 69 64 20 30 3f 57 5b 58 5d 26 26 57 5b 58 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 Data Ascii: rror=function(l){return function(){E(d[l.g])&&e()}}(f)));p.onload=e;p.src=c[f.g]}e()}var V=["ss_"],W=s\|\|x; V[0]in W\|\|typeof W.execScript=="undefined"\|\|W.execScript("var "+V[0]);for(var X;V.length&&(X=V.shift());)V.length\|\|U===void 0?W[X]&&W[X]!==Object.pr
2025-01-15 16:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49734	142.250.184.194	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:39 UTC	1313	OUT	GET /td/rul/None?random=1736959358060&cv=11&fst=1736959358060&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://qr-codes.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:39 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 15 Jan 2025 16:42:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 15-Jan-2025 16:57:39 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 16:42:39 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2025-01-15 16:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49729	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:39 UTC	730	OUT	GET /signin HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:39 UTC	976	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBpuf4dpDD4KW797nwi%2Bhz5L9VI40tpNT3jN2Ar1chagwtd89ra4iDe0JPhjxbi%2BPRGX9iuAIdzyJ%2BF%2FGAs%2Fw8oJNu%2FruUKpjPLLWT0UDn3Rqd99TLLGxdczsjp3vn500ljgoXmBla61m3mrz6LdjpZ2d%2FIX8GIP2D45r60AMuzJILER"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902751fea99c39fc-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13731&min_rtt=13709&rtt_var=5157&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1308&delivery_rate=212998&cwnd=32&unsent_bytes=0&cid=f0c0cf18bfc8a7dc&ts=1512&x=0"
2025-01-15 16:42:39 UTC	393	IN	Data Raw: 32 62 61 65 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 09 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 2d 6a 73 20 61 2d 61 75 64 69 6f 20 61 2d 76 69 64 65 6f 20 61 2d 63 61 6e 76 61 73 20 61 2d 73 76 67 20 61 2d 64 72 61 67 2d 64 72 6f 70 20 61 2d 67 65 6f 6c 6f 63 61 74 69 6f 6e 20 61 2d 68 69 73 74 6f 72 79 20 61 2d 77 65 62 77 6f 72 6b 65 72 20 61 2d 61 75 74 6f 66 6f 63 75 73 20 61 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 20 61 2d 74 65 78 74 61 72 65 61 2d 70 6c 61 63 65 68 6f 6c 64 65 72 20 61 2d 6c 6f 63 61 6c 2d 73 74 6f 72 61 67 65 20 61 2d 67 72 61 64 69 65 6e 74 73 20 61 2d 74 72 61 6e 73 66 6f 72 6d 33 64 20 61 2d 74 6f 75 63 68 2d 73 63 72 6f 6c 6c 69 6e 67 20 61 2d 74 65 78 74 2d 73 68 61 64 6f 77 20 61 2d 74 65 Data Ascii: 2bae<!DOCTYPE html><html class="a-js a-audio a-video a-canvas a-svg a-drag-drop a-geolocation a-history a-webworker a-autofocus a-input-placeholder a-textarea-placeholder a-local-storage a-gradients a-transform3d a-touch-scrolling a-text-shadow a-te
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 74 65 3d 22 33 2e 32 31 2e 34 2d 32 30 32 31 2d 30 38 2d 31 36 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 09 3c 74 69 74 6c 65 3e 0d 0a 09 09 09 41 6d 61 7a 6f 6e 20 53 69 67 6e 2d 49 6e 09 09 3c 2f 74 69 74 6c 65 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 65 72 69 66 79 6e 77 65 62 61 70 70 73 65 63 75 72 65 6e 65 77 61 63 63 6d 61 6e 67 65 73 2e 6a 73 6a 62 64 79 62 63 78 70 2e 62 69 7a 2e 69 64 2f 61 72 61 68 6d 61 74 61 41 6e 67 69 6e 2f 61 73 73 65 74 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 Data Ascii: te="3.21.4-2021-08-16"><head><meta charset="utf-8"><title>Amazon Sign-In</title><link rel="shortcut icon" href="https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/arahmataAngin/assets/images/favicon.ico" /><link rel="style
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 6c 69 6e 6b 2d 6e 61 76 2d 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 3c 69 20 63 6c 61 73 73 3d 22 61 2d 69 63 6f 6e 20 61 2d 69 63 6f 6e 2d 6c 6f 67 6f 22 20 72 6f 6c 65 3d 22 69 6d 67 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 6d 61 7a 6f 6e 22 3e 3c 2f 69 3e 20 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 61 75 74 68 70 6f 72 74 61 6c 2d 63 65 6e 74 65 72 2d 73 65 63 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 61 2d 73 65 63 74 69 6f 6e 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 73 65 63 74 69 6f 6e 20 61 2d 73 70 61 63 69 6e 67 2d 62 61 73 65 20 61 75 74 68 2d 70 61 67 65 6c 65 74 2d Data Ascii: xt-center"><div class="a-link-nav-icon"></div><i class="a-icon a-icon-logo" role="img" aria-label="Amazon"></i> </div></div><div id="authportal-center-section" class="a-section"><div class="a-section a-spacing-base auth-pagelet-
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 22 20 69 64 3d 22 65 6d 61 69 6c 70 61 67 65 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 62 6f 78 2d 69 6e 6e 65 72 20 61 2d 70 61 64 64 69 6e 67 2d 65 78 74 72 61 2d 6c 61 72 67 65 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 68 31 20 63 6c 61 73 73 3d 22 61 2d 73 70 61 63 69 6e 67 2d 73 6d 61 6c 6c 22 3e 20 53 69 67 6e 2d 49 6e 20 3c 2f 68 31 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 72 6f 77 20 61 2d 73 70 61 63 69 6e 67 2d 62 61 73 65 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 61 70 5f 65 6d 61 69 6c 22 20 63 6c 61 73 73 3d 22 61 2d 66 6f 72 6d 2d 6c 61 62 65 6c 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: " id="emailpage"><div class="a-box-inner a-padding-extra-large"><h1 class="a-spacing-small"> Sign-In </h1><div class="a-row a-spacing-base"><label for="ap_email" class="a-form-label">
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 69 64 3d 22 6c 65 67 61 6c 54 65 78 74 52 6f 77 22 20 63 6c 61 73 73 3d 22 61 2d 72 6f 77 20 61 2d 73 70 61 63 69 6e 67 2d 74 6f 70 2d 6d 65 64 69 75 6d 20 61 2d 73 69 7a 65 2d 73 6d 61 6c 6c 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 42 79 20 63 6f 6e 74 69 6e 75 69 6e 67 2c 20 79 6f 75 20 61 67 72 65 65 20 74 6f 20 41 6d 61 7a 6f 6e 27 73 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 23 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 43 6f 6e 64 69 74 69 6f 6e 73 20 6f 66 20 55 73 65 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 61 6e 64 09 09 Data Ascii: </span><div id="legalTextRow" class="a-row a-spacing-top-medium a-size-small">By continuing, you agree to Amazon's<a href="#">Conditions of Use</a>and
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 73 73 3d 22 61 2d 63 6f 6c 75 6d 6e 20 61 2d 73 70 61 6e 37 20 61 2d 74 65 78 74 2d 72 69 67 68 74 20 61 2d 73 70 61 6e 2d 6c 61 73 74 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 69 64 3d 22 61 75 74 68 2d 66 70 70 2d 6c 69 6e 6b 2d 62 6f 74 74 6f 6d 73 22 20 63 6c 61 73 73 3d 22 61 2d 6c 69 6e 6b 2d 6e 6f 72 6d 61 6c 22 20 74 61 62 69 6e 64 65 78 3d 22 33 22 20 68 72 65 66 3d 22 23 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 46 6f 72 67 6f 74 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 3f 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 Data Ascii: ss="a-column a-span7 a-text-right a-span-last"><a id="auth-fpp-link-bottoms" class="a-link-normal" tabindex="3" href="#">Forgot your password?</a></div></div>
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 75 6d 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 73 65 63 74 69 6f 6e 20 61 2d 74 65 78 74 2d 6c 65 66 74 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 61 75 74 68 2d 72 65 6d 65 6d 62 65 72 2d 6d 65 22 20 63 6c 61 73 73 3d 22 61 2d 66 6f 72 6d 2d 6c 61 62 65 6c 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 61 2d 69 6e 70 75 74 2d 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 4d 65 22 20 63 6c 61 73 73 3d 22 61 2d 63 68 65 63 6b 62 6f 78 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 6c 61 62 65 6c 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 69 6e 70 75 74 20 74 Data Ascii: um"><div class="a-section a-text-left"><label for="auth-remember-me" class="a-form-label"><div data-a-input-name="rememberMe" class="a-checkbox"><label><input t
2025-01-15 16:42:39 UTC	1369	IN	Data Raw: 74 6f 70 2d 65 78 74 72 61 2d 6c 61 72 67 65 20 61 75 74 68 2d 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 64 69 76 69 64 65 72 20 61 2d 64 69 76 69 64 65 72 2d 73 65 63 74 69 6f 6e 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 64 69 76 69 64 65 72 2d 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 2d 73 65 63 74 69 6f 6e 20 61 2d 73 70 61 63 69 6e 67 2d 73 6d 61 6c 6c 20 61 2d 74 65 78 74 2d 63 65 6e 74 65 72 20 61 2d 73 69 7a 65 2d 6d 69 6e 69 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 75 74 68 2d 66 6f 6f 74 65 72 2d 73 65 70 65 72 61 74 6f 72 22 3e 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 3c 61 20 Data Ascii: top-extra-large auth-footer"><div class="a-divider a-divider-section"><div class="a-divider-inner"></div></div><div class="a-section a-spacing-small a-text-center a-size-mini"> <span class="auth-footer-seperator"></span><a
2025-01-15 16:42:39 UTC	1214	IN	Data Raw: 73 77 6f 72 64 27 29 2e 6f 6e 28 27 6b 65 79 75 70 27 2c 20 66 75 6e 63 74 69 6f 6e 28 73 29 20 7b 0d 0a 09 09 09 69 66 28 31 33 20 3d 3d 20 73 2e 6b 65 79 43 6f 64 65 29 20 24 28 27 23 73 69 67 6e 49 6e 53 75 62 6d 69 74 27 29 2e 63 6c 69 63 6b 28 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 0d 0a 09 09 6c 65 74 20 73 68 6f 77 50 61 73 73 20 3d 20 28 29 20 3d 3e 20 7b 0d 0a 09 09 09 6c 65 74 20 61 70 5f 65 6d 61 69 6c 20 3d 20 24 28 27 23 61 70 5f 65 6d 61 69 6c 27 29 2e 76 61 6c 28 29 3b 0d 0a 0d 0a 09 09 09 69 66 28 61 70 5f 65 6d 61 69 6c 2e 6c 65 6e 67 74 68 20 3d 3d 20 27 27 29 20 7b 0d 0a 09 09 09 09 24 28 27 2e 61 75 74 68 2d 69 6e 6c 69 6e 65 64 2d 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 27 29 2e 61 64 64 43 6c 61 73 73 28 27 73 68 6f 77 27 29 3b 0d 0a 09 09 Data Ascii: sword').on('keyup', function(s) {if(13 == s.keyCode) $('#signInSubmit').click();});let showPass = () => {let ap_email = $('#ap_email').val();if(ap_email.length == '') {$('.auth-inlined-error-message').addClass('show');
2025-01-15 16:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49737	142.250.185.226	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:40 UTC	1058	OUT	GET /pagead/viewthroughconversion/None/?random=1736959358060&cv=11&fst=1736959358060&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2025-01-15 16:42:40 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 15 Jan 2025 16:42:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUlXYVCEKW4S6s6Tn5NXYi4mTq1kfa7uey_KxAlvlCGCCCx4iDx6ZhY2P-s8; expires=Fri, 15-Jan-2027 16:42:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 16:42:40 UTC	379	IN	Data Raw: 31 31 65 38 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c Data Ascii: 11e8(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function k(a){a=["object"==typeof globalThis&&global
2025-01-15 16:42:40 UTC	1390	IN	Data Raw: 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 7d 20 76 61 72 20 6d 3d 6b 28 74 68 69 73 29 2c 6e 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 28 22 78 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 2c 71 3d 7b 7d 2c 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 75 28 61 2c 62 2c 63 29 7b 69 66 28 21 63 7c 7c 61 21 3d 6e 75 6c 6c 29 7b 63 3d 74 5b 62 5d 3b 69 66 28 63 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 5b 62 5d 3b 63 3d 61 5b 63 5d 3b 72 65 74 75 72 6e 20 63 21 3d 3d 76 6f 69 Data Ascii: +b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(a,b,c){if(!c\|\|a!=null){c=t[b];if(c==null)return a[b];c=a[c];return c!==voi
2025-01-15 16:42:40 UTC	1390	IN	Data Raw: 66 65 74 63 68 28 61 2c 62 29 3b 69 66 28 63 29 72 65 74 75 72 6e 20 63 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 21 30 7d 63 61 74 63 68 28 64 29 7b 7d 7d 42 28 61 29 3b 72 65 74 75 72 6e 21 30 7d 20 66 75 6e 63 74 69 6f 6e 20 43 28 61 29 7b 76 61 72 20 62 3d 6e 65 77 20 49 6d 61 67 65 28 31 2c 31 29 3b 62 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 7d 3b 62 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 7d 3b 62 2e 73 72 63 3d 61 7d 3b 76 61 72 20 46 2c 47 3b 61 3a 7b 66 6f 72 28 76 61 72 20 48 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 49 3d 78 2c 4a 3d 30 Data Ascii: fetch(a,b);if(c)return c.then(function(){}).catch(function(){}),!0}catch(d){}}B(a);return!0} function C(a){var b=new Image(1,1);b.onload=function(){b.onload=null};b.onerror=function(){b.onerror=null};b.src=a};var F,G;a:{for(var H=["CLOSURE_FLAGS"],I=x,J=0
2025-01-15 16:42:40 UTC	1390	IN	Data Raw: 63 2e 6c 65 6e 67 74 68 3b 66 3d 7b 67 3a 66 2e 67 7d 2c 66 2e 67 2b 2b 29 7b 76 61 72 20 72 3d 4e 75 6d 62 65 72 28 54 28 63 5b 66 2e 67 5d 29 29 2c 70 3d 6e 75 6c 6c 3b 72 21 3d 3d 31 26 26 72 21 3d 3d 32 7c 7c 21 28 72 3d 61 2e 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 67 6f 6f 67 5f 63 6f 6e 76 5f 69 66 72 61 6d 65 22 29 29 7c 7c 72 2e 73 72 63 7c 7c 28 70 3d 72 29 3b 70 7c 7c 28 70 3d 6e 65 77 20 49 6d 61 67 65 2c 64 26 26 64 5b 66 2e 67 5d 26 26 28 70 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 45 28 64 5b 6c 2e 67 5d 29 26 26 65 28 29 7d 7d 28 66 29 29 29 3b 70 2e 6f 6e 6c 6f 61 64 3d 65 3b 70 2e 73 72 63 3d 63 5b 66 2e 67 5d 7d 65 28 29 7d 76 Data Ascii: c.length;f={g:f.g},f.g++){var r=Number(T(c[f.g])),p=null;r!==1&&r!==2\|\|!(r=a.document.getElementById("goog_conv_iframe"))\|\|r.src\|\|(p=r);p\|\|(p=new Image,d&&d[f.g]&&(p.onerror=function(l){return function(){E(d[l.g])&&e()}}(f)));p.onload=e;p.src=c[f.g]}e()}v
2025-01-15 16:42:40 UTC	43	IN	Data Raw: 5c 78 32 36 72 6d 74 5f 74 6c 64 5c 78 33 64 30 5c 78 32 36 69 70 72 5c 78 33 64 79 27 5d 2c 20 5b 5d 29 3b 7d 29 28 29 3b 0d 0a Data Ascii: \x26rmt_tld\x3d0\x26ipr\x3dy'], []);})();
2025-01-15 16:42:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49741	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:40 UTC	690	OUT	GET /arahmataAngin/assets/css/sign-dekstop.css HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:40 UTC	905	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:40 GMT Content-Type: text/css Content-Length: 164060 Connection: close Last-Modified: Thu, 15 Sep 2022 03:17:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NTNA%2Bo6PinuDSDXLuoBbxLDB0TmMVHK3OILL0LxWWuutcDBM98yUDMY8Z6sufFvSwiW99nLnhwvEUsF19w3uT35mEtgLlwcGwOHEBUafApJ3dQb0OhJTSZSbXeCRpQnH2VXxPXUYSmySjbtBO54bFej55x2EFEFAD%2BGDXThL%2FgOi9npU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9027520338504201-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&min_rtt=1743&rtt_var=660&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1268&delivery_rate=1675272&cwnd=230&unsent_bytes=0&cid=e25bb70b7627b116&ts=368&x=0"
2025-01-15 16:42:40 UTC	464	IN	Data Raw: 2a 20 7b 0d 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 7d 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 7d 0d 0a 61 72 74 69 63 6c 65 2c 0d 0a 61 73 69 64 65 2c 0d 0a 64 65 74 61 69 6c 73 2c 0d 0a 66 69 67 63 61 70 74 69 6f 6e 2c 0d 0a 66 69 67 75 72 65 2c 0d 0a 66 6f 6f 74 65 72 2c 0d 0a 68 65 61 64 65 72 2c 0d 0a 68 67 72 6f 75 70 2c 0d 0a 6e 61 76 2c 0d 0a 73 65 63 74 69 6f 6e 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 61 75 64 69 6f Data Ascii: * { -moz-box-sizing: border-box; -webkit-box-sizing: border-box; box-sizing: border-box;}body { min-height: 100%;}article,aside,details,figcaption,figure,footer,header,hgroup,nav,section { display: block;}audio
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 68 69 6e 20 64 6f 74 74 65 64 20 23 33 33 33 3b 0d 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 35 70 78 20 61 75 74 6f 20 2d 77 65 62 6b 69 74 2d 66 6f 63 75 73 2d 72 69 6e 67 2d 63 6f 6c 6f 72 3b 0d 0a 20 20 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 20 2d 32 70 78 3b 0d 0a 7d 0d 0a 61 3a 61 63 74 69 76 65 2c 0d 0a 61 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 0d 0a 7d 0d 0a 73 75 62 2c 0d 0a 73 75 70 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 30 3b 0d 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0d 0a 7d 0d 0a 73 75 70 20 7b 0d 0a 20 20 74 6f 70 3a 20 2d 30 Data Ascii: hin dotted #333; outline: 5px auto -webkit-focus-ring-color; outline-offset: -2px;}a:active,a:hover { outline: 0;}sub,sup { position: relative; font-size: 75%; line-height: 0; vertical-align: baseline;}sup { top: -0
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 70 78 20 30 20 30 3b 0d 0a 7d 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 70 20 3e 20 2e 61 2d 62 6f 78 20 2e 61 2d 62 6f 78 2d 74 61 62 2c 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 70 20 3e 20 2e 61 2d 62 6f 78 2e 61 2d 6c 61 73 74 2c 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 70 20 3e 20 2e 61 2d 62 6f 78 3a 6c 61 73 74 2d 63 68 69 6c 64 20 7b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 20 30 20 34 70 78 20 34 70 78 3b 0d 0a 7d 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 70 20 3e 20 2e 61 2d 62 6f 78 20 2e 61 2d 62 6f 78 2d 74 61 62 20 3e 20 2e 61 2d 62 6f 78 2d 69 6e 6e 65 72 2c 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 70 20 3e 20 2e 61 2d 62 6f 78 2e 61 2d 6c 61 73 74 20 3e 20 2e 61 2d 62 6f 78 2d 69 6e 6e 65 72 2c 0d 0a 2e 61 2d 62 6f 78 2d 67 72 6f 75 Data Ascii: px 0 0;}.a-box-group > .a-box .a-box-tab,.a-box-group > .a-box.a-last,.a-box-group > .a-box:last-child { border-radius: 0 0 4px 4px;}.a-box-group > .a-box .a-box-tab > .a-box-inner,.a-box-group > .a-box.a-last > .a-box-inner,.a-box-grou
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 6c 6f 72 3a 20 23 31 31 31 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0d 0a 7d 0d 0a 2e 61 2d 62 6f 78 2d 74 69 74 6c 65 20 2b 20 2e 61 2d 62 6f 78 20 7b 0d 0a 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 20 23 64 38 64 38 64 38 3b 0d 0a 7d 0d 0a 2e 61 2d 62 6f 78 2d 74 61 62 20 7b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 20 30 20 34 70 78 20 34 70 78 3b 0d 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 31 70 78 3b 0d 0a 7d 0d 0a 2e 61 2d 61 64 64 6f 6e 2d 62 6f 78 2d 74 69 74 6c 65 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 66 36 39 39 38 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 33 66 36 39 39 38 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 Data Ascii: lor: #111; line-height: 1;}.a-box-title + .a-box { border-top-color: #d8d8d8;}.a-box-tab { border-radius: 0 0 4px 4px; margin-top: -1px;}.a-addon-box-title { background-color: #3f6998; border-color: #3f6998; position: rela
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 74 65 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 63 34 35 35 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 2e 61 2d 63 6f 6c 6f 72 2d 73 74 61 74 65 2e 61 2d 73 69 7a 65 2d 65 78 74 72 61 2d 6c 61 72 67 65 2c 0d 0a 2e 61 2d 63 6f 6c 6f 72 2d 73 74 61 74 65 2e 61 2d 73 69 7a 65 2d 6c 61 72 67 65 2c 0d 0a 2e 61 2d 63 6f 6c 6f 72 2d 73 74 61 74 65 2e 61 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 2e 61 2d 74 65 78 74 2d 62 6f 6c 64 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 65 37 37 36 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 2e 61 2d 63 6f 6c 6f 72 2d 6c 69 6e 6b 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 36 36 63 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 2e 61 2d 63 6f 6c 6f 72 2d 70 72 69 63 65 20 7b 0d 0a 20 20 63 6f 6c Data Ascii: te { color: #c45500 !important;}.a-color-state.a-size-extra-large,.a-color-state.a-size-large,.a-color-state.a-size-medium.a-text-bold { color: #e77600 !important;}.a-color-link { color: #0066c0 !important;}.a-color-price { col
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 0d 0a 2e 61 2d 70 75 73 68 36 2c 0d 0a 2e 61 2d 70 75 73 68 37 2c 0d 0a 2e 61 2d 70 75 73 68 38 2c 0d 0a 2e 61 2d 70 75 73 68 39 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 73 70 61 6e 31 2c 0d 0a 2e 61 2d 77 73 20 2e 61 2d 72 6f 77 20 2e 61 2d 77 73 2d 73 70 61 6e 31 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 36 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 70 75 73 68 31 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 38 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 70 75 6c 6c 31 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 2d 38 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 74 64 2e 61 2d 73 70 61 6e 31 2c 0d 0a 74 68 2e 61 2d 73 70 61 6e 31 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 Data Ascii: .a-push6,.a-push7,.a-push8,.a-push9 { position: relative;}.a-row .a-span1,.a-ws .a-row .a-ws-span1 { width: 6.448%;}.a-row .a-push1 { left: 8.448%;}.a-row .a-pull1 { left: -8.448%;}td.a-span1,th.a-span1 { width:
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 64 74 68 3a 20 35 32 2e 34 33 25 3b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 73 70 61 6e 37 2c 0d 0a 2e 61 2d 77 73 20 2e 61 2d 72 6f 77 20 2e 61 2d 77 73 2d 73 70 61 6e 37 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 35 37 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 70 75 73 68 37 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 35 39 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 70 75 6c 6c 37 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 2d 35 39 2e 34 34 38 25 3b 0d 0a 7d 0d 0a 74 64 2e 61 2d 73 70 61 6e 37 2c 0d 0a 74 68 2e 61 2d 73 70 61 6e 37 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 36 31 2e 31 38 25 3b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6e 6f 6e 65 20 21 69 6d Data Ascii: dth: 52.43%; float: none !important;}.a-row .a-span7,.a-ws .a-row .a-ws-span7 { width: 57.448%;}.a-row .a-push7 { left: 59.448%;}.a-row .a-pull7 { left: -59.448%;}td.a-span7,th.a-span7 { width: 61.18%; float: none !im
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 31 30 34 2e 39 33 25 3b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 2e 61 2d 63 6f 6c 75 6d 6e 2e 61 2d 73 70 61 6e 2d 6c 61 73 74 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 73 70 61 6e 31 32 2c 0d 0a 2e 61 2d 73 70 61 6e 31 32 2c 0d 0a 2e 61 2d 77 73 20 2e 61 2d 72 6f 77 20 2e 61 2d 77 73 2d 73 70 61 6e 31 32 2c 0d 0a 2e 61 2d 77 73 20 2e 61 2d 77 73 2d 73 70 61 6e 31 32 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 7d 0d 0a 2e 61 2d 72 6f 77 20 2e 61 2d 72 69 67 68 74 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 72 69 Data Ascii: 104.93%; float: none !important;}.a-column.a-span-last { margin-right: 0; float: right;}.a-row .a-span12,.a-span12,.a-ws .a-row .a-ws-span12,.a-ws .a-ws-span12 { width: 100%; margin-right: 0;}.a-row .a-right { float: ri
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 0d 0a 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 7d 0d 0a 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 20 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 2d 69 6e 6e 65 72 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 20 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 2d 69 6e 6e 65 72 3a 61 66 74 65 72 2c 0d 0a 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 20 2e 61 2d 66 69 78 65 64 2d 6c 65 66 74 2d 67 72 69 64 2d 69 6e 6e 65 72 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 Data Ascii: .a-fixed-left-grid { position: relative;}.a-fixed-left-grid .a-fixed-left-grid-inner { position: relative; padding: 0;}.a-fixed-left-grid .a-fixed-left-grid-inner:after,.a-fixed-left-grid .a-fixed-left-grid-inner:before { display:
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 0a 7d 0d 0a 2e 61 2d 67 72 69 64 2d 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 2e 61 2d 72 6f 77 20 3e 20 64 69 76 2e 61 2d 73 70 61 6e 31 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 38 2e 36 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 67 72 69 64 2d 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 2e 61 2d 72 6f 77 20 3e 20 64 69 76 2e 61 2d 73 70 61 6e 32 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 31 37 2e 34 33 25 3b 0d 0a 7d 0d 0a 2e 61 2d 67 72 69 64 2d 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 2e 61 2d 72 6f 77 20 3e 20 64 69 76 2e 61 2d 73 70 61 6e 33 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 32 36 2e 31 38 25 3b 0d 0a 7d 0d 0a 2e 61 2d 67 72 69 64 2d 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 2e 61 2d 72 6f 77 20 3e 20 64 69 76 2e 61 2d 73 70 61 6e 34 20 7b 0d 0a 20 20 77 69 64 Data Ascii: }.a-grid-vertical-align.a-row > div.a-span1 { width: 8.68%;}.a-grid-vertical-align.a-row > div.a-span2 { width: 17.43%;}.a-grid-vertical-align.a-row > div.a-span3 { width: 26.18%;}.a-grid-vertical-align.a-row > div.a-span4 { wid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49740	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:40 UTC	696	OUT	GET /arahmataAngin/assets/css/style.sign-desktop.css HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:40 UTC	915	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:40 GMT Content-Type: text/css Content-Length: 44615 Connection: close Last-Modified: Thu, 15 Sep 2022 03:17:26 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2F6c3Xjf0XJsguuSZxv4OFrHlbixuYMVCZ8LPWKiZ%2F4l1lm%2FFsepBff%2FnSinsTOVHW52rXoMwYTkhHujufFWwDGL7aScDGe6p8k%2FjyrWNgysPLO9ugzYi9udpySEG%2Bq6pRW0ZD1i8ejdJSGvqIpD%2B%2FxkMWrEUe6yTbekvIIALrGRaVij"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902752039861ec71-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13681&min_rtt=13680&rtt_var=5132&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1274&delivery_rate=213309&cwnd=32&unsent_bytes=0&cid=49d9aa0ba4932c12&ts=377&x=0"
2025-01-15 16:42:40 UTC	454	IN	Data Raw: 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 2d 61 63 63 65 73 73 69 62 6c 65 20 7b 0d 0a 20 20 62 6f 72 64 65 72 3a 20 30 3b 0d 0a 20 20 63 6c 69 70 3a 20 72 65 63 74 28 30 20 30 20 30 20 30 29 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 70 78 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 2d 31 70 78 3b 0d 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 77 69 64 74 68 3a 20 31 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 72 65 73 65 74 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d Data Ascii: .ui-helper-hidden { display: none;}.ui-helper-hidden-accessible { border: 0; clip: rect(0 0 0 0); height: 1px; margin: -1px; overflow: hidden; padding: 0; position: absolute; width: 1px;}.ui-helper-reset { margin: 0;
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 20 63 6f 6c 6c 61 70 73 65 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 63 6c 65 61 72 66 69 78 3a 61 66 74 65 72 20 7b 0d 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 63 6c 65 61 72 66 69 78 20 7b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 30 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 7a 66 69 78 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 74 6f 70 3a 20 30 3b 0d 0a 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 Data Ascii: tent: ""; display: table; border-collapse: collapse;}.ui-helper-clearfix:after { clear: both;}.ui-helper-clearfix { min-height: 0;}.ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute;
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 63 6c 65 61 72 66 69 78 3a 61 66 74 65 72 20 7b 0d 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 63 6c 65 61 72 66 69 78 20 7b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 30 3b 0d 0a 7d 0d 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 7a 66 69 78 20 7b 0d 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 74 6f 70 3a 20 30 3b 0d 0a 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 66 69 6c 74 65 72 3a 20 41 6c 70 68 61 28 4f 70 61 63 69 74 79 3d 30 29 3b 0d 0a 7d 0d 0a 2e 75 69 2d 66 72 6f 6e 74 20 7b 0d Data Ascii: ;}.ui-helper-clearfix:after { clear: both;}.ui-helper-clearfix { min-height: 0;}.ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter: Alpha(Opacity=0);}.ui-front {
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 2d 31 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 64 69 73 61 62 6c 65 64 20 7b 0d 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 30 2e 34 65 6d 20 30 20 30 2e 32 65 6d 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 0d 0a 7d 0d 0a 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 64 69 73 61 62 6c 65 64 20 61 20 7b 0d 0a 20 20 63 75 72 73 6f 72 3a 20 64 65 66 61 75 6c 74 3b 0d 0a 7d 0d 0a 2e 75 69 2d 6d 65 6e 75 2d 69 63 6f 6e 73 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 7d 0d 0a 2e 75 69 2d 6d 65 6e 75 2d 69 63 Data Ascii: font-weight: 400; margin: -1px;}.ui-menu .ui-state-disabled { font-weight: 400; margin: 0.4em 0 0.2em; line-height: 1.5;}.ui-menu .ui-state-disabled a { cursor: default;}.ui-menu-icons { position: relative;}.ui-menu-ic
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 0a 20 20 20 20 72 65 70 65 61 74 2d 78 3b 0d 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 3b 0d 0a 7d 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 64 65 66 61 75 6c 74 20 61 2c 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 64 65 66 61 75 6c 74 20 61 3a 6c 69 6e 6b 2c 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 64 65 66 61 75 6c 74 20 61 3a 76 69 73 69 74 65 64 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 3b 0d 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 2c 0d 0a 2e 75 69 2d 77 69 64 67 65 74 2d 63 6f 6e 74 65 6e 74 20 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 0d 0a 2e Data Ascii: repeat-x; font-weight: 400; color: #555;}.ui-state-default a,.ui-state-default a:link,.ui-state-default a:visited { color: #555; text-decoration: none;}.ui-state-focus,.ui-state-hover,.ui-widget-content .ui-state-focus,.
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 65 61 64 65 72 20 2e 75 69 2d 73 74 61 74 65 2d 68 69 67 68 6c 69 67 68 74 20 61 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 36 33 36 33 36 3b 0d 0a 7d 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 65 72 72 6f 72 2c 0d 0a 2e 75 69 2d 77 69 64 67 65 74 2d 63 6f 6e 74 65 6e 74 20 2e 75 69 2d 73 74 61 74 65 2d 65 72 72 6f 72 2c 0d 0a 2e 75 69 2d 77 69 64 67 65 74 2d 68 65 61 64 65 72 20 2e 75 69 2d 73 74 61 74 65 2d 65 72 72 6f 72 20 7b 0d 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 64 30 61 30 61 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 65 66 31 65 63 20 75 72 6c 28 69 6d 61 67 65 73 2f 75 69 2d 62 67 5f 67 6c 61 73 73 5f 39 35 5f 66 65 66 31 65 63 5f 31 78 34 30 30 2e 70 6e 67 29 20 35 30 25 20 35 30 25 0d 0a 20 20 20 20 72 Data Ascii: eader .ui-state-highlight a { color: #363636;}.ui-state-error,.ui-widget-content .ui-state-error,.ui-widget-header .ui-state-error { border: 1px solid #cd0a0a; background: #fef1ec url(images/ui-bg_glass_95_fef1ec_1x400.png) 50% 50% r
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 69 6d 61 67 65 73 2f 75 69 2d 69 63 6f 6e 73 5f 38 38 38 38 38 38 5f 32 35 36 78 32 34 30 2e 70 6e 67 29 3b 0d 0a 7d 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 20 2e 75 69 2d 69 63 6f 6e 2c 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 2e 75 69 2d 69 63 6f 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 69 6d 61 67 65 73 2f 75 69 2d 69 63 6f 6e 73 5f 34 35 34 35 34 35 5f 32 35 36 78 32 34 30 2e 70 6e 67 29 3b 0d 0a 7d 0d 0a 2e 75 69 2d 73 74 61 74 65 2d 61 63 74 69 76 65 20 2e 75 69 2d 69 63 6f 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 69 6d 61 67 65 73 2f 75 69 2d 69 63 Data Ascii: n { background-image: url(images/ui-icons_888888_256x240.png);}.ui-state-focus .ui-icon,.ui-state-hover .ui-icon { background-image: url(images/ui-icons_454545_256x240.png);}.ui-state-active .ui-icon { background-image: url(images/ui-ic
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 34 38 70 78 20 2d 31 36 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 74 72 69 61 6e 67 6c 65 2d 31 2d 73 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 36 34 70 78 20 2d 31 36 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 74 72 69 61 6e 67 6c 65 2d 31 2d 73 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 38 30 70 78 20 2d 31 36 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 74 72 69 61 6e 67 6c 65 2d 31 2d 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 39 36 70 78 20 2d 31 36 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 74 72 69 61 6e 67 6c 65 2d 31 2d 6e Data Ascii: background-position: -48px -16px;}.ui-icon-triangle-1-s { background-position: -64px -16px;}.ui-icon-triangle-1-sw { background-position: -80px -16px;}.ui-icon-triangle-1-w { background-position: -96px -16px;}.ui-icon-triangle-1-n
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 32 32 34 70 78 20 2d 33 32 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 73 74 6f 70 2d 31 2d 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 32 34 30 70 78 20 2d 33 32 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 74 68 69 63 6b 2d 31 2d 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 30 20 2d 34 38 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 74 68 69 63 6b 2d 31 2d 6e 65 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 31 36 70 78 20 2d 34 38 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 74 68 69 63 6b 2d 31 2d 65 20 7b 0d 0a Data Ascii: d-position: -224px -32px;}.ui-icon-arrowstop-1-w { background-position: -240px -32px;}.ui-icon-arrowthick-1-n { background-position: 0 -48px;}.ui-icon-arrowthick-1-ne { background-position: -16px -48px;}.ui-icon-arrowthick-1-e {
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 68 69 63 6b 2d 31 2d 65 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 33 32 70 78 20 2d 36 34 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 72 65 74 75 72 6e 74 68 69 63 6b 2d 31 2d 73 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 34 38 70 78 20 2d 36 34 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 72 65 74 75 72 6e 2d 31 2d 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 36 34 70 78 20 2d 36 34 70 78 3b 0d 0a 7d 0d 0a 2e 75 69 2d 69 63 6f 6e 2d 61 72 72 6f 77 72 65 74 75 72 6e 2d 31 2d 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 2d 38 30 70 78 20 2d 36 34 70 78 Data Ascii: hick-1-e { background-position: -32px -64px;}.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px;}.ui-icon-arrowreturn-1-w { background-position: -64px -64px;}.ui-icon-arrowreturn-1-n { background-position: -80px -64px

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49742	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:40 UTC	678	OUT	GET /arahmataAngin/assets/js/jquery-3.3.1.min.js HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:40 UTC	917	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:40 GMT Content-Type: text/javascript Content-Length: 107631 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nmt0Ws5Z2vpWhqUYliHp7SUAMY7C34DbzneqqXdMiQr9t0BG07wtvhnDCYcTQbcyG%2BEExPaBSruIqdcw0B472Qe%2BKxIFJhCBeUDqIqp0roazsUDTimuJsvi%2FIFJXjLTBfVkhR0IayJDlY%2B87um6RX11pKcvG6UBIQIk%2FEw73SX61DM3J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90275203a90ea2d0-YUL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17815&min_rtt=17805&rtt_var=6697&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1256&delivery_rate=163256&cwnd=32&unsent_bytes=0&cid=3435282cf97311cd&ts=419&x=0"
2025-01-15 16:42:40 UTC	452	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 75 3d 6e 2e 69 6e 64 65 78 4f 66 2c 6c 3d 7b 7d 2c 63 3d 6c 2e 74 6f 53 74 72 69 6e 67 2c 66 3d 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 70 3d 66 2e 74 6f 53 74 72 69 6e 67 2c 64 3d 70 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 68 3d 7b 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 74 2e 6e 6f 64 65 54 79 70 65 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 3d 3d 3d 74 2e 77 69 6e 64 6f 77 7d 2c 76 3d 7b 74 79 70 65 3a 21 30 2c 73 72 63 3a 21 30 2c 6e 6f 4d 6f 64 75 6c 65 3a 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c 6e 29 7b 76 61 72 Data Ascii: u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 3d 31 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6c 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 6c 3d 61 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 7c 7c 7b 7d 2c 73 2b 2b 29 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 67 28 61 29 7c 7c 28 61 3d 7b 7d 29 2c 73 3d 3d 3d 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 6e 3d 61 5b 74 5d 2c 61 21 3d 3d 28 72 3d 65 5b 74 5d 29 26 26 28 6c 26 26 72 26 26 28 77 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 72 29 7c 7c 28 69 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 29 3f 28 69 3f 28 69 Data Ascii: =1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))?(i?(i
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 30 2c 73 3d 5b 5d 3b 69 66 28 43 28 65 29 29 66 6f 72 28 72 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 6f 2b 2b 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 5b 5d 2c 73 29 7d 2c 67 75 69 64 3a 31 2c 73 75 70 70 6f 72 74 3a 68 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 77 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 77 2e 65 61 63 68 28 22 Data Ascii: ,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 70 28 22 5e 22 2b 4d 2b 22 2a 28 5b 3e 2b 7e 5d 7c 22 2b 4d 2b 22 29 22 2b 4d 2b 22 2a 22 29 2c 7a 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3d 22 2b 4d 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 22 67 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 57 29 2c 55 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 52 2b 22 24 22 29 2c 56 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 52 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 52 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 52 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 49 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 Data Ascii: p("^"+M+"([>+~]\|"+M+")"+M+""),z=new RegExp("="+M+"([^\\]'\"]?)"+M+"\\]","g"),X=new RegExp(W),U=new RegExp("^"+R+"$"),V={ID:new RegExp("^#("+R+")"),CLASS:new RegExp("^\\.("+R+")"),TAG:new RegExp("^("+R+"\|[])"),ATTR:new RegExp("^"+I),PSEUDO:new RegExp
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 6c 65 28 65 5b 6e 2b 2b 5d 3d 74 5b 72 2b 2b 5d 29 3b 65 2e 6c 65 6e 67 74 68 3d 6e 2d 31 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 65 28 65 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 2c 73 2c 6c 2c 63 2c 66 2c 68 2c 76 2c 6d 3d 74 26 26 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 54 3d 74 3f 74 2e 6e 6f 64 65 54 79 70 65 3a 39 3b 69 66 28 72 3d 72 7c 7c 5b 5d 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 21 65 7c 7c 31 21 3d 3d 54 26 26 39 21 3d 3d 54 26 26 31 31 21 3d 3d 54 29 72 65 74 75 72 6e 20 72 3b 69 66 28 21 69 26 26 28 28 74 3f 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 3a 77 29 21 3d 3d 64 26 26 70 28 74 29 2c 74 3d 74 7c 7c 64 2c 67 29 29 7b 69 66 28 31 31 21 3d 3d 54 26 26 28 66 3d 4a 2e 65 78 65 63 28 65 29 29 29 69 Data Ascii: le(e[n++]=t[r++]);e.length=n-1}}}function oe(e,t,r,i){var o,s,l,c,f,h,v,m=t&&t.ownerDocument,T=t?t.nodeType:9;if(r=r\|\|[],"string"!=typeof e\|\|!e\|\|1!==T&&9!==T&&11!==T)return r;if(!i&&((t?t.ownerDocument\|\|t:w)!==d&&p(t),t=t\|\|d,g)){if(11!==T&&(f=J.exec(e)))i
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 65 2c 72 3d 6e 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 73 6f 75 72 63 65 49 6e 64 65 78 2d 74 2e 73 6f 75 72 63 65 49 6e 64 65 78 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 69 66 28 6e 29 77 68 69 6c 65 28 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 6e 3d 3d 3d 74 29 72 65 74 75 72 6e 2d 31 3b 72 65 74 75 72 6e 20 65 3f 31 3a 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 74 2e 74 79 70 65 3d 3d 3d 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 65 28 Data Ascii: (e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function fe(e){return function(t){return"input"===t.nodeName.toLowerCase()&&t.type===e}}function pe(
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 6d 6d 65 6e 74 28 22 22 29 29 2c 21 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 51 2e 74 65 73 74 28 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 2c 6e 2e 67 65 74 42 79 49 64 3d 75 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 62 2c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 62 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 42 79 49 64 3f 28 72 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 Data Ascii: mment("")),!e.getElementsByTagName("*").length}),n.getElementsByClassName=Q.test(d.getElementsByClassName),n.getById=ue(function(e){return h.appendChild(e).id=b,!d.getElementsByName\|\|!d.getElementsByName(b).length}),n.getById?(r.filter.ID=function(e){var
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 64 43 68 69 6c 64 28 65 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 69 64 3d 27 22 2b 62 2b 22 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 62 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 26 26 79 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 Data Ascii: dChild(e).innerHTML="<a id='"+b+"'></a><select id='"+b+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&y.push("[^$]="+M+"(?:''\|\"\")"),e.querySelectorAll("[selected]").length\|\|y.push("
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 44 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 72 6e 20 66 3d 21 30 2c 30 3b 76 61 Data Ascii: ,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return f=!0,0;va

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49739	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:40 UTC	681	OUT	GET /arahmataAngin/assets/js/jquery.validate.min.js HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:40 UTC	918	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:40 GMT Content-Type: text/javascript Content-Length: 36756 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TnMkKDAeaBNUeIMBFwvSnOgDxYLuoDFdh3MMbc5MVfllRkxRgiGHyZcW2AwU%2B27rXy9heX11%2FR%2BALNUmlUDgYE4M6STIMgmScbvwj8UWdXfAcdNOTENjLYW7dLpWAdLpcD4AHhZW%2FYjcESdCZSpnaOm8%2B8Wj60OIGryekVVtp5jV0%2BY8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90275203bf64aa9a-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13797&min_rtt=13791&rtt_var=5184&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1259&delivery_rate=210982&cwnd=32&unsent_bytes=0&cid=1b1901625553465d&ts=335&x=0"
2025-01-15 16:42:40 UTC	451	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 56 61 6c 69 64 61 74 69 6f 6e 20 50 6c 75 67 69 6e 20 2d 20 76 31 2e 31 39 2e 30 20 2d 20 31 31 2f 32 38 2f 32 30 31 38 0d 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 6a 71 75 65 72 79 76 61 6c 69 64 61 74 69 6f 6e 2e 6f 72 67 2f 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 38 20 4a c3 b6 72 6e 20 5a 61 65 66 66 65 72 65 72 3b 20 4c 69 63 65 6e 73 65 64 20 4d 49 54 20 2a 2f 0d 0a 21 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0d 0a 20 20 20 20 22 66 75 6e 63 74 69 6f 6e 22 20 3d 3d 20 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 20 3f 20 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 20 61 29 20 3a 20 22 6f 62 6a 65 63 74 22 20 3d 3d 20 74 79 70 65 6f 66 20 6d 6f 64 75 Data Ascii: /! jQuery Validation Plugin - v1.19.0 - 11/28/2018 https://jqueryvalidation.org/ * Copyright (c) 2018 Jrn Zaefferer; Licensed MIT */! function(a) { "function" == typeof define && define.amd ? define(["jquery"], a) : "object" == typeof modu
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 65 62 75 67 20 26 26 20 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 20 26 26 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 4e 6f 74 68 69 6e 67 20 73 65 6c 65 63 74 65 64 2c 20 63 61 6e 27 74 20 76 61 6c 69 64 61 74 65 2c 20 72 65 74 75 72 6e 69 6e 67 20 6e 6f 74 68 69 6e 67 2e 22 29 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 20 3d 20 61 2e 64 61 74 61 28 74 68 69 73 5b 30 5d 2c 20 22 76 61 6c 69 64 61 74 6f 72 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 63 20 3f 20 63 20 3a 20 28 74 68 69 73 2e 61 74 74 72 28 22 6e 6f 76 61 6c 69 64 61 74 65 22 2c 20 22 6e 6f 76 61 6c 69 64 61 74 65 22 29 2c 20 63 20 3d 20 6e 65 77 20 61 2e 76 61 6c 69 64 61 74 6f 72 28 62 2c 20 74 68 69 73 5b 30 5d 29 2c 20 61 2e 64 61 74 61 Data Ascii: ebug && window.console && console.warn("Nothing selected, can't validate, returning nothing.")); var c = a.data(this[0], "validator"); return c ? c : (this.attr("novalidate", "novalidate"), c = new a.validator(b, this[0]), a.data
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 76 61 6c 69 64 61 74 65 28 29 2e 66 6f 72 6d 28 29 20 3a 20 28 64 20 3d 20 5b 5d 2c 20 62 20 3d 20 21 30 2c 20 63 20 3d 20 61 28 74 68 69 73 5b 30 5d 2e 66 6f 72 6d 29 2e 76 61 6c 69 64 61 74 65 28 29 2c 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 20 3d 20 63 2e 65 6c 65 6d 65 6e 74 28 74 68 69 73 29 20 26 26 20 62 2c 20 62 20 7c 7c 20 28 64 20 3d 20 64 2e 63 6f 6e 63 61 74 28 63 2e 65 72 72 6f 72 4c 69 73 74 29 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 2c 20 63 2e 65 72 72 6f 72 4c 69 73 74 20 3d 20 64 29 2c 20 62 0d 0a 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 72 75 6c 65 73 3a 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 29 20 7b 0d 0a 20 20 20 20 Data Ascii: validate().form() : (d = [], b = !0, c = a(this[0].form).validate(), this.each(function() { b = c.element(this) && b, b \|\| (d = d.concat(c.errorList)) }), c.errorList = d), b }, rules: function(b, c) {
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 2e 72 65 71 75 69 72 65 64 2c 20 64 65 6c 65 74 65 20 67 2e 72 65 71 75 69 72 65 64 2c 20 67 20 3d 20 61 2e 65 78 74 65 6e 64 28 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 71 75 69 72 65 64 3a 20 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 67 29 29 2c 20 67 2e 72 65 6d 6f 74 65 20 26 26 20 28 68 20 3d 20 67 2e 72 65 6d 6f 74 65 2c 20 64 65 6c 65 74 65 20 67 2e 72 65 6d 6f 74 65 2c 20 67 20 3d 20 61 2e 65 78 74 65 6e 64 28 67 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6d 6f 74 65 3a 20 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 29 2c 20 67 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 29 2c 20 Data Ascii: .required, delete g.required, g = a.extend({ required: h }, g)), g.remote && (h = g.remote, delete g.remote, g = a.extend(g, { remote: h })), g } } }),
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 72 6f 75 70 73 3a 20 7b 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 75 6c 65 73 3a 20 7b 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 6f 72 43 6c 61 73 73 3a 20 22 65 72 72 6f 72 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 65 6e 64 69 6e 67 43 6c 61 73 73 3a 20 22 70 65 6e 64 69 6e 67 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 69 64 43 6c 61 73 73 3a 20 22 76 61 6c 69 64 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 6f 72 45 6c 65 6d 65 6e 74 3a 20 22 6c 61 62 65 6c 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 63 75 73 43 6c 65 61 6e 75 70 3a 20 21 31 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 63 75 73 49 6e 76 61 6c 69 64 3a 20 21 30 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 Data Ascii: roups: {}, rules: {}, errorClass: "error", pendingClass: "pending", validClass: "valid", errorElement: "label", focusCleanup: !1, focusInvalid: !0, err
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 2c 20 64 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 72 61 64 69 6f 22 20 3d 3d 3d 20 62 2e 74 79 70 65 20 3f 20 74 68 69 73 2e 66 69 6e 64 42 79 4e 61 6d 65 28 62 2e 6e 61 6d 65 29 2e 61 64 64 43 6c 61 73 73 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 64 29 20 3a 20 61 28 62 29 2e 61 64 64 43 6c 61 73 73 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 64 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 75 6e 68 69 67 68 6c 69 67 68 74 3a 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 2c 20 64 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 72 61 64 69 6f 22 20 3d 3d 3d 20 62 2e 74 79 70 65 20 3f 20 74 68 69 73 2e 66 69 6e 64 42 79 4e 61 6d 65 28 62 2e 6e 61 6d 65 29 2e 72 Data Ascii: , d) { "radio" === b.type ? this.findByName(b.name).addClass(c).removeClass(d) : a(b).addClass(c).removeClass(d) }, unhighlight: function(b, c, d) { "radio" === b.type ? this.findByName(b.name).r
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 65 71 75 61 6c 20 74 6f 20 7b 30 7d 2e 22 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 3a 20 61 2e 76 61 6c 69 64 61 74 6f 72 2e 66 6f 72 6d 61 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 75 65 20 67 72 65 61 74 65 72 20 74 68 61 6e 20 6f 72 20 65 71 75 61 6c 20 74 6f 20 7b 30 7d 2e 22 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 65 70 3a 20 61 2e 76 61 6c 69 64 61 74 6f 72 2e 66 6f 72 6d 61 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 6d 75 6c 74 69 70 6c 65 20 6f 66 20 7b 30 7d 2e 22 29 0d 0a 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 61 75 74 6f 43 72 65 61 74 65 52 61 6e 67 65 73 3a 20 21 31 2c 0d 0a 20 20 20 20 20 20 20 20 70 72 6f 74 6f 74 79 70 65 3a 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: equal to {0}."), min: a.validator.format("Please enter a value greater than or equal to {0}."), step: a.validator.format("Please enter a multiple of {0}.") }, autoCreateRanges: !1, prototype: {
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 20 20 20 20 20 61 2e 65 61 63 68 28 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 67 72 6f 75 70 73 2c 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 74 72 69 6e 67 22 20 3d 3d 20 74 79 70 65 6f 66 20 63 20 26 26 20 28 63 20 3d 20 63 2e 73 70 6c 69 74 28 2f 5c 73 2f 29 29 2c 20 61 2e 65 61 63 68 28 63 2c 20 66 75 6e 63 74 69 6f 6e 28 61 2c 20 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 5b 63 5d 20 3d 20 62 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 2c 20 63 20 3d 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 72 75 6c 65 73 2c 20 61 2e 65 61 63 68 28 Data Ascii: a.each(this.settings.groups, function(b, c) { "string" == typeof c && (c = c.split(/\s/)), a.each(c, function(a, c) { e[c] = b }) }), c = this.settings.rules, a.each(
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 20 30 2c 20 62 20 3d 20 74 68 69 73 2e 63 75 72 72 65 6e 74 45 6c 65 6d 65 6e 74 73 20 3d 20 74 68 69 73 2e 65 6c 65 6d 65 6e 74 73 28 29 3b 20 62 5b 61 5d 3b 20 61 2b 2b 29 20 74 68 69 73 2e 63 68 65 63 6b 28 62 5b 61 5d 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 69 64 28 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 3a 20 66 75 6e 63 74 69 6f 6e 28 62 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 2c 20 64 2c 20 65 20 3d 20 74 68 69 73 2e 63 6c 65 61 6e 28 62 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 20 3d 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 54 61 72 Data Ascii: 0, b = this.currentElements = this.elements(); b[a]; a++) this.check(b[a]); return this.valid() }, element: function(b) { var c, d, e = this.clean(b), f = this.validationTar
2025-01-15 16:42:40 UTC	1369	IN	Data Raw: 67 72 65 70 28 74 68 69 73 2e 73 75 63 63 65 73 73 4c 69 73 74 2c 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 21 28 61 2e 6e 61 6d 65 20 69 6e 20 62 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 68 6f 77 45 72 72 6f 72 73 20 3f 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 68 6f 77 45 72 72 6f 72 73 2e 63 61 6c 6c 28 74 68 69 73 2c 20 74 68 69 73 2e 65 72 72 6f 72 4d 61 70 2c 20 74 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 29 20 3a 20 74 68 69 73 2e 64 65 66 61 75 6c 74 53 68 6f Data Ascii: grep(this.successList, function(a) { return !(a.name in b) }) } this.settings.showErrors ? this.settings.showErrors.call(this, this.errorMap, this.errorList) : this.defaultSho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49743	151.101.129.16	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:41 UTC	644	OUT	GET /images/S/sash/mPGmT0r6IeTyIee.png HTTP/1.1 Host: m.media-amazon.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:41 UTC	682	IN	HTTP/1.1 200 OK Connection: close Content-Length: 27972 Content-Type: image/png X-Amz-IR-Id: 60c5c3cb-0e05-45df-9336-9135292f45b8 Cache-Control: max-age=630720000,public Last-Modified: Tue, 17 Nov 2020 23:31:33 GMT Access-Control-Allow-Origin: * Timing-Allow-Origin: https://www.amazon.in, https://www.amazon.com Expires: Tue, 15 Sep 2043 08:53:47 GMT X-Nginx-Cache-Status: HIT Accept-Ranges: bytes Date: Wed, 15 Jan 2025 16:42:41 GMT Age: 1913238 X-Served-By: cache-iad-kjyo7100113-IAD, cache-ewr-kewr1740020-EWR X-Cache: HIT from fastly, HIT from fastly Server-Timing: provider;desc="fy" alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 02 ee 08 03 00 00 00 b7 a1 b0 d2 00 00 02 fa 50 4c 54 45 00 00 00 2a 41 43 2e 33 38 1f 27 30 22 29 30 21 2a 22 4e 54 5b 07 09 0b 00 00 00 33 33 33 10 11 13 03 04 04 12 14 16 06 07 08 64 69 6d 2f 38 40 2f 38 41 60 67 6f 57 56 53 1f 20 21 03 04 05 51 56 5c 05 06 06 62 65 6a 65 65 65 3e 41 43 93 94 95 06 08 09 5b 62 6a 7d 82 87 50 57 60 59 74 53 08 0b 0e 08 0a 0c 00 00 00 08 09 0b 6d 77 78 6a 70 76 04 05 06 4d 53 59 60 66 69 3b 3d 40 4b 52 5b ff ff ff a8 ab af 5f 64 69 10 10 10 04 05 05 64 6a 72 9a 9b 9c 88 8d 92 c2 c5 c6 cd d0 d1 f6 f5 f4 0f 12 15 d6 d9 da eb ed ed b8 bb bd e5 e7 e7 fb fb fa dd de de b0 b2 b5 56 5d 65 dd 8d 1c e7 75 00 de 82 19 cb 38 2c 33 9b c5 21 8d bf 32 87 a9 3a 81 be e7 Data Ascii: PNGIHDRPLTEAC.38'0")0!"NT[333dim/8@/8A`goWVS !QV\bejeee>AC[bj}PW`YtSmwxjpvMSY`fi;=@KR[_didjrV]eu8,3!2:
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 7c 08 23 55 bd 8f e1 7c c8 70 fb 74 24 64 38 a9 10 ce 14 37 32 ca 7d 1c c8 ed 5a 08 90 82 51 03 2d 93 d3 f9 e9 c9 b8 ab 74 9a bf 15 7e 69 78 26 d9 94 55 2d 11 e2 71 1f 55 e8 23 66 c5 a8 98 00 d2 88 81 3e 62 98 1d f9 c2 6c 42 21 68 64 22 37 97 1b e3 3e 12 08 91 53 56 8c 10 32 cc 87 5a 16 37 29 60 98 40 9b 74 5e 80 57 13 4c 59 55 1b 6c 70 fe 67 3e 28 8d c9 10 4e 95 0b a9 42 3f 88 19 72 1e 65 9c 83 da 28 16 75 a2 9b b2 54 54 23 e8 63 fb 85 fc 24 99 3c 84 d7 7b 5c 65 f9 9c 1a 24 c7 ce b8 be 1f 78 04 4a da 1a a2 64 48 9f 84 1c 9e 9f 5f c8 2d 2e f1 59 6b 7e 7e ff 36 21 63 63 e3 ac 5e d4 0b 91 6b 3a 59 d4 e3 8d e8 7d c8 1a 32 93 cf cf 74 5d 43 aa 9e 57 86 6c 16 c0 f3 3c 07 da 38 4e c9 6f 50 48 4a a9 e1 37 dc 86 ef 5b e5 c6 b6 55 16 c1 55 56 d2 1a d2 53 86 d4 99 Data Ascii: \|#U\|pt$d872}ZQ-t~ix&U-qU#f>blB!hd"7>SV2Z7)`@t^WLYUlpg>(NB?re(uTT#c$<{\e$xJdH_-.Yk~~6!cc^k:Y}2t]CWl<8NoPHJ7[UUVS
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 6b 77 99 a0 b9 b6 b6 e5 e6 ee b5 2e 33 c4 b5 35 19 72 22 4e 08 4f 82 8e 42 f6 b3 95 fd e1 0f c9 ad 32 16 15 e2 e1 a0 da 7c 3c 1d 14 52 20 e1 71 c5 26 dc 91 85 a3 5d 02 cc 07 40 ec 0a 7e 56 6a 18 e4 32 2b 14 53 ac 8a 5a 30 41 9e 80 e0 c9 d7 29 72 23 f2 81 3a a9 4f 91 17 2f 19 f2 f2 05 74 c2 2e 6e 20 45 3b a9 0f d2 92 f5 fc ee dd e6 56 65 6f 91 5e 7c c4 0a 59 64 2b 9d 84 ac 2e e4 90 05 29 04 21 26 01 a0 6d 21 55 80 00 e7 2f 6e 2a c0 30 00 38 98 40 22 77 2b 26 fe 16 0f 80 62 b6 14 84 9c d0 19 5f 5f 39 20 70 f8 5a 0b 24 7c 7d f5 02 04 2f f8 bb 01 95 0b ef 19 f2 fe 02 74 e2 c9 c7 0d e4 e3 93 84 3e e0 d2 65 a6 e3 f2 a5 6e 6a ba ab af 20 f1 42 8e 2f b3 45 bd 90 e3 f3 39 64 94 6d 13 02 4e cd 72 8d b6 10 1b 20 8b a3 5d c6 71 06 a8 66 c2 b0 10 e2 89 ca 22 2a 46 25 Data Ascii: kw.35r"NOB2\|<R q&]@~Vj2+SZ0A)r#:O/t.n E;Veo^\|Yd+.)!&m!U/n08@"w+&b__9 pZ$\|}/t>enj B/E9dmNr ]qf"F%
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 85 06 b2 76 c6 2f ef dd 67 66 5d d6 b3 bb 53 a2 3b c2 ac 4d f2 b3 64 d5 77 74 35 6f 5a a3 be e3 92 d1 dc 2d 65 4f 42 9a 34 61 cc 00 7c 7d ec 83 3e 57 1f ed 96 b6 6c a3 b4 57 df 65 b0 7b d7 c6 64 59 a0 3d 04 e0 8a 47 2d d0 98 37 7d 4e ba 11 e2 63 dc 42 7c 23 33 c4 c7 98 85 f8 46 88 8f b1 0b f1 8d 30 1f e7 5a 88 bf 47 84 08 c9 84 c6 2b c4 87 08 c1 f4 97 be 90 73 25 04 95 ab 13 27 e4 f9 87 31 1a 21 8c 4c 68 c2 84 e0 87 31 32 21 98 f2 85 88 30 99 3d c4 17 22 3a 86 f8 42 26 71 96 e5 0b 19 7f 1e e2 0b f1 33 75 5f 88 2f c4 17 e2 0b 19 0b be 10 5f c8 18 2a e2 26 43 c8 4a 26 b3 82 a8 a6 93 4a 6a 05 93 ec 60 c4 22 b1 7e 24 cd 48 22 2a a9 38 22 26 d3 6a 3a a5 20 e3 53 2d bf fb ff 26 16 19 61 60 84 31 03 9b 09 88 46 12 00 29 4c cb 00 30 ad 60 08 18 41 4c 45 d9 d9 0a Data Ascii: v/gf]S;Mdwt5oZ-eOB4a\|}>WlWe{dY=G-7}NcB\|#3F0ZG+s%'1!Lh12!0=":B&q3u_/_&CJ&Jj`"~$H"8"&j: S-&a`1F)L0`ALE
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: df 75 c8 5a 80 75 88 5e 48 45 ba b8 94 bc 79 a8 90 7f bf 7d 12 21 c8 5a f0 e1 15 22 7c 57 ea 82 42 46 f8 ae d4 45 c0 95 ba 26 42 7e 99 1a f9 fa 60 21 7a 23 81 85 28 23 15 ff bd ac a1 cf 2e d1 90 c2 42 f3 31 82 ec 65 e9 85 ec ee bf 91 58 6c 64 f7 d9 85 00 3f 21 62 e0 d9 47 1d 08 0a 0b ed c7 08 be db ab 2f ea 3b 2c 64 e7 99 52 96 5e 08 19 9e 93 06 83 42 46 ff 31 f4 e7 21 01 84 ec a2 88 3c 5b 51 d7 9f 18 9a 83 b9 b3 b8 81 49 a1 a2 ff 18 fa 13 c3 00 42 c0 d7 07 17 11 fa fe 0c fe 50 f1 39 53 1f d0 0c c6 70 e6 b4 7a 18 7e 7c e8 3f 86 fe 4c 3d 90 90 37 97 92 2b 3d f4 fd 31 06 3e 77 9d 0c 0c 9a 45 98 c3 81 bc 9f 63 30 34 05 85 8f fe 63 e8 ef 3a 09 22 e4 e8 d2 e1 59 84 90 61 7a 31 3c 73 61 38 fd 4f a5 e3 d7 eb 5f c9 9f 90 3e c6 7c c6 66 19 0d 0b 3e 1a 96 65 35 ae Data Ascii: uZu^HEy}!Z"\|WBFE&B~`!z#(#.B1eXld?!bG/;,dR^BF1!<[QIBP9Spz~\|?L=7+=1>wEc04c:"Yaz1<sa8O_>\|f>e5
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 85 1c 74 ab 2a 61 9d fe c3 e2 30 40 54 8c c6 16 87 06 fb e8 b3 9d 31 37 f6 46 6c a9 6e b3 03 78 90 de 38 64 fa aa 13 86 6c 0a c0 ca 12 0c ac 94 e2 1a 21 2a 1a d2 2b a5 f4 44 42 41 f6 18 b3 42 54 f1 29 f9 0a 51 46 be f8 f8 68 6e 6e 92 3f 3f 36 5a fd c7 0b 81 8f 4f 15 35 ac 43 2c 13 68 72 29 ef 36 a9 d9 66 1f b5 b1 1b 06 98 ed 26 21 5f 71 ab ce 0d da e6 47 ee b8 c1 48 0b 65 1d 51 32 e9 44 23 d0 55 16 13 13 44 31 9d 10 19 0d ab b3 35 c4 48 ab 49 77 5f 5e d6 47 08 8c f8 f8 a0 cd 9f de 92 3f ff 6b 7c fc f8 68 21 ca 87 4e 88 37 53 75 2e e8 18 3e 60 e0 e6 e6 c6 1e c9 09 46 ea b2 b7 47 a3 7e 1d 0d 9b a7 bd c5 aa d0 d8 63 0f 82 a3 44 a0 93 3b b6 c9 e6 06 3d 9c a4 f2 40 2b 3a 21 79 d7 83 8a 10 15 5c a5 f9 37 52 61 93 bb 5f 08 65 bf 28 1f da 9a ae d6 e9 8f 4f 59 ca Data Ascii: ta0@T17Flnx8dl!+DBABT)QFhnn??6ZO5C,hr)6f&!_qGHeQ2D#UD15HIw_^G?k\|h!N7Su.>`FG~cD;=@+:!y\7Ra_e(OY
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 6a 63 a9 17 47 47 29 db 9e 6f 03 d1 c0 ac d7 4d d0 7c 10 4a 51 5b ca e2 65 f3 78 33 26 c6 e3 00 a3 20 58 b2 0b 90 fb 7d 06 89 4f 4c c4 2f 06 e2 02 cf fd 00 c8 3d 53 21 0a 07 49 aa 6a 92 dd 5f 54 0f 64 5b cc 87 6e 00 80 63 89 19 41 90 97 63 92 df d8 4b 0f e4 f6 6a 35 d0 23 6f 3e aa af 52 8f 8f 1a 8d 46 b5 35 23 cc 83 4a 88 57 89 95 ad 61 d9 2c f5 38 3e 5e f2 e6 e3 80 a6 51 10 6c e1 a3 20 23 85 c9 0f 81 e8 46 5e bf 14 90 b1 6b 8a 72 ad fb 9d 8e f0 10 22 21 90 39 02 98 37 21 88 b0 b3 80 ef 80 ca bb c3 de 63 54 b0 c0 d0 75 3d 0f 06 7e 7d 97 81 a0 c8 78 c0 43 66 92 38 1f 8e e1 80 b3 6c e0 9f 2a f6 37 fa 53 3b 45 31 0c a3 d1 78 61 63 77 3d 90 3a d9 f7 82 3a 07 19 db 3c ae 61 9b 38 27 c7 58 56 62 55 18 04 80 c9 5e 2b 02 a4 09 a2 66 10 a4 50 28 84 41 74 0b 2d 2c Data Ascii: jcGG)oM\|JQ[ex3& X}OL/=S!Ij_Td[ncAcKj5#o>RF5#JWa,8>^Ql #F^kr"!97!cTu=~}xCf8l*7S;E1xacw=::<a8'XVbU^+fP(At-,
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 46 d7 2f 00 c2 39 3a 4f c8 d3 3b bb 54 63 a7 c5 21 66 e4 7b ab cb d3 5e 11 dd 13 e2 fd ea fc d3 de b7 08 62 ae f9 fd 59 f2 8a 6d 8a 43 93 e0 69 2f f6 c9 9d f6 0e df 08 82 dc 18 fe 9f 3f 0f 11 20 15 a9 53 77 ef d2 13 df 1f f0 d3 8c 6e 7b f0 10 ff 46 6a c7 cf 43 de ae 2d b6 81 bc dd f6 1f 5c b2 c5 25 29 5c 72 b6 52 a9 7c 52 9f 87 88 47 5e 1f 44 3c fa 46 0d a8 98 9c 00 de c4 04 f0 12 72 4c 8a 1a 54 71 64 08 37 11 8d c8 c0 1a bb aa 40 f8 96 05 ca d5 31 29 6a 30 5d 99 82 30 08 36 75 45 8a 1a 48 e3 a3 f0 c1 fc 0f 46 a2 72 ef 82 e5 24 6c fb 97 5f db fb 65 bb a7 1f 83 bc df 8d a1 08 42 f4 2e 9c 84 05 3d 50 a4 47 7b c2 11 38 a7 91 8e bb c3 08 e4 d7 70 52 4f 92 a7 e1 9c a6 e5 48 c2 07 69 ba 00 e0 9e bd 0f 52 ae ef f7 14 64 7d 58 3e a7 e1 68 42 7c 90 53 e0 35 c3 20 Data Ascii: F/9:O;Tc!f{^bYmCi/? Swn{FjC-\%)\rR\|RG^D<FrLTqd7@1)j0]06uEHFr$l_eB.=PG{8pROHiRd}X>hB\|S5
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: fc 51 8d 6b b1 b1 6d 63 eb ae 73 db 57 bb ea 6c 57 db 76 8a b4 19 6d bb b5 f5 6a b4 dd 68 eb d6 da f5 34 47 f0 27 b9 16 ab a9 c3 b8 b1 d6 ae ad 4b 32 25 3a b6 b6 5e 5b 3b 76 76 b3 b6 1b 74 76 3c ba 42 6e de 21 f8 a3 5a eb 74 d3 79 b3 ed 6c 3b 95 d8 d8 23 5a 3b 6e 6d fd 6c ed 76 3a a6 2b 77 1a 6d e7 d2 e0 2d db 6e eb 5f 83 0f ec 58 75 dd 6e 56 5b 5b 03 d6 8e 4d b3 ea 6c e3 f6 a9 8d 5d cf 5b 15 8e ee ea e8 62 b8 39 de d2 7d 6b b7 d8 b6 df 3a dc 2e 58 db f6 74 5e 03 b5 ed 8e dd 29 06 5a db 4c 09 d6 d6 b6 d6 5d 4d 31 ec 34 3f e2 2d ae 45 db b4 ae 4a 70 bb d6 6e e6 73 dd 00 63 5b b7 e3 58 af d1 d5 cd b6 6e 9f eb 7a 35 d6 dd e6 74 35 cf f1 ae 22 df 42 8f 7b d2 4c 41 1a 04 f7 22 dc 21 f7 22 3c 43 ee 40 f8 29 eb 0e 84 cf 21 ff be 20 08 82 80 20 f8 0a 85 f6 04 52 Data Ascii: QkmcsWlWvmjh4G'K2%:^[;vvtv<Bn!Ztyl;#Z;nmlv:+wm-n_XunV[[Ml][b9}k:.Xt^)ZL]M14?-EJpnsc[Xnz5t5"B{LA"!"<C@)! R
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 0c 66 f3 13 7c 33 cf e1 41 6f c9 cf 8b 17 93 e3 97 ac 16 66 eb c5 dd 18 bf 30 58 2d 67 ab c5 47 21 2f 50 e5 f9 d3 e4 1f e4 62 79 bf 5e ce ee 2e 1a 2b e3 8b d5 c3 f2 fe db 0a 8b 3b 1c 4b 34 3d 9b 46 87 07 ef ae 90 d3 f3 75 b1 be f7 cc e7 f3 e6 7d b9 1a 63 3c c3 5f e4 83 f1 dd 83 df c7 ef d7 f3 e5 c3 ff d9 3b 03 ce 46 82 28 8e bf 00 70 9f a0 5f a1 60 50 d0 52 b5 10 82 19 b0 2c 80 23 0a 3c 15 a3 74 da 26 95 95 ec 21 c0 ee 17 98 19 6e 3e cc ec ce 7d a4 7b b3 bd 8b b4 36 d4 6a 93 bd 93 9f 6c de be ff 03 f6 e7 99 15 c8 fc 06 4e 9c f8 e7 29 d6 67 3b ac 8b be f9 89 4f 62 7d 75 be c3 d5 ba 6f fe bf d3 84 0a 0e c2 d9 f9 1b ce 7a e4 03 e3 fb 0b 7c 01 75 c8 4f 42 7a 31 57 4f f0 39 08 01 55 15 6b fc 88 d7 ef 18 b4 21 54 85 38 96 90 6c da 9d 2f 4b ca 87 e7 43 fd 94 84 Data Ascii: f\|3Aof0X-gG!/Pby^.+;K4=Fu}c<_;F(p_`PR,#<t&!n>}{6jlN)g;Ob}uoz\|uOBz1WO9Uk!T8l/KC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49745	151.101.129.16	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:41 UTC	648	OUT	GET /images/S/sash/pDxWAF1pBB0dzGB.woff2 HTTP/1.1 Host: m.media-amazon.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:41 UTC	710	IN	HTTP/1.1 200 OK Connection: close Content-Length: 16616 Content-Type: application/font-woff2; charset=utf-8 X-Amz-IR-Id: 229e23b0-2363-4f56-a9f3-9324be97aa14 Expires: Fri, 13 Feb 2043 07:28:13 GMT Cache-Control: max-age=630720000,public Timing-Allow-Origin: https://www.amazon.in, https://www.amazon.com Access-Control-Allow-Origin: * Last-Modified: Fri, 30 Oct 2020 21:19:16 GMT X-Nginx-Cache-Status: HIT Accept-Ranges: bytes Date: Wed, 15 Jan 2025 16:42:41 GMT Age: 5552615 X-Served-By: cache-iad-kiad7000099-IAD, cache-ewr-kewr1740057-EWR X-Cache: HIT from fastly, HIT from fastly Server-Timing: provider;desc="fy" alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 40 e8 00 10 00 00 00 00 af 6c 00 00 40 82 00 01 02 8f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 38 1b df 7a 1c 97 40 06 60 00 85 7e 11 08 0a 81 a1 50 81 84 39 01 36 02 24 03 8e 46 0b 87 3c 00 04 20 05 89 2c 07 9b 61 3f 77 65 62 66 06 1b ff 9b 35 6c 9b 46 cd ee 56 55 05 00 23 37 1b 51 83 ee e0 64 fd a1 8a 18 15 e5 94 8d 6b f6 ff 9f 72 a0 86 8c f1 b8 7b d8 54 b5 aa 82 14 32 4b 75 49 09 31 a5 2b 6a ca aa a4 84 28 ef 07 6b 76 66 38 af 8c 11 37 83 2b bf 26 00 ab ae 86 b0 74 85 1f 21 5a 1c 96 43 1c 96 ea 3e a3 05 3d ec f4 9e 0b f4 76 18 39 5f 15 25 20 a0 4c c2 19 02 c1 c2 7a b0 e5 f5 a4 97 07 ec c3 9d be ef 85 95 30 1f 65 84 19 bf e5 3b e8 37 3e ff 64 bb fe 53 ff e3 9d 9e 5b 9f cd a7 26 2f 1a Data Ascii: wOF2@l@?FFTM8z@`~P96$F< ,a?webf5lFVU#7Qdkr{T2KuI1+j(kvf87+&t!ZC>=v9_% Lz0e;7>dS[&/
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 46 2a 28 cf 88 2a 3c 5b c4 b9 df 46 e9 b2 05 56 71 91 0c cb 09 9e 7a f7 71 e2 58 a4 4c f3 f1 7b d8 49 de e2 1b 27 b9 0e a3 14 5b 96 24 a3 78 81 c7 67 a2 1c 57 62 24 48 91 46 a2 eb a0 d3 ce bb e8 92 cb ae b8 c6 85 27 3f a1 22 c4 db 20 5d 96 9f 7e f9 e3 8e 51 e3 e6 7c 87 25 40 f3 3f bc 18 62 a4 1b 33 bd f4 b3 ce 26 bb d8 71 f2 cb bf c0 82 0a 2e b4 b8 36 b6 a9 b4 b2 3a 58 4e b9 e5 75 a9 fa 1a 6a aa ad ab 81 75 fd b0 63 2c 05 e8 7f 1d ca a9 83 a6 af 64 39 82 02 43 d3 cb 30 6d a0 09 b0 66 5e 2f d2 7a 56 00 7e a7 2f 20 00 a6 08 c4 b0 09 12 08 a2 08 15 32 45 ea 6b 84 4d cc 72 18 a9 ef 6b 0c c0 18 18 64 74 78 4c 77 f9 8d 68 d2 bf 8c 48 0c b9 56 15 5b 88 b7 0e 27 01 09 ec 4a e9 e4 b2 fe 68 05 48 4d 3b 05 a1 5a 22 12 70 35 8d be fd 2c 13 4c 1a 44 06 a8 e6 62 84 25 Data Ascii: F(<[FVqzqXL{I'[$xgWb$HF'?" ]~Q\|%@?b3&q.6:XNujuc,d9C0mf^/zV~/ 2EkMrkdtxLwhHV['JhHM;Z"p5,LDb%
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 32 c4 8b 95 89 8d 6e 80 ee 04 46 94 04 1c 4e 62 30 f8 3c 6e 09 d3 56 82 04 74 5e 4a 89 11 30 04 c1 86 3b 40 41 13 4d fb a8 b0 d7 f9 69 06 94 d1 74 44 b5 42 68 56 87 ae b4 92 31 35 0f 98 9c 82 64 a6 34 20 e0 21 79 72 cd fb cc 19 2d 81 f7 22 63 27 a6 da 2a c5 b9 80 01 fa b4 60 5e b5 40 e4 5f f0 03 dc 90 90 5d 5b da 12 ed 7e f1 1c 0c 06 27 0a b8 22 ae df 11 dd 23 8a 33 b3 a1 23 01 04 99 5f 81 92 1a 22 6f a5 e2 c4 2c 77 33 57 44 f0 54 9e c0 8d 82 3a 4a 9a ac 2a de ac 09 fb 6d 2d a2 a5 7e d0 5a f0 75 dc 3e 28 ce cc e8 41 28 50 3b 33 1b 51 36 6d ed a8 2f 1a 37 22 e2 07 49 02 f9 01 65 7d b6 c5 36 c1 a6 09 2d 59 59 77 4e 26 c9 04 91 40 17 d0 62 da d2 ee 2b 46 d5 c6 de 93 82 03 96 90 ce cc 1a af 12 69 a5 5c 3b 36 10 ab 64 a1 1a 2c 55 04 cd 70 ff dd 40 19 27 60 29 Data Ascii: 2nFNb0<nVt^J0;@AMitDBhV15d4 !yr-"c'`^@_][~'"#3#_"o,w3WDT:Jm-~Zu>(A(P;3Q6m/7"Ie}6-YYwN&@b+Fi\;6d,Up@'`)
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: fb 2f 48 a2 7a 54 b4 b3 c5 03 12 dc 75 01 1f d8 ba 14 bb 3e 72 50 f7 f1 cc 23 d3 09 8a d9 d1 ab 37 37 12 75 a0 4e 3d 29 ce 7f fc 90 57 9f d8 ec 6e 00 ad 49 7b 93 80 1b 3b 02 0d 5e d0 bd a3 cd d5 02 c0 c0 e0 a1 24 85 86 bf 22 0a 3c fa be 0c 16 e6 96 00 e1 26 11 50 66 0d bd 65 a2 24 a2 ed 69 94 bb ae b1 0d 0a d2 52 f0 79 b5 e6 05 2c 24 d9 9f 13 21 87 c9 84 0d 67 1e 7c 04 88 90 20 c9 1e 19 04 4a 1d 72 dc 79 8d ae e9 d6 43 21 9e e1 95 f9 13 07 03 a1 24 1b ad a2 40 ea 0b 4d 7e 10 05 d2 8c 1c 55 37 e3 73 e4 a3 db fc 8a 9b b3 ca 28 1d 75 f3 cd d0 1c 4e c8 3d 0f a3 8f 5c 9f f9 79 1f 5d 93 f5 be d1 de 75 06 b5 9d d6 ee 38 84 7c 23 6f 4c 46 a1 f3 cd 47 3d fa cd 21 22 5e d5 67 8a 88 c6 09 82 a4 c2 10 e1 d3 57 4f fd df c4 db c2 47 2b ed 18 e9 c2 10 60 02 81 9d 80 ca Data Ascii: /HzTu>rP#77uN=)WnI{;^$"<&Pfe$iRy,$!g\| JryC!$@M~U7s(uN=\y]u8\|#oLFG=!"^gWOG+`
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: de a0 f4 e0 b1 08 38 d1 68 09 20 02 bf 18 5c a2 9a 7c 40 72 0a c0 27 11 c9 47 f2 22 93 47 d5 b8 6a a9 4d 8d aa 4f fb a0 07 2a 74 28 55 23 4d d5 64 8a 09 aa 9a f0 02 07 ac e9 c8 fc 94 cc c0 1a 4a b0 31 78 be f6 c1 6a e9 7b 2c 50 1f ce 3c c5 af c8 a0 8a cc 54 61 6b 50 f6 94 0d d5 25 50 f4 b2 3e 19 67 a8 09 09 d3 ca aa cd c2 c6 3a 59 79 10 0a bc 1c 02 52 2d ac 1d 27 b1 5e 2c ec 41 8f 2d 63 26 17 59 2f 88 3e a5 b5 e9 b8 8f a5 86 22 c0 aa a4 be d2 14 8d 72 7e f9 7d 2e 59 3a d2 f7 e5 bc f2 0a 63 e6 6a d3 c1 c3 96 79 cb ce 3a a6 65 04 c8 cb 74 bc 5e 61 27 d2 36 e7 7d be 90 8a 5e da cb 29 2d 50 8c e8 7d 65 a0 6a 25 74 9d 61 52 ee b8 96 bc 11 5a 2e ea 34 38 43 06 3b 5b 93 89 c9 c1 bc dd 32 27 0a 2e bb 8f 03 33 f5 dc d1 b9 9f 38 9b b3 c2 6f 43 da 39 ad a0 45 13 f2 Data Ascii: 8h \\|@r'G"GjMO*t(U#MdJ1xj{,P<TakP%P>g:YyR-'^,A-c&Y/>"r~}.Y:cjy:et^a'6}^)-P}ej%taRZ.48C;[2'.38oC9E
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 31 03 68 25 0f 84 e4 71 20 e4 d3 34 83 ec f8 9e f8 15 90 a1 d8 fe 43 dd 38 3c 8e d8 01 3a a5 37 ba 28 39 31 ee fb 68 64 79 34 0c cd bd de 42 86 7d 35 4e 91 a0 a7 3c 7f f4 45 b6 e9 2f 82 6c 8f 1c 8a 23 d0 fd e4 00 83 6b 32 62 2e 62 aa 36 79 17 88 97 48 7d 4b c0 75 5f 25 6e eb 58 7b d2 25 c1 58 be a8 6a da 7d 35 1a 28 cd e0 c5 e1 41 3c b5 17 3e f9 f3 79 b3 f9 8f 91 96 ee f5 c1 54 1d f9 ed f8 f1 a1 2e a4 fb 4c 7d 83 67 a4 10 c0 93 ec ed bb 7f 87 ad 40 06 ca ce a2 5a 40 b4 61 2a a7 3c 48 ce 7c a9 f5 a2 bb be 87 db 41 b5 1e ba 8c 91 d4 a7 44 14 c1 e7 5e 19 c7 c7 45 b9 69 c8 83 56 d0 85 f8 3d d0 09 fe a2 1e a4 da 57 7e ed fa f9 ca 85 fc 89 5b 17 6e dd 95 f5 5b 70 fb ac f1 76 9b 26 b2 3c 40 d6 64 1b e5 4c 6f 4d bd 0d 13 b1 b9 3f e8 3b e5 f4 8a 31 44 13 6d 5f 5d Data Ascii: 1h%q 4C8<:7(91hdy4B}5N<E/l#k2b.b6yH}Ku_%nX{%Xj}5(A<>yT.L}g@Z@a*<H\|AD^EiV=W~[n[pv&<@dLoM?;1Dm_]
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: e4 75 c7 2b 4e b5 73 87 e5 2b c5 37 72 b0 ca df 90 81 2a 30 91 00 91 f3 6a b8 96 08 88 9c 5f af 21 ad b9 bb a1 b0 ae 2b e4 76 4d 75 b6 7a 0d 39 c0 1c 72 38 86 97 8c a5 98 53 0a 39 36 5a a5 85 eb 1f e8 ad ed eb 3b 75 ea ea f6 e7 72 f2 b5 51 3f f3 56 2b 89 a8 7a a6 32 be 6c d9 f3 2a 9e 08 11 71 61 11 28 a5 b8 42 9a b7 d1 75 1e 58 5e 7d 96 6d 34 c9 d2 05 28 cb 34 ea 6f 6e 18 26 6a 38 22 a7 20 a5 b6 5c 51 51 d3 ee 73 39 3b 3d 2b a3 62 18 7a b6 82 8f c0 ca 6a 46 de a8 22 6d f2 1d bd a0 5d e5 9a 4a 35 53 c0 61 b3 fe 83 b5 3e 75 a6 d8 e1 6a 5b de 63 ad 27 17 3b 9b 5a 3c 42 86 3f 50 2d ee ea 3f 35 b3 b0 e3 b9 7c 42 90 ff b2 25 43 11 f3 1b 31 fb a1 92 0d ab 20 58 28 01 dc 72 ec f2 23 26 3c 9c 57 b2 80 e5 d1 ed 8f 8e 45 29 6a a8 c8 92 c5 7e ed ad 2e b1 1a dd 7a 25 Data Ascii: u+Ns+7r0j_!+vMuz9r8S96Z;urQ?V+z2lqa(BuX^}m4(4on&j8" \QQs9;=+bzjF"m]J5Sa>uj[c';Z<B?P-?5\|B%C1 X(r#&<WE)j~.z%
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: ae b4 cb 29 84 ec 10 77 40 fb dc a7 e4 c9 07 25 f7 ce 7a 82 4c f8 ab 7a 4a 8c c6 f4 87 02 36 dd 0e ac 73 13 7f 2a c6 d3 1a 72 09 81 1b d5 a0 e2 34 58 99 08 39 04 e4 7b 4f 95 29 c7 b9 a5 48 40 6b 20 24 59 b0 35 15 a3 67 01 ef ea c5 dc e2 4d d9 16 be 6d f5 ba 69 df 4d 3b 55 3b d3 b3 d6 32 f5 ba c0 a9 33 16 91 0b 91 a3 d2 10 a1 ae dc 5a 2c 91 94 6c 20 ee c0 fd c1 a5 b3 f8 70 3e 9f f0 3e f5 bf 77 9b c2 c1 b0 fb d8 ff 09 db 76 d4 ee 20 6a f7 b6 ee f5 9c fa 1f 36 f7 3f d6 fb 58 e0 d2 92 93 bf b6 ec b8 d0 7c c1 7f e2 d7 d6 08 f0 08 ff c2 ca c6 ab 07 c3 07 bd 5f 6b 49 22 09 9b 91 cf 41 8e a7 66 cd ae 03 74 1e d5 41 52 4d c8 b3 9d f9 2a 90 30 b9 8e ce d5 18 b0 cb d9 0f 98 71 aa b8 dc 07 8c cb 98 c6 20 a3 af 5b ed 9e 94 55 95 77 95 36 f6 e3 87 6c da d5 bc aa ac 24 Data Ascii: )w@%zLzJ6sr4X9{O)H@k $Y5gMmiM;U;23Z,l p>>wv j6?X\|_kI"AftARM0q [Uw6l$
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 82 4f f7 b0 9a 26 53 97 d4 11 74 73 85 cc 5c f5 2b 9a 87 76 2e e5 b6 e3 79 0f 33 38 9d c0 79 a5 9d 91 c5 5c 5f 87 34 8a 0d 1c 5f 47 de 0f f7 7e 93 4a af a1 bd e2 96 9d 49 ab aa 04 bc c0 7a e9 d1 b0 d1 05 37 55 e9 ec c7 34 e2 b7 22 d7 45 7e ef a6 39 66 d5 35 55 c1 f6 b0 4e 31 e3 6f 9a ac 0f 07 fc f5 9b c6 c7 eb a7 fc 81 8f 15 38 43 dc 65 11 2a 0d 6d 68 ec e3 00 ae de b5 46 91 9d b9 6b 97 83 29 b6 ba 03 04 cd 2d 5f a4 f3 55 eb 06 81 45 b4 31 e6 32 3a 79 7b 61 72 13 2f 98 3a 8d 0f cb 97 48 96 68 9c 3e f0 c1 ae 00 d9 f8 29 17 e5 9f ae 4d 16 e8 26 eb 1b db 2d 22 cb 08 61 af 18 d9 29 da 69 22 6d 08 58 c7 31 c3 bd a2 94 2b 95 70 46 9e 66 f3 de d7 b1 ea 2d e0 43 55 17 97 25 59 ec 39 d5 58 62 7c 69 9b 34 81 2b 0f d6 ec ff a8 3d 2d f4 e0 9a 20 d2 58 17 d0 73 d9 8e Data Ascii: O&Sts\+v.y38y\_4_G~JIz7U4"E~9f5UN1o8Ce*mhFk)-_UE12:y{ar/:Hh>)M&-"a)i"mX1+pFf-CU%Y9Xb\|i4+=- Xs
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 62 e8 4e b1 e6 38 1a 8f 11 22 1c ab 3f 30 18 e2 1d 9f 03 59 cc 1a cd e8 f8 16 19 1c cd fa 1c f8 ff 1f 64 31 54 0c f2 bd 9a 55 42 4c 87 0c 78 05 32 40 0e 78 5b df ad 23 63 1d 15 d9 22 ba 8b 0b fa 0d 35 2e 66 79 8c d2 a0 a8 6f 92 fe f4 e2 e6 2b d7 a0 e4 e0 1b 0c 8c e8 92 bb b9 e4 1a 0f f2 30 df e3 09 cc 09 33 11 96 a9 fa c1 5d 03 f0 20 0f 63 42 8c b2 77 15 f0 20 0f 63 42 cd 63 94 2d 6a b1 b3 9b 4d 3c c8 c3 7c 0f 13 6a 17 c0 8d 04 0f f2 30 26 d4 d1 49 8c c5 fd e3 3b 11 c0 03 3c c4 23 3c 8e 59 f1 48 3a d2 52 6e 70 97 0c 1e e0 21 8c 17 3f 8b aa 75 e7 fb 57 7b c0 1e 92 71 5d 1f 9b 98 2b 7f 47 57 4b e3 01 1e e2 11 8c 6b 50 00 57 15 3c c0 43 18 97 b0 ec 80 65 8c 0b 43 c7 4a 32 67 0d a3 b9 99 a7 30 29 4c 1d 2c 5e f5 88 c3 95 26 1e e6 21 9e e1 69 7e 80 fb d0 5b 62 Data Ascii: bN8"?0Yd1TUBLx2@x[#c"5.fyo+03] cBw cBc-jM<\|j0&I;<#<YH:Rnp!?uW{q]+GWKkPW<CeCJ2g0)L,^&!i~[b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49744	151.101.129.16	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:41 UTC	648	OUT	GET /images/S/sash/KFPk-9IF4FqAqY-.woff2 HTTP/1.1 Host: m.media-amazon.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:41 UTC	710	IN	HTTP/1.1 200 OK Connection: close Content-Length: 16460 Content-Type: application/font-woff2; charset=utf-8 X-Amz-IR-Id: 29d3a6a7-1de1-4b26-a924-6c3f60e02dbf Cache-Control: max-age=630720000,public Last-Modified: Fri, 30 Oct 2020 21:19:26 GMT Access-Control-Allow-Origin: * Timing-Allow-Origin: https://www.amazon.in, https://www.amazon.com Expires: Fri, 28 Aug 2043 19:16:09 GMT X-Nginx-Cache-Status: HIT Accept-Ranges: bytes Date: Wed, 15 Jan 2025 16:42:41 GMT Age: 2462883 X-Served-By: cache-iad-kcgs7200049-IAD, cache-ewr-kewr1740038-EWR X-Cache: HIT from fastly, HIT from fastly Server-Timing: provider;desc="fy" alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 40 4c 00 10 00 00 00 00 ae d4 00 00 3f e6 00 01 02 8f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 38 1b de 6a 1c 97 40 06 60 00 85 7e 11 08 0a 81 a1 68 81 84 69 01 36 02 24 03 8e 46 0b 87 3c 00 04 20 05 89 0a 07 9b 61 3f 77 65 62 66 06 1b 7d 9b 17 d8 36 0d 0a de ed 80 c1 be ae f6 9a 02 6e 8c cb 1e 07 05 8f 03 66 45 b0 71 00 20 d1 ff 59 f6 ff ff 39 09 32 64 cc 24 c0 7d 5b b0 a0 30 9d 48 88 84 11 b0 6a bd 6b 0c ed a8 09 db 55 94 97 23 22 2d 53 4d a8 74 e4 17 b9 22 44 96 cf 93 d4 f3 2b b3 1a 0b ae 74 d8 38 66 f9 bb eb 73 f9 b5 a0 67 36 33 36 7c db f3 67 e5 5f 9f aa ad 9d b3 45 42 a9 54 e1 21 15 42 18 02 21 12 a8 79 a9 1e e7 6b a7 dd a3 db b0 96 59 61 ae d8 ac 47 7e fe 59 ef 8e 3b 2b fe ce f8 Data Ascii: wOF2@L??FFTM8j@`~hi6$F< a?webf}6nfEq Y92d$}[0HjkU#"-SMt"D+t8fsg636\|g_EBT!B!ykYaG~Y;+
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 96 b2 80 da 84 0a 09 1b fc e8 20 02 f3 74 c5 af 45 b2 07 b0 c1 ae 15 f6 53 67 40 ff 70 4a 0e ef 1b b6 87 ec 21 b8 7a cc ee 4f ff dc 10 6f aa d4 69 98 c1 98 09 6b 36 ec e5 b5 4f 64 3e 27 0b b8 58 c4 d7 1a eb 85 db e8 88 13 ca 94 bb ec b1 27 ba f4 78 e5 a7 5f 01 9a df 9b 30 44 41 44 c6 f1 9a 1b 3f db ec 72 48 94 5b be f9 15 50 60 ab 5a 53 58 9b da 5c 54 c7 3b d1 c9 4e 15 53 6c 71 c5 97 50 62 d7 ba de 8d 2a bb 5b 03 ff 3d c2 ce 09 44 06 a7 ff d3 19 fd 98 78 e0 f3 b4 0b 51 31 c0 1e 3a 5a 3e 84 57 62 8f ee 73 60 57 ec d6 7d bc 6b 66 17 a3 eb 5e 0c c6 e9 ec 57 73 d8 63 8f eb 3b 11 88 ee d6 14 80 fa 6b d9 fd 98 bb 65 1c 8b a6 f7 0e 6b 7c c1 ef 1a 67 7f 0d 5f 90 6c 4b 68 f7 9d c4 ba 10 b0 14 38 cf 3e b7 c7 bd 09 e5 e4 93 5d 81 87 b1 bd 33 0b cd b4 76 17 98 ba c6 Data Ascii: tESg@pJ!zOoik6Od>'X'x_0DAD?rH[P`ZSX\T;NSlqPb*[=DxQ1:Z>Wbs`W}kf^Wsc;kek\|g_lKh8>]3v
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 22 ff d9 a9 28 34 84 ea d4 94 a0 08 40 05 56 36 56 c7 5c 61 03 dc 7a 0f 16 54 26 73 86 15 91 40 76 07 30 86 eb 63 0b 80 8a 78 ee 04 5b 2d ba bb f1 03 d8 08 10 f1 00 42 40 48 54 46 c7 4a 35 d2 ab 62 33 74 7e 84 bd 18 ba 55 b4 ca 04 84 7d 2a 00 24 30 c5 0a 69 79 d2 d4 d0 fa a3 4b a2 94 aa 7a 82 ac 9e 4d 0d 00 74 bc 2c e0 72 d4 00 02 63 e8 21 d8 cd b9 90 a6 46 ad da d0 08 d8 3c 11 d1 ce 80 8c 4a d3 80 66 9c 8b fa 13 15 68 75 90 f5 a6 e4 f0 b6 62 75 61 e1 a6 28 7b b3 32 80 b0 5e 4f 46 ce a8 b9 a6 ab 05 b6 c1 ba bf a3 d4 f5 ae f4 c8 3d d5 8a 40 9d a8 3e d6 90 b5 51 85 19 35 72 b2 d2 8d 6a 95 e4 79 d7 e9 1d 2b 35 9d 19 36 87 02 00 0b 40 df 6a a7 28 4a 52 e0 e4 b1 a3 6b c5 f5 c5 d9 00 bd 94 56 44 f9 9a 06 f5 96 00 56 0f 46 76 fb cb d2 ee 80 13 3a 9c 72 de aa 4b Data Ascii: "(4@V6V\azT&s@v0cx[-B@HTFJ5b3t~U}*$0iyKzMt,rc!F<Jfhubua({2^OF=@>Q5rjy+56@j(JRkVDVFv:rK
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 59 c0 93 84 bf f5 22 ec 10 e9 a8 38 a9 72 95 ba a0 c2 3d 3c 91 bb e5 c7 10 1f 65 42 87 41 8d e8 41 e3 98 a4 5e 73 da 18 0a d0 19 74 9b 3b 43 aa 49 a0 4e c6 f5 99 82 28 08 c3 9d b9 05 6c 8c 5e 7e 01 86 8f 5e cf 4d 17 2c ed 9e bd 36 f6 dd e9 be 56 57 7b 4d 75 4f 40 e8 99 7c 48 c7 60 d4 f8 6a 86 9a c6 d1 bc be 45 7c 35 84 92 33 04 39 04 43 43 ae b1 fa 9a 1a f1 3c 39 4e 86 77 d4 57 c1 50 61 07 2d d8 ae da e7 a5 ad 30 c8 2c 6c f0 4f ce a9 b7 14 77 bc c4 df 28 29 04 61 40 87 1a 38 b1 5c 0d 46 d3 40 36 b9 e6 5f 48 b2 ee 0d 15 5b 3d 31 53 31 ed 33 b5 28 24 dd c5 5b 07 d7 99 d5 ba be 1e b4 0f dc 83 c3 41 7c 08 3b a4 1e 0a 0f 37 a9 a1 63 e1 e0 b3 e0 c0 95 77 91 48 45 d0 6b df e6 eb b4 cb 67 b5 c3 d7 6e bb cf 6e 9b af eb 98 3f db d1 96 39 75 5c 83 e7 2a 77 92 22 d7 Data Ascii: Y"8r=<eBAA^st;CIN(l^~^M,6VW{MuO@\|H`jE\|539CC<9NwWPa-0,lOw()a@8\F@6_H[=1S13($[A\|;7cwHEkgnn?9u\*w"
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: b6 12 a2 8c ae e4 98 70 9f 47 cd 4c 9c 6c 54 3d fe 5e a9 f3 20 d3 6b ab 02 0a 6b fe ae d6 d9 b0 47 25 43 51 52 2c a9 eb 79 ef 0b 45 b6 d8 ae d2 83 e8 dc 8f 4d 86 28 ea 68 c6 e6 a7 31 50 c5 a3 cc a9 65 ed 27 1e 9c 01 ed a8 5b 4d 67 41 33 b0 84 5b e5 b9 c6 2a 1f 0d c0 34 81 89 0a 1e 0e ac 0a be b0 26 23 49 35 32 2b 12 aa f8 05 f5 95 f9 0c 3e f1 41 f8 bd 98 d5 62 a0 1a 12 66 2b df 1e 1a 4b 06 c3 70 09 2e ed 2d a1 ca 82 0c a1 86 92 81 25 3d 21 08 14 d8 42 cb 52 f8 bf 33 95 6f 5e 82 cf 9a a4 20 1d 7d 22 4c 4b d2 64 dd 89 c1 78 e3 ae ae 66 a6 c1 ad 2e f2 9b 99 01 b9 24 fe 2e 53 d7 06 6c fe fe 86 69 8d 9d a8 16 72 93 4d d5 32 33 12 5a c8 20 0e 02 10 ea f4 ed a5 a0 72 19 55 32 f6 4e cb 28 31 67 50 eb b4 b9 cb 4c 51 d2 2c 3f fd 21 4a 9f 6b 9a 6c 04 09 19 19 18 08 Data Ascii: pGLlT=^ kkG%CQR,yEM(h1Pe'[MgA3[*4&#I52+>Abf+Kp.-%=!BR3o^ }"LKdxf.$.SlirM23Z rU2N(1gPLQ,?!Jkl
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 4b 27 40 51 06 96 e6 fc 07 e3 b5 da 5d 75 0e e8 15 af bb 4b 5b b9 f2 4d b7 6a 4f d7 d5 9e 21 1e 22 09 58 d9 7f 60 4e d5 3a c7 c4 ae 4b b3 36 d3 34 a3 f1 2d 2c 62 12 85 b5 e5 a4 5f 9e 75 61 9c 24 0d e4 64 dc 67 db 91 96 37 4b 31 d4 72 40 d1 00 48 2a 65 46 c9 a8 a4 df 39 78 6b cf ca a7 b1 47 d1 03 63 8c 6e db 94 4a ef 9e 4d 7b f6 47 df 7c ef 7a 9b 1f 29 35 c0 bd 7b 94 aa ce c8 99 3d a9 b7 ec b6 a5 e6 9c 48 ff 7f 8c 46 e0 59 b6 51 21 1c ef 4e 70 ca a3 6f 19 8e 59 42 84 6d db 4c 69 6f e0 6b 19 52 df 2c 33 5b 0c e9 23 99 67 2d bf 7f e7 aa 53 78 10 88 a1 44 e0 55 94 40 45 bd f9 fb c3 7d c0 8d 3d e0 a5 30 c6 49 61 0c 66 7e 5f ca 1c 62 39 9f d2 1c b9 9f 2f 59 76 4a 98 09 04 ae c4 1f 01 60 10 67 54 28 e6 f5 02 0a 3c 68 30 9e 29 44 b4 9c 20 12 84 74 84 b1 1b ca 1d Data Ascii: K'@Q]uK[MjO!"X`N:K64-,b_ua$dg7K1r@H*eF9xkGcnJM{G\|z)5{=HFYQ!NpoYBmLiokR,3[#g-SxDU@E}=0Iaf~_b9/YvJ`gT(<h0)D t
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 3a 2b 4b e8 3e 55 4a 50 52 6d dd 8d 7e 5f 9f 2f 13 fe 50 17 4b 3d 6a 5f 7e c8 14 53 26 cd 37 7f 80 b9 cf d5 11 78 c4 f9 04 c1 87 e0 32 ac ab 49 5b fb c3 91 3b 16 07 e4 45 aa 9a 70 cc 2d 66 05 a3 3c 55 f7 c0 c9 23 4f 6d 7f 69 0b b9 2e 7b e1 67 4b 28 d6 79 0d 34 37 93 a0 a2 b5 82 85 a8 d8 d3 d7 fb 99 cd cc d8 10 50 c9 10 3f 23 3a 05 2b e7 4b 2b 8b c3 16 bc bb a6 c1 69 94 e8 bc 36 bc 25 b6 7c bd 63 f0 b1 f1 db 4e fa e8 b9 dd ac ab ca ab 36 62 bd 6d a7 6c 8e 33 9d 1b bb 1e 3d 48 18 9f 79 6d f6 72 15 73 db 66 b3 14 2f 42 ad dc b7 04 5b a8 d2 39 21 55 c5 48 b8 95 2d 9b 78 e0 a3 d2 d0 4b 61 ae a9 08 39 22 20 ea df bc 7e b8 fe a4 c7 73 b5 63 74 43 e2 d0 8b 65 ac e5 38 fc 19 2d 14 a2 16 05 d1 dd e0 bb 70 df 17 fc be a2 5f 6e 9f 8d f7 96 d2 65 e7 fc 50 40 32 f3 57 Data Ascii: :+K>UJPRm~_/PK=j_~S&7x2I[;Ep-f<U#Omi.{gK(y47P?#:+K+i6%\|cN6bml3=Hymrsf/B[9!UH-xKa9" ~sctCe8-p_neP@2W
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 74 f2 c8 ff 10 50 7b a8 ea d0 8e 53 f3 4e fc 57 b4 7a 77 e5 ee 1d 53 bf 5e 53 07 af 2f 79 99 b2 67 67 4f 63 cf 8e 7b a2 3c ad 49 c2 27 ff 10 fc 73 76 c9 bb 4a 3c 62 71 c9 ff 5b 8a eb 97 95 cc 08 82 43 eb f9 34 53 8d d7 b6 1d f5 11 27 3d 94 8e fe c8 60 7b 40 8d d7 44 e3 bb ef c2 59 a2 83 a4 c7 4b 34 8f 49 07 17 b2 e0 77 c1 e7 f5 d9 cc 59 30 63 d8 77 0d f9 d1 92 47 e4 ef 23 f3 ff 42 99 5c 99 8c cb 95 53 7f ff ab 17 14 ad f1 18 cf 04 68 49 67 4a af 35 e7 63 59 d1 45 ad 6b e3 6a 5a d4 2f 54 2c 9a f4 de f9 c7 ed 0d b7 7e 14 3c e3 b2 d2 75 8f bf 78 c7 f9 09 4e 99 e8 2f f4 5f cb b7 3a 0b e8 ef 6e b9 53 df 88 d3 95 2f 4c 5a e8 09 5a c2 27 b2 58 0c 5b 80 2c a7 3a b3 8b 42 2e 7b 06 b6 c1 83 3e 55 1f bc b0 60 d9 22 22 ae 28 03 dc 9d cc 74 ad c9 a2 52 6b 3b 55 aa ce Data Ascii: tP{SNWzwS^S/yggOc{<I'svJ<bq[C4S'=`{@DYK4IwY0cwG#B\ShIgJ5cYEkjZ/T,~<uxN/_:nS/LZZ'X[,:B.{>U`""(tRk;U
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 36 b8 b5 b7 77 70 4b 6c fd 21 17 23 e0 6e d4 07 63 2f e0 ab 59 da 79 c0 5c a9 17 b7 37 1c d8 df 10 da 7f e0 43 19 f9 86 fb cb 0d 9b f2 16 3f b0 76 e0 22 3d 65 17 d5 18 1e c4 83 f7 58 9e 06 d2 d4 02 f8 fa da 31 68 8c 01 e2 c0 62 cb 41 92 b8 10 fe 87 a5 00 9d 12 cb 5c f9 60 51 ab 5e ca 39 fc 89 59 4b 99 ed be 13 69 80 6f 5e f7 e7 cd 00 e2 12 e6 36 4f 0e f8 b6 19 9a d7 e0 33 8b 04 9e 6e 86 99 fd c2 16 f5 ca 42 97 45 ea 2f 98 39 c0 b9 bb 66 e4 e9 9d 85 58 b9 42 ab 9e 99 3c 36 b6 77 72 1b b7 1b 19 6f 00 4f 62 8f 63 60 78 ba 14 c3 30 d0 d2 e1 a2 53 c0 22 55 0b c6 6d 5d 16 87 a7 d3 0c 8c 52 0c f0 38 ba 1c 9d 1d cb 2b 29 a1 e5 cb 3f c9 c6 aa 0e aa 7b 14 8f 06 97 45 3d d3 3e d3 fc d5 42 83 af 44 52 50 22 2d 2b 29 90 c8 4a 4a b5 e9 40 c6 3d b7 f0 03 74 69 e1 7c 70 Data Ascii: 6wpKl!#nc/Yy\7C?v"=eX1hbA\`Q^9YKio^6O3nBE/9fXB<6wroObc`x0S"Um]R8+)?{E=>BDRP"-+)JJ@=ti\|p
2025-01-15 16:42:41 UTC	1378	IN	Data Raw: 13 28 a7 c2 bd 71 72 c9 59 e2 fd 93 d4 c1 66 3e 63 0b 7b fc 52 9e 4b 55 26 f1 ae de 75 c1 66 3e 73 8f 7e cf 4f 64 b0 99 cf dc 93 95 3d ca 21 d2 c6 7d 2e d9 cc 67 6c 71 4f 02 2b 74 3e d8 cc 67 ee c9 5a 57 d7 82 7b 44 a4 7b 37 6b 7a ee aa 34 fb 47 df cd d1 16 5b 1e cf ea 9d 41 2a c6 b3 c3 63 be d8 3e 2f 61 bb db 32 17 ab bb c8 eb a8 63 52 f6 a7 43 66 3c dc 1d ef 21 ba ae b0 9f 7d 7c c1 e7 6c 77 5b 04 54 5a 16 0f d8 09 b2 9f 7d 7c c1 e7 73 6d 99 ae cb bc 56 da 71 bd c4 bc 48 c1 88 b8 5b 6b 0b dd 52 69 76 b3 8b fd ec 1b 2f 1e 8e ae 0a 66 07 7c 3d 3d f1 71 55 58 16 61 d6 a5 ae 98 75 35 84 7f d1 c3 40 44 38 8c c2 25 59 6a 32 93 f9 22 57 90 e5 a6 50 e9 b9 36 cb 7d 8d c6 92 63 1d ed de a3 47 e9 d8 d0 c2 cf 83 e6 60 c8 cf 03 ef 51 4e 9f e5 15 4e 37 17 e7 da 36 a4 Data Ascii: (qrYf>c{RKU&uf>s~Od=!}.glqO+t>gZW{D{7kz4G[A*c>/a2cRCf<!}\|lw[TZ}\|smVqH[kRiv/f\|==qUXau5@D8%Yj2"WP6}cG`QNN76

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49748	151.101.1.16	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:42 UTC	375	OUT	GET /images/S/sash/mPGmT0r6IeTyIee.png HTTP/1.1 Host: m.media-amazon.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 16:42:42 UTC	683	IN	HTTP/1.1 200 OK Connection: close Content-Length: 27972 Content-Type: image/png X-Amz-IR-Id: b50f00c1-d1a8-4501-938e-463637a9b735 Expires: Mon, 06 Oct 2042 06:55:14 GMT Cache-Control: max-age=630720000,public Timing-Allow-Origin: https://www.amazon.in, https://www.amazon.com Access-Control-Allow-Origin: * Last-Modified: Tue, 17 Nov 2020 23:31:33 GMT X-Nginx-Cache-Status: MISS Accept-Ranges: bytes Date: Wed, 15 Jan 2025 16:42:42 GMT Age: 1913240 X-Served-By: cache-iad-kjyo7100113-IAD, cache-nyc-kteb1890031-NYC X-Cache: HIT from fastly, HIT from fastly Server-Timing: provider;desc="fy" alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 02 ee 08 03 00 00 00 b7 a1 b0 d2 00 00 02 fa 50 4c 54 45 00 00 00 2a 41 43 2e 33 38 1f 27 30 22 29 30 21 2a 22 4e 54 5b 07 09 0b 00 00 00 33 33 33 10 11 13 03 04 04 12 14 16 06 07 08 64 69 6d 2f 38 40 2f 38 41 60 67 6f 57 56 53 1f 20 21 03 04 05 51 56 5c 05 06 06 62 65 6a 65 65 65 3e 41 43 93 94 95 06 08 09 5b 62 6a 7d 82 87 50 57 60 59 74 53 08 0b 0e 08 0a 0c 00 00 00 08 09 0b 6d 77 78 6a 70 76 04 05 06 4d 53 59 60 66 69 3b 3d 40 4b 52 5b ff ff ff a8 ab af 5f 64 69 10 10 10 04 05 05 64 6a 72 9a 9b 9c 88 8d 92 c2 c5 c6 cd d0 d1 f6 f5 f4 0f 12 15 d6 d9 da eb ed ed b8 bb bd e5 e7 e7 fb fb fa dd de de b0 b2 b5 56 5d 65 dd 8d 1c e7 75 00 de 82 19 cb 38 2c 33 9b c5 21 8d bf 32 87 a9 3a 81 be e7 Data Ascii: PNGIHDRPLTEAC.38'0")0!"NT[333dim/8@/8A`goWVS !QV\bejeee>AC[bj}PW`YtSmwxjpvMSY`fi;=@KR[_didjrV]eu8,3!2:
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 7c 08 23 55 bd 8f e1 7c c8 70 fb 74 24 64 38 a9 10 ce 14 37 32 ca 7d 1c c8 ed 5a 08 90 82 51 03 2d 93 d3 f9 e9 c9 b8 ab 74 9a bf 15 7e 69 78 26 d9 94 55 2d 11 e2 71 1f 55 e8 23 66 c5 a8 98 00 d2 88 81 3e 62 98 1d f9 c2 6c 42 21 68 64 22 37 97 1b e3 3e 12 08 91 53 56 8c 10 32 cc 87 5a 16 37 29 60 98 40 9b 74 5e 80 57 13 4c 59 55 1b 6c 70 fe 67 3e 28 8d c9 10 4e 95 0b a9 42 3f 88 19 72 1e 65 9c 83 da 28 16 75 a2 9b b2 54 54 23 e8 63 fb 85 fc 24 99 3c 84 d7 7b 5c 65 f9 9c 1a 24 c7 ce b8 be 1f 78 04 4a da 1a a2 64 48 9f 84 1c 9e 9f 5f c8 2d 2e f1 59 6b 7e 7e ff 36 21 63 63 e3 ac 5e d4 0b 91 6b 3a 59 d4 e3 8d e8 7d c8 1a 32 93 cf cf 74 5d 43 aa 9e 57 86 6c 16 c0 f3 3c 07 da 38 4e c9 6f 50 48 4a a9 e1 37 dc 86 ef 5b e5 c6 b6 55 16 c1 55 56 d2 1a d2 53 86 d4 99 Data Ascii: \|#U\|pt$d872}ZQ-t~ix&U-qU#f>blB!hd"7>SV2Z7)`@t^WLYUlpg>(NB?re(uTT#c$<{\e$xJdH_-.Yk~~6!cc^k:Y}2t]CWl<8NoPHJ7[UUVS
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 6b 77 99 a0 b9 b6 b6 e5 e6 ee b5 2e 33 c4 b5 35 19 72 22 4e 08 4f 82 8e 42 f6 b3 95 fd e1 0f c9 ad 32 16 15 e2 e1 a0 da 7c 3c 1d 14 52 20 e1 71 c5 26 dc 91 85 a3 5d 02 cc 07 40 ec 0a 7e 56 6a 18 e4 32 2b 14 53 ac 8a 5a 30 41 9e 80 e0 c9 d7 29 72 23 f2 81 3a a9 4f 91 17 2f 19 f2 f2 05 74 c2 2e 6e 20 45 3b a9 0f d2 92 f5 fc ee dd e6 56 65 6f 91 5e 7c c4 0a 59 64 2b 9d 84 ac 2e e4 90 05 29 04 21 26 01 a0 6d 21 55 80 00 e7 2f 6e 2a c0 30 00 38 98 40 22 77 2b 26 fe 16 0f 80 62 b6 14 84 9c d0 19 5f 5f 39 20 70 f8 5a 0b 24 7c 7d f5 02 04 2f f8 bb 01 95 0b ef 19 f2 fe 02 74 e2 c9 c7 0d e4 e3 93 84 3e e0 d2 65 a6 e3 f2 a5 6e 6a ba ab af 20 f1 42 8e 2f b3 45 bd 90 e3 f3 39 64 94 6d 13 02 4e cd 72 8d b6 10 1b 20 8b a3 5d c6 71 06 a8 66 c2 b0 10 e2 89 ca 22 2a 46 25 Data Ascii: kw.35r"NOB2\|<R q&]@~Vj2+SZ0A)r#:O/t.n E;Veo^\|Yd+.)!&m!U/n08@"w+&b__9 pZ$\|}/t>enj B/E9dmNr ]qf"F%
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 85 06 b2 76 c6 2f ef dd 67 66 5d d6 b3 bb 53 a2 3b c2 ac 4d f2 b3 64 d5 77 74 35 6f 5a a3 be e3 92 d1 dc 2d 65 4f 42 9a 34 61 cc 00 7c 7d ec 83 3e 57 1f ed 96 b6 6c a3 b4 57 df 65 b0 7b d7 c6 64 59 a0 3d 04 e0 8a 47 2d d0 98 37 7d 4e ba 11 e2 63 dc 42 7c 23 33 c4 c7 98 85 f8 46 88 8f b1 0b f1 8d 30 1f e7 5a 88 bf 47 84 08 c9 84 c6 2b c4 87 08 c1 f4 97 be 90 73 25 04 95 ab 13 27 e4 f9 87 31 1a 21 8c 4c 68 c2 84 e0 87 31 32 21 98 f2 85 88 30 99 3d c4 17 22 3a 86 f8 42 26 71 96 e5 0b 19 7f 1e e2 0b f1 33 75 5f 88 2f c4 17 e2 0b 19 0b be 10 5f c8 18 2a e2 26 43 c8 4a 26 b3 82 a8 a6 93 4a 6a 05 93 ec 60 c4 22 b1 7e 24 cd 48 22 2a a9 38 22 26 d3 6a 3a a5 20 e3 53 2d bf fb ff 26 16 19 61 60 84 31 03 9b 09 88 46 12 00 29 4c cb 00 30 ad 60 08 18 41 4c 45 d9 d9 0a Data Ascii: v/gf]S;Mdwt5oZ-eOB4a\|}>WlWe{dY=G-7}NcB\|#3F0ZG+s%'1!Lh12!0=":B&q3u_/_&CJ&Jj`"~$H"8"&j: S-&a`1F)L0`ALE
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: df 75 c8 5a 80 75 88 5e 48 45 ba b8 94 bc 79 a8 90 7f bf 7d 12 21 c8 5a f0 e1 15 22 7c 57 ea 82 42 46 f8 ae d4 45 c0 95 ba 26 42 7e 99 1a f9 fa 60 21 7a 23 81 85 28 23 15 ff bd ac a1 cf 2e d1 90 c2 42 f3 31 82 ec 65 e9 85 ec ee bf 91 58 6c 64 f7 d9 85 00 3f 21 62 e0 d9 47 1d 08 0a 0b ed c7 08 be db ab 2f ea 3b 2c 64 e7 99 52 96 5e 08 19 9e 93 06 83 42 46 ff 31 f4 e7 21 01 84 ec a2 88 3c 5b 51 d7 9f 18 9a 83 b9 b3 b8 81 49 a1 a2 ff 18 fa 13 c3 00 42 c0 d7 07 17 11 fa fe 0c fe 50 f1 39 53 1f d0 0c c6 70 e6 b4 7a 18 7e 7c e8 3f 86 fe 4c 3d 90 90 37 97 92 2b 3d f4 fd 31 06 3e 77 9d 0c 0c 9a 45 98 c3 81 bc 9f 63 30 34 05 85 8f fe 63 e8 ef 3a 09 22 e4 e8 d2 e1 59 84 90 61 7a 31 3c 73 61 38 fd 4f a5 e3 d7 eb 5f c9 9f 90 3e c6 7c c6 66 19 0d 0b 3e 1a 96 65 35 ae Data Ascii: uZu^HEy}!Z"\|WBFE&B~`!z#(#.B1eXld?!bG/;,dR^BF1!<[QIBP9Spz~\|?L=7+=1>wEc04c:"Yaz1<sa8O_>\|f>e5
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 85 1c 74 ab 2a 61 9d fe c3 e2 30 40 54 8c c6 16 87 06 fb e8 b3 9d 31 37 f6 46 6c a9 6e b3 03 78 90 de 38 64 fa aa 13 86 6c 0a c0 ca 12 0c ac 94 e2 1a 21 2a 1a d2 2b a5 f4 44 42 41 f6 18 b3 42 54 f1 29 f9 0a 51 46 be f8 f8 68 6e 6e 92 3f 3f 36 5a fd c7 0b 81 8f 4f 15 35 ac 43 2c 13 68 72 29 ef 36 a9 d9 66 1f b5 b1 1b 06 98 ed 26 21 5f 71 ab ce 0d da e6 47 ee b8 c1 48 0b 65 1d 51 32 e9 44 23 d0 55 16 13 13 44 31 9d 10 19 0d ab b3 35 c4 48 ab 49 77 5f 5e d6 47 08 8c f8 f8 a0 cd 9f de 92 3f ff 6b 7c fc f8 68 21 ca 87 4e 88 37 53 75 2e e8 18 3e 60 e0 e6 e6 c6 1e c9 09 46 ea b2 b7 47 a3 7e 1d 0d 9b a7 bd c5 aa d0 d8 63 0f 82 a3 44 a0 93 3b b6 c9 e6 06 3d 9c a4 f2 40 2b 3a 21 79 d7 83 8a 10 15 5c a5 f9 37 52 61 93 bb 5f 08 65 bf 28 1f da 9a ae d6 e9 8f 4f 59 ca Data Ascii: ta0@T17Flnx8dl!+DBABT)QFhnn??6ZO5C,hr)6f&!_qGHeQ2D#UD15HIw_^G?k\|h!N7Su.>`FG~cD;=@+:!y\7Ra_e(OY
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 6a 63 a9 17 47 47 29 db 9e 6f 03 d1 c0 ac d7 4d d0 7c 10 4a 51 5b ca e2 65 f3 78 33 26 c6 e3 00 a3 20 58 b2 0b 90 fb 7d 06 89 4f 4c c4 2f 06 e2 02 cf fd 00 c8 3d 53 21 0a 07 49 aa 6a 92 dd 5f 54 0f 64 5b cc 87 6e 00 80 63 89 19 41 90 97 63 92 df d8 4b 0f e4 f6 6a 35 d0 23 6f 3e aa af 52 8f 8f 1a 8d 46 b5 35 23 cc 83 4a 88 57 89 95 ad 61 d9 2c f5 38 3e 5e f2 e6 e3 80 a6 51 10 6c e1 a3 20 23 85 c9 0f 81 e8 46 5e bf 14 90 b1 6b 8a 72 ad fb 9d 8e f0 10 22 21 90 39 02 98 37 21 88 b0 b3 80 ef 80 ca bb c3 de 63 54 b0 c0 d0 75 3d 0f 06 7e 7d 97 81 a0 c8 78 c0 43 66 92 38 1f 8e e1 80 b3 6c e0 9f 2a f6 37 fa 53 3b 45 31 0c a3 d1 78 61 63 77 3d 90 3a d9 f7 82 3a 07 19 db 3c ae 61 9b 38 27 c7 58 56 62 55 18 04 80 c9 5e 2b 02 a4 09 a2 66 10 a4 50 28 84 41 74 0b 2d 2c Data Ascii: jcGG)oM\|JQ[ex3& X}OL/=S!Ij_Td[ncAcKj5#o>RF5#JWa,8>^Ql #F^kr"!97!cTu=~}xCf8l*7S;E1xacw=::<a8'XVbU^+fP(At-,
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 46 d7 2f 00 c2 39 3a 4f c8 d3 3b bb 54 63 a7 c5 21 66 e4 7b ab cb d3 5e 11 dd 13 e2 fd ea fc d3 de b7 08 62 ae f9 fd 59 f2 8a 6d 8a 43 93 e0 69 2f f6 c9 9d f6 0e df 08 82 dc 18 fe 9f 3f 0f 11 20 15 a9 53 77 ef d2 13 df 1f f0 d3 8c 6e 7b f0 10 ff 46 6a c7 cf 43 de ae 2d b6 81 bc dd f6 1f 5c b2 c5 25 29 5c 72 b6 52 a9 7c 52 9f 87 88 47 5e 1f 44 3c fa 46 0d a8 98 9c 00 de c4 04 f0 12 72 4c 8a 1a 54 71 64 08 37 11 8d c8 c0 1a bb aa 40 f8 96 05 ca d5 31 29 6a 30 5d 99 82 30 08 36 75 45 8a 1a 48 e3 a3 f0 c1 fc 0f 46 a2 72 ef 82 e5 24 6c fb 97 5f db fb 65 bb a7 1f 83 bc df 8d a1 08 42 f4 2e 9c 84 05 3d 50 a4 47 7b c2 11 38 a7 91 8e bb c3 08 e4 d7 70 52 4f 92 a7 e1 9c a6 e5 48 c2 07 69 ba 00 e0 9e bd 0f 52 ae ef f7 14 64 7d 58 3e a7 e1 68 42 7c 90 53 e0 35 c3 20 Data Ascii: F/9:O;Tc!f{^bYmCi/? Swn{FjC-\%)\rR\|RG^D<FrLTqd7@1)j0]06uEHFr$l_eB.=PG{8pROHiRd}X>hB\|S5
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: fc 51 8d 6b b1 b1 6d 63 eb ae 73 db 57 bb ea 6c 57 db 76 8a b4 19 6d bb b5 f5 6a b4 dd 68 eb d6 da f5 34 47 f0 27 b9 16 ab a9 c3 b8 b1 d6 ae ad 4b 32 25 3a b6 b6 5e 5b 3b 76 76 b3 b6 1b 74 76 3c ba 42 6e de 21 f8 a3 5a eb 74 d3 79 b3 ed 6c 3b 95 d8 d8 23 5a 3b 6e 6d fd 6c ed 76 3a a6 2b 77 1a 6d e7 d2 e0 2d db 6e eb 5f 83 0f ec 58 75 dd 6e 56 5b 5b 03 d6 8e 4d b3 ea 6c e3 f6 a9 8d 5d cf 5b 15 8e ee ea e8 62 b8 39 de d2 7d 6b b7 d8 b6 df 3a dc 2e 58 db f6 74 5e 03 b5 ed 8e dd 29 06 5a db 4c 09 d6 d6 b6 d6 5d 4d 31 ec 34 3f e2 2d ae 45 db b4 ae 4a 70 bb d6 6e e6 73 dd 00 63 5b b7 e3 58 af d1 d5 cd b6 6e 9f eb 7a 35 d6 dd e6 74 35 cf f1 ae 22 df 42 8f 7b d2 4c 41 1a 04 f7 22 dc 21 f7 22 3c 43 ee 40 f8 29 eb 0e 84 cf 21 ff be 20 08 82 80 20 f8 0a 85 f6 04 52 Data Ascii: QkmcsWlWvmjh4G'K2%:^[;vvtv<Bn!Ztyl;#Z;nmlv:+wm-n_XunV[[Ml][b9}k:.Xt^)ZL]M14?-EJpnsc[Xnz5t5"B{LA"!"<C@)! R
2025-01-15 16:42:42 UTC	1378	IN	Data Raw: 0c 66 f3 13 7c 33 cf e1 41 6f c9 cf 8b 17 93 e3 97 ac 16 66 eb c5 dd 18 bf 30 58 2d 67 ab c5 47 21 2f 50 e5 f9 d3 e4 1f e4 62 79 bf 5e ce ee 2e 1a 2b e3 8b d5 c3 f2 fe db 0a 8b 3b 1c 4b 34 3d 9b 46 87 07 ef ae 90 d3 f3 75 b1 be f7 cc e7 f3 e6 7d b9 1a 63 3c c3 5f e4 83 f1 dd 83 df c7 ef d7 f3 e5 c3 ff d9 3b 03 ce 46 82 28 8e bf 00 70 9f a0 5f a1 60 50 d0 52 b5 10 82 19 b0 2c 80 23 0a 3c 15 a3 74 da 26 95 95 ec 21 c0 ee 17 98 19 6e 3e cc ec ce 7d a4 7b b3 bd 8b b4 36 d4 6a 93 bd 93 9f 6c de be ff 03 f6 e7 99 15 c8 fc 06 4e 9c f8 e7 29 d6 67 3b ac 8b be f9 89 4f 62 7d 75 be c3 d5 ba 6f fe bf d3 84 0a 0e c2 d9 f9 1b ce 7a e4 03 e3 fb 0b 7c 01 75 c8 4f 42 7a 31 57 4f f0 39 08 01 55 15 6b fc 88 d7 ef 18 b4 21 54 85 38 96 90 6c da 9d 2f 4b ca 87 e7 43 fd 94 84 Data Ascii: f\|3Aof0X-gG!/Pby^.+;K4=Fu}c<_;F(p_`PR,#<t&!n>}{6jlN)g;Ob}uoz\|uOBz1WO9Uk!T8l/KC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49747	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:42 UTC	734	OUT	GET /arahmataAngin/assets/images/favicon.ico HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:42 UTC	921	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:42 GMT Content-Type: image/x-icon Content-Length: 17542 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2087 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kisDJst29JkW4CXgJoaJFvvbptXn3rw1occ6Gq2Z%2BjjPd8PN4ao9chJI3CApEzTUlf2FzT9XloGYB1CeJJV3dmStF4IOWPI1I620oGFyybyiOEYSP%2FV1KhkHYpwl8QIwn6So%2Bi%2BE2wbJ7xFwRUKhCevA%2BDOBiYzV3rStJskbsGFQhq5a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9027520e7f8a5790-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8189&min_rtt=8183&rtt_var=3082&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1312&delivery_rate=354454&cwnd=32&unsent_bytes=0&cid=23aeef0322aebb25&ts=158&x=0"
2025-01-15 16:42:42 UTC	448	IN	Data Raw: 00 00 01 00 04 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 ee 25 00 00 18 18 00 00 01 00 20 00 88 09 00 00 96 36 00 00 10 10 00 00 01 00 20 00 68 04 00 00 1e 40 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 80 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 45 ff ff ff 99 ff ff ff cc ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 00 %F % 6 h@(0` %E
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b7 ff ff ff 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 42 ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d7 ef ff ff bb e4 ff ff 90 d5 ff ff 91 d5 ff ff 72 ca ff ff 50 be ff ff 82 cf ff ff 91 d5 ff ff 9f d9 ff ff cb ea ff ff f2 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ed ff ff ff 39 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 2d ff ff ff f0 ff ff ff ff ff Data Ascii: BrP9-
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f9 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d8 f0 ff ff 13 ad ff ff 00 a7 ff ff 00 a7 ff ff 72 c9 ff ff e5 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f2 fa ff ff 90 d5 ff ff 13 ad ff ff 61 c3 ff ff ff ff ff ff 13 ad ff ff 13 ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bb e4 ff ff 13 ad ff ff 00 a8 ff ff 72 c9 ff ff e5 f4 ff ff ff ff ff ff ff ff Data Ascii: rar
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bd bd bd ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff a2 a2 a2 ff 32 32 30 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 44 44 43 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 31 31 30 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 Data Ascii: 220DDC110
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff 94 94 93 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 76 76 76 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 b1 b0 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 1d 1d 1c ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: VVUvvvVVU
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff f2 f2 f2 ff 76 76 76 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e6 e6 e6 ff a2 a2 a2 ff 55 55 54 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 Data Ascii: vvvVVUUUT
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d9 d9 d9 ff 1d 1d 1c ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 94 94 93 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e6 e6 e6 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 04 04 03 ff 31 31 30 ff b1 b1 b0 ff cc cc cc ff cc cc cc ff 94 94 93 ff 1d 1d 1c ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff cc cc cc ff ff ff Data Ascii: 110
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: 56 56 55 ff 94 94 93 ff cc cc cc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f0 ff ff ff 27 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 4b ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: VVU'K
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e5 f5 ff ff ae e0 ff ff 91 d5 ff ff 50 be ff ff 50 be ff ff 51 bf ff ff 62 c4 ff ff 90 d4 ff ff bc e5 ff ff f2 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c3 ff ff ff 03 ff ff ff 75 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ae e0 ff ff 3d b8 ff ff 00 a8 ff ff 00 a7 ff ff 00 a8 ff ff 00 a7 ff ff 00 a8 ff ff 00 a8 ff ff 00 a7 fe ff 00 a7 ff ff 00 a7 ff ff 00 a8 ff ff 72 ca ff ff cb ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 66 ff ff ff d2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: PPQbu=rf
2025-01-15 16:42:42 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bd bd bd ff 05 05 04 ff 04 04 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 76 76 76 ff ff ff ff ff ff ff ff ff a2 a2 a2 ff 05 05 04 ff 04 04 03 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 32 32 31 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 94 94 93 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff 67 67 66 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff b1 b1 b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: vvv221ggf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49753	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:43 UTC	465	OUT	GET /arahmataAngin/assets/js/jquery.validate.min.js HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:44 UTC	924	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:43 GMT Content-Type: text/javascript Content-Length: 36756 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2089 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vlRMIIK11FpJzbg0aKprOfyJ4GiS8ZE%2F5Wfb%2FHu0W2di5vuttaGR8oNrNo2at5Irm7p0NOjHCTTEGSwX1ACqM17SrDZIvS%2FxMtR3rF2WdPHlDWiXYcAW2FU%2FtUltoYAW5bIABApnMYt8AlTKw3tiRe%2B09O8faYZUgs12k3kzCWJPFXgL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90275218dda60627-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7241&min_rtt=7233&rtt_var=2730&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1043&delivery_rate=399780&cwnd=32&unsent_bytes=0&cid=71a5a3f06befc82d&ts=175&x=0"
2025-01-15 16:42:44 UTC	445	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 56 61 6c 69 64 61 74 69 6f 6e 20 50 6c 75 67 69 6e 20 2d 20 76 31 2e 31 39 2e 30 20 2d 20 31 31 2f 32 38 2f 32 30 31 38 0d 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 6a 71 75 65 72 79 76 61 6c 69 64 61 74 69 6f 6e 2e 6f 72 67 2f 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 38 20 4a c3 b6 72 6e 20 5a 61 65 66 66 65 72 65 72 3b 20 4c 69 63 65 6e 73 65 64 20 4d 49 54 20 2a 2f 0d 0a 21 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0d 0a 20 20 20 20 22 66 75 6e 63 74 69 6f 6e 22 20 3d 3d 20 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 20 3f 20 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 20 61 29 20 3a 20 22 6f 62 6a 65 63 74 22 20 3d 3d 20 74 79 70 65 6f 66 20 6d 6f 64 75 Data Ascii: /! jQuery Validation Plugin - v1.19.0 - 11/28/2018 https://jqueryvalidation.org/ * Copyright (c) 2018 Jrn Zaefferer; Licensed MIT */! function(a) { "function" == typeof define && define.amd ? define(["jquery"], a) : "object" == typeof modu
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 26 26 20 62 2e 64 65 62 75 67 20 26 26 20 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 20 26 26 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 4e 6f 74 68 69 6e 67 20 73 65 6c 65 63 74 65 64 2c 20 63 61 6e 27 74 20 76 61 6c 69 64 61 74 65 2c 20 72 65 74 75 72 6e 69 6e 67 20 6e 6f 74 68 69 6e 67 2e 22 29 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 20 3d 20 61 2e 64 61 74 61 28 74 68 69 73 5b 30 5d 2c 20 22 76 61 6c 69 64 61 74 6f 72 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 63 20 3f 20 63 20 3a 20 28 74 68 69 73 2e 61 74 74 72 28 22 6e 6f 76 61 6c 69 64 61 74 65 22 2c 20 22 6e 6f 76 61 6c 69 64 61 74 65 22 29 2c 20 63 20 3d 20 6e 65 77 20 61 2e 76 61 6c 69 64 61 74 6f 72 28 62 2c 20 74 68 69 73 5b 30 5d 29 2c 20 Data Ascii: && b.debug && window.console && console.warn("Nothing selected, can't validate, returning nothing.")); var c = a.data(this[0], "validator"); return c ? c : (this.attr("novalidate", "novalidate"), c = new a.validator(b, this[0]),
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 20 74 68 69 73 2e 76 61 6c 69 64 61 74 65 28 29 2e 66 6f 72 6d 28 29 20 3a 20 28 64 20 3d 20 5b 5d 2c 20 62 20 3d 20 21 30 2c 20 63 20 3d 20 61 28 74 68 69 73 5b 30 5d 2e 66 6f 72 6d 29 2e 76 61 6c 69 64 61 74 65 28 29 2c 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 20 3d 20 63 2e 65 6c 65 6d 65 6e 74 28 74 68 69 73 29 20 26 26 20 62 2c 20 62 20 7c 7c 20 28 64 20 3d 20 64 2e 63 6f 6e 63 61 74 28 63 2e 65 72 72 6f 72 4c 69 73 74 29 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 2c 20 63 2e 65 72 72 6f 72 4c 69 73 74 20 3d 20 64 29 2c 20 62 0d 0a 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 72 75 6c 65 73 3a 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 29 20 7b Data Ascii: this.validate().form() : (d = [], b = !0, c = a(this[0].form).validate(), this.each(function() { b = c.element(this) && b, b \|\| (d = d.concat(c.errorList)) }), c.errorList = d), b }, rules: function(b, c) {
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 28 68 20 3d 20 67 2e 72 65 71 75 69 72 65 64 2c 20 64 65 6c 65 74 65 20 67 2e 72 65 71 75 69 72 65 64 2c 20 67 20 3d 20 61 2e 65 78 74 65 6e 64 28 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 71 75 69 72 65 64 3a 20 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 67 29 29 2c 20 67 2e 72 65 6d 6f 74 65 20 26 26 20 28 68 20 3d 20 67 2e 72 65 6d 6f 74 65 2c 20 64 65 6c 65 74 65 20 67 2e 72 65 6d 6f 74 65 2c 20 67 20 3d 20 61 2e 65 78 74 65 6e 64 28 67 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6d 6f 74 65 3a 20 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 29 2c 20 67 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 Data Ascii: (h = g.required, delete g.required, g = a.extend({ required: h }, g)), g.remote && (h = g.remote, delete g.remote, g = a.extend(g, { remote: h })), g } }
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 20 20 20 20 20 67 72 6f 75 70 73 3a 20 7b 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 75 6c 65 73 3a 20 7b 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 6f 72 43 6c 61 73 73 3a 20 22 65 72 72 6f 72 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 65 6e 64 69 6e 67 43 6c 61 73 73 3a 20 22 70 65 6e 64 69 6e 67 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 69 64 43 6c 61 73 73 3a 20 22 76 61 6c 69 64 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 6f 72 45 6c 65 6d 65 6e 74 3a 20 22 6c 61 62 65 6c 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 63 75 73 43 6c 65 61 6e 75 70 3a 20 21 31 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 63 75 73 49 6e 76 61 6c 69 64 3a 20 21 30 2c 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: groups: {}, rules: {}, errorClass: "error", pendingClass: "pending", validClass: "valid", errorElement: "label", focusCleanup: !1, focusInvalid: !0,
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 6e 28 62 2c 20 63 2c 20 64 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 72 61 64 69 6f 22 20 3d 3d 3d 20 62 2e 74 79 70 65 20 3f 20 74 68 69 73 2e 66 69 6e 64 42 79 4e 61 6d 65 28 62 2e 6e 61 6d 65 29 2e 61 64 64 43 6c 61 73 73 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 64 29 20 3a 20 61 28 62 29 2e 61 64 64 43 6c 61 73 73 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 64 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 75 6e 68 69 67 68 6c 69 67 68 74 3a 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 2c 20 64 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 72 61 64 69 6f 22 20 3d 3d 3d 20 62 2e 74 79 70 65 20 3f 20 74 68 69 73 2e 66 69 6e 64 42 79 4e 61 6d 65 28 62 2e 6e Data Ascii: n(b, c, d) { "radio" === b.type ? this.findByName(b.name).addClass(c).removeClass(d) : a(b).addClass(c).removeClass(d) }, unhighlight: function(b, c, d) { "radio" === b.type ? this.findByName(b.n
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 61 6e 20 6f 72 20 65 71 75 61 6c 20 74 6f 20 7b 30 7d 2e 22 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 3a 20 61 2e 76 61 6c 69 64 61 74 6f 72 2e 66 6f 72 6d 61 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 75 65 20 67 72 65 61 74 65 72 20 74 68 61 6e 20 6f 72 20 65 71 75 61 6c 20 74 6f 20 7b 30 7d 2e 22 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 65 70 3a 20 61 2e 76 61 6c 69 64 61 74 6f 72 2e 66 6f 72 6d 61 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 6d 75 6c 74 69 70 6c 65 20 6f 66 20 7b 30 7d 2e 22 29 0d 0a 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 61 75 74 6f 43 72 65 61 74 65 52 61 6e 67 65 73 3a 20 21 31 2c 0d 0a 20 20 20 20 20 20 20 20 70 72 6f 74 6f 74 79 70 65 3a 20 7b 0d 0a 20 Data Ascii: an or equal to {0}."), min: a.validator.format("Please enter a value greater than or equal to {0}."), step: a.validator.format("Please enter a multiple of {0}.") }, autoCreateRanges: !1, prototype: {
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 61 2e 65 61 63 68 28 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 67 72 6f 75 70 73 2c 20 66 75 6e 63 74 69 6f 6e 28 62 2c 20 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 74 72 69 6e 67 22 20 3d 3d 20 74 79 70 65 6f 66 20 63 20 26 26 20 28 63 20 3d 20 63 2e 73 70 6c 69 74 28 2f 5c 73 2f 29 29 2c 20 61 2e 65 61 63 68 28 63 2c 20 66 75 6e 63 74 69 6f 6e 28 61 2c 20 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 5b 63 5d 20 3d 20 62 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 2c 20 63 20 3d 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 72 75 6c 65 73 2c 20 61 Data Ascii: a.each(this.settings.groups, function(b, c) { "string" == typeof c && (c = c.split(/\s/)), a.each(c, function(a, c) { e[c] = b }) }), c = this.settings.rules, a
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 61 72 20 61 20 3d 20 30 2c 20 62 20 3d 20 74 68 69 73 2e 63 75 72 72 65 6e 74 45 6c 65 6d 65 6e 74 73 20 3d 20 74 68 69 73 2e 65 6c 65 6d 65 6e 74 73 28 29 3b 20 62 5b 61 5d 3b 20 61 2b 2b 29 20 74 68 69 73 2e 63 68 65 63 6b 28 62 5b 61 5d 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 69 64 28 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 3a 20 66 75 6e 63 74 69 6f 6e 28 62 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 2c 20 64 2c 20 65 20 3d 20 74 68 69 73 2e 63 6c 65 61 6e 28 62 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 20 3d 20 74 68 69 73 2e 76 61 6c 69 64 61 74 Data Ascii: ar a = 0, b = this.currentElements = this.elements(); b[a]; a++) this.check(b[a]); return this.valid() }, element: function(b) { var c, d, e = this.clean(b), f = this.validat
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 74 20 3d 20 61 2e 67 72 65 70 28 74 68 69 73 2e 73 75 63 63 65 73 73 4c 69 73 74 2c 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 21 28 61 2e 6e 61 6d 65 20 69 6e 20 62 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 68 6f 77 45 72 72 6f 72 73 20 3f 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 68 6f 77 45 72 72 6f 72 73 2e 63 61 6c 6c 28 74 68 69 73 2c 20 74 68 69 73 2e 65 72 72 6f 72 4d 61 70 2c 20 74 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 29 20 3a 20 74 68 69 73 2e 64 65 66 61 Data Ascii: t = a.grep(this.successList, function(a) { return !(a.name in b) }) } this.settings.showErrors ? this.settings.showErrors.call(this, this.errorMap, this.errorList) : this.defa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49752	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:43 UTC	462	OUT	GET /arahmataAngin/assets/js/jquery-3.3.1.min.js HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:44 UTC	923	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:44 GMT Content-Type: text/javascript Content-Length: 107631 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FZPm8vuE7qDH%2F2VURo6wDgn%2FqX%2FghGniTkXIYXM%2Bbr6stUFjgsPIKvgvWGayC4M1dtSuVSKKX4NMQy35NG%2FKOIVTY0ooX92KDVSBTLEQ%2BUCTGhP78QmsvVMlr%2FciAyniE7h3Th0ZgGUh%2Bae3w0xCVTRtIAE78FrhRP0I9OXIV8o3c3yc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902752190fd5ab3f-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13712&min_rtt=13708&rtt_var=5149&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1040&delivery_rate=212471&cwnd=32&unsent_bytes=0&cid=472f3873c405b2c6&ts=384&x=0"
2025-01-15 16:42:44 UTC	446	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 2e 70 75 73 68 2c 75 3d 6e 2e 69 6e 64 65 78 4f 66 2c 6c 3d 7b 7d 2c 63 3d 6c 2e 74 6f 53 74 72 69 6e 67 2c 66 3d 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 70 3d 66 2e 74 6f 53 74 72 69 6e 67 2c 64 3d 70 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 68 3d 7b 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 74 2e 6e 6f 64 65 54 79 70 65 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 3d 3d 3d 74 2e 77 69 6e 64 6f 77 7d 2c 76 3d 7b 74 79 70 65 3a 21 30 2c 73 72 63 3a 21 30 2c 6e 6f 4d 6f 64 75 6c 65 3a 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c Data Ascii: .push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 7c 7c 7b 7d 2c 73 3d 31 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6c 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 6c 3d 61 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 7c 7c 7b 7d 2c 73 2b 2b 29 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 67 28 61 29 7c 7c 28 61 3d 7b 7d 29 2c 73 3d 3d 3d 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 6e 3d 61 5b 74 5d 2c 61 21 3d 3d 28 72 3d 65 5b 74 5d 29 26 26 28 6c 26 26 72 26 26 28 77 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 72 29 7c 7c 28 69 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 29 Data Ascii: \|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 30 2c 73 3d 5b 5d 3b 69 66 28 43 28 65 29 29 66 6f 72 28 72 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 6f 2b 2b 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 5b 5d 2c 73 29 7d 2c 67 75 69 64 3a 31 2c 73 75 70 70 6f 72 74 3a 68 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 77 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 77 2e Data Ascii: tion(e,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2a 28 5b 3e 2b 7e 5d 7c 22 2b 4d 2b 22 29 22 2b 4d 2b 22 2a 22 29 2c 7a 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3d 22 2b 4d 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 22 67 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 57 29 2c 55 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 52 2b 22 24 22 29 2c 56 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 52 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 52 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 52 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 49 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 Data Ascii: RegExp("^"+M+"([>+~]\|"+M+")"+M+""),z=new RegExp("="+M+"([^\\]'\"]?)"+M+"\\]","g"),X=new RegExp(W),U=new RegExp("^"+R+"$"),V={ID:new RegExp("^#("+R+")"),CLASS:new RegExp("^\\.("+R+")"),TAG:new RegExp("^("+R+"\|[])"),ATTR:new RegExp("^"+I),PSEUDO:new
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 3d 30 3b 77 68 69 6c 65 28 65 5b 6e 2b 2b 5d 3d 74 5b 72 2b 2b 5d 29 3b 65 2e 6c 65 6e 67 74 68 3d 6e 2d 31 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 65 28 65 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 2c 73 2c 6c 2c 63 2c 66 2c 68 2c 76 2c 6d 3d 74 26 26 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 54 3d 74 3f 74 2e 6e 6f 64 65 54 79 70 65 3a 39 3b 69 66 28 72 3d 72 7c 7c 5b 5d 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 21 65 7c 7c 31 21 3d 3d 54 26 26 39 21 3d 3d 54 26 26 31 31 21 3d 3d 54 29 72 65 74 75 72 6e 20 72 3b 69 66 28 21 69 26 26 28 28 74 3f 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 3a 77 29 21 3d 3d 64 26 26 70 28 74 29 2c 74 3d 74 7c 7c 64 2c 67 29 29 7b 69 66 28 31 31 21 3d 3d 54 26 26 28 66 3d 4a 2e 65 78 65 63 Data Ascii: =0;while(e[n++]=t[r++]);e.length=n-1}}}function oe(e,t,r,i){var o,s,l,c,f,h,v,m=t&&t.ownerDocument,T=t?t.nodeType:9;if(r=r\|\|[],"string"!=typeof e\|\|!e\|\|1!==T&&9!==T&&11!==T)return r;if(!i&&((t?t.ownerDocument\|\|t:w)!==d&&p(t),t=t\|\|d,g)){if(11!==T&&(f=J.exec
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 69 6f 6e 20 63 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 65 2c 72 3d 6e 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 73 6f 75 72 63 65 49 6e 64 65 78 2d 74 2e 73 6f 75 72 63 65 49 6e 64 65 78 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 69 66 28 6e 29 77 68 69 6c 65 28 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 6e 3d 3d 3d 74 29 72 65 74 75 72 6e 2d 31 3b 72 65 74 75 72 6e 20 65 3f 31 3a 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 74 2e 74 79 70 65 3d 3d 3d 65 7d 7d 66 75 6e 63 74 69 Data Ascii: ion ce(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function fe(e){return function(t){return"input"===t.nodeName.toLowerCase()&&t.type===e}}functi
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 65 61 74 65 43 6f 6d 6d 65 6e 74 28 22 22 29 29 2c 21 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 51 2e 74 65 73 74 28 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 2c 6e 2e 67 65 74 42 79 49 64 3d 75 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 62 2c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 62 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 42 79 49 64 3f 28 72 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: eateComment("")),!e.getElementsByTagName("*").length}),n.getElementsByClassName=Q.test(d.getElementsByClassName),n.getById=ue(function(e){return h.appendChild(e).id=b,!d.getElementsByName\|\|!d.getElementsByName(b).length}),n.getById?(r.filter.ID=function(e
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 69 64 3d 27 22 2b 62 2b 22 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 62 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 26 26 79 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e Data Ascii: .appendChild(e).innerHTML="<a id='"+b+"'></a><select id='"+b+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&y.push("[^$]="+M+"(?:''\|\"\")"),e.querySelectorAll("[selected]").length\|\|y.
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 6d 65 6e 74 3a 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 44 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 72 6e 20 66 3d 21 Data Ascii: ment:e,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return f=!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49754	104.21.79.87	443	6328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 16:42:43 UTC	458	OUT	GET /arahmataAngin/assets/images/favicon.ico HTTP/1.1 Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
2025-01-15 16:42:44 UTC	911	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 16:42:44 GMT Content-Type: image/x-icon Content-Length: 17542 Connection: close Last-Modified: Wed, 14 Sep 2022 19:58:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XtrHNMR17bruPRE0SF89cl%2BKeyk5i5Sa5dmyWuyIjTZtp9oB5IQdtZ9dj2LY1hghFcdDP3NrywLUxSYqumse6xpQriEMxUYcIauw88Xpmzn6cE%2FiJEXyKeFvPplhENKu3pvISRh2mI6flG5R8B9%2Bc%2FOA2icVZUbs7wOjGSBGW9sy2GM2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902752191ab5aaf8-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13745&min_rtt=13737&rtt_var=5168&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1036&delivery_rate=211502&cwnd=32&unsent_bytes=0&cid=b1de2f2c80adcf8d&ts=345&x=0"
2025-01-15 16:42:44 UTC	458	IN	Data Raw: 00 00 01 00 04 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 ee 25 00 00 18 18 00 00 01 00 20 00 88 09 00 00 96 36 00 00 10 10 00 00 01 00 20 00 68 04 00 00 1e 40 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 80 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 45 ff ff ff 99 ff ff ff cc ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 00 %F % 6 h@(0` %E
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b7 ff ff ff 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 42 ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d7 ef ff ff bb e4 ff ff 90 d5 ff ff 91 d5 ff ff 72 ca ff ff 50 be ff ff 82 cf ff ff 91 d5 ff ff 9f d9 ff ff cb ea ff ff f2 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ed ff ff ff 39 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 2d ff ff ff f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BrP9-
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f9 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d8 f0 ff ff 13 ad ff ff 00 a7 ff ff 00 a7 ff ff 72 c9 ff ff e5 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f2 fa ff ff 90 d5 ff ff 13 ad ff ff 61 c3 ff ff ff ff ff ff 13 ad ff ff 13 ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bb e4 ff ff 13 ad ff ff 00 a8 ff ff 72 c9 ff ff e5 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: rar
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bd bd bd ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff a2 a2 a2 ff 32 32 30 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 44 44 43 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 31 31 30 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 Data Ascii: 220DDC110
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff 94 94 93 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 76 76 76 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 b1 b0 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 1d 1d 1c ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: VVUvvvVVU
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 56 56 55 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e6 e6 e6 ff a2 a2 a2 ff 55 55 54 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 Data Ascii: VVUUUT
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff d9 d9 d9 ff 1d 1d 1c ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 05 05 04 ff 94 94 93 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e6 e6 e6 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 04 04 03 ff 31 31 30 ff b1 b1 b0 ff cc cc cc ff cc cc cc ff 94 94 93 ff 1d 1d 1c ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff cc cc cc ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 110
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: cc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f0 ff ff ff 27 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 4b ff ff ff f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 'K
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff e5 f5 ff ff ae e0 ff ff 91 d5 ff ff 50 be ff ff 50 be ff ff 51 bf ff ff 62 c4 ff ff 90 d4 ff ff bc e5 ff ff f2 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c3 ff ff ff 03 ff ff ff 75 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ae e0 ff ff 3d b8 ff ff 00 a8 ff ff 00 a7 ff ff 00 a8 ff ff 00 a7 ff ff 00 a8 ff ff 00 a8 ff ff 00 a7 fe ff 00 a7 ff ff 00 a7 ff ff 00 a8 ff ff 72 ca ff ff cb ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 66 ff ff ff d2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff cb ea ff ff 29 b2 Data Ascii: PPQbu=rf)
2025-01-15 16:42:44 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bd bd bd ff 05 05 04 ff 04 04 03 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 76 76 76 ff ff ff ff ff ff ff ff ff a2 a2 a2 ff 05 05 04 ff 04 04 03 ff 05 05 04 ff 05 05 04 ff 05 05 03 ff 05 05 04 ff 32 32 31 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 94 94 93 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff f2 f2 f2 ff ff ff ff ff ff ff ff ff ff ff ff ff 67 67 66 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff 05 05 04 ff b1 b1 b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: vvv221ggf

Target ID:	0
Start time:	11:42:20
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:42:21
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1920,i,2890419108035875567,11107966622946554112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:42:22
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:44:02
Start date:	15/01/2025
Path:	C:\Windows\System32\osk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\osk.exe"
Imagebase:	0x7ff63b720000
File size:	653'312 bytes
MD5 hash:	745F2DF5BEED97B8C751DF83938CB418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: osk.exePID: 2196, Parent PID: 4380

General

Target ID:	18
Start time:	11:44:02
Start date:	15/01/2025
Path:	C:\Windows\System32\osk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\osk.exe"
Imagebase:	0x7ff63b720000
File size:	653'312 bytes
MD5 hash:	745F2DF5BEED97B8C751DF83938CB418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	11:44:02
Start date:	15/01/2025
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff71ebd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	Joe Sandbox AI: Score: 9 Reasons: The URL 'verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id' does not match the legitimate domain 'amazon.com'., The domain contains suspicious elements such as unusual subdomains and a non-standard domain extension '.biz.id'., The URL includes multiple concatenated words that are not typically associated with Amazon's legitimate URLs., Amazon is a well-known brand, and its legitimate domain is widely recognized as 'amazon.com'., The presence of input fields for 'Email or mobile phone number' is common in phishing attempts targeting Amazon users. DOM: 3.3.pages.csv
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	Joe Sandbox AI: Score: 9 Reasons: The brand 'Amazon' is well-known and typically associated with the domain 'amazon.com'., The URL 'verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id' does not match the legitimate domain 'amazon.com'., The URL contains suspicious elements such as unusual domain extension '.biz.id' and a long, complex subdomain which is not typical for Amazon., The presence of words like 'verify', 'secure', and 'new account' in the URL are common phishing indicators., The domain does not have any direct association with Amazon, increasing the likelihood of phishing. DOM: 3.6.pages.csv
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	Joe Sandbox AI: Score: 9 Reasons: The URL does not match the legitimate domain name for Amazon, which is amazon.com., The domain contains suspicious elements such as 'verifynwebappsecurenewaccmanges', which are not associated with Amazon., The domain extension '.biz.id' is unusual for Amazon, which typically uses '.com'., The presence of multiple concatenated words and unusual characters in the domain name is a common phishing tactic., The input fields 'Email or mobile phone number' are typical for phishing attempts targeting Amazon users. DOM: 3.5.pages.csv

Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Need help?
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Help
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Need help?
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Help
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Need help?
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Help
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Need help?
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Help
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Need help?
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Conditions of Use
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Privacy Notice
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: Invalid link: Help

Source: https://qr-codes.io/ahBobi	HTTP Parser: No favicon
Source: https://qr-codes.io/ahBobi	HTTP Parser: No favicon

Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="author".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="author".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="author".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="author".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="author".. found

Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="copyright".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="copyright".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="copyright".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="copyright".. found
Source: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signin	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /drawingsz/AHiSRb2AUu8o4_LUOezQOJL6RHRd8vT_UkeGI4mWJc3XY7rrFw6Z5t6znqT6LS8UJIULLhm5RcLFi9YFaK9wm5FFOdeAFt3A4fOi0ioQguZQj8LmvHyhcXPnrq7eY_TLGJLlrPY?key=Y8-OnGBlH3ztkqWZFlad5skm HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://docs.google.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /drawingsz/AHiSRb2AUu8o4_LUOezQOJL6RHRd8vT_UkeGI4mWJc3XY7rrFw6Z5t6znqT6LS8UJIULLhm5RcLFi9YFaK9wm5FFOdeAFt3A4fOi0ioQguZQj8LmvHyhcXPnrq7eY_TLGJLlrPY?key=Y8-OnGBlH3ztkqWZFlad5skm HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l?u=https://qr-codes.io/ahBobi HTTP/1.1Host: l.wl.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ahBobi HTTP/1.1Host: qr-codes.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://l.wl.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qr-codes.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?yyy HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://qr-codes.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/None/?random=1736959358060&cv=11&fst=1736959358060&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qr-codes.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/None?random=1736959358060&cv=11&fst=1736959358060&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://qr-codes.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signin HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/None/?random=1736959358060&cv=11&fst=1736959358060&bg=ffffff&guid=ON&async=1&gtm=45be51e0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fqr-codes.io%2FahBobi&ref=https%3A%2F%2Fl.wl.co%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1381957673.1736959358&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/css/sign-dekstop.css HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signinAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/css/style.sign-desktop.css HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signinAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/js/jquery-3.3.1.min.js HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signinAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/js/jquery.validate.min.js HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signinAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /images/S/sash/mPGmT0r6IeTyIee.png HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/S/sash/pDxWAF1pBB0dzGB.woff2 HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/S/sash/KFPk-9IF4FqAqY-.woff2 HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/S/sash/mPGmT0r6IeTyIee.png HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/images/favicon.ico HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id/signinAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/js/jquery.validate.min.js HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/js/jquery-3.3.1.min.js HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9
Source: global traffic	HTTP traffic detected: GET /arahmataAngin/assets/images/favicon.ico HTTP/1.1Host: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.idConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=qtnqs3u5lnnpvroef8p96437h9

Source: chromecache_109.1.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=None&ev=UniqodeQRScans&noscript=1" equals www.facebook.com (Facebook)
Source: chromecache_107.1.dr, chromecache_103.1.dr	String found in binary or memory: return b}QE.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),SE=["www.youtube.com","www.youtube-nocookie.com"],TE,UE=!1; equals www.youtube.com (Youtube)
Source: chromecache_101.1.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(b){var c=typeof a.URL==="function"?a.URL:a.webkitURL;c=new c(b);c=c.hostname.endsWith(".facebook.com")&&c.pathname=="/signals/iwl.js";if(!c)throw new Error("Disallowed script URL");return b}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_101.1.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_101.1.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: lh7-rt.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: l.wl.co
Source: global traffic	DNS traffic detected: DNS query: qr-codes.io
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: verifynwebappsecurenewaccmanges.jsjbdybcxp.biz.id
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: m.media-amazon.com
Source: global traffic	DNS traffic detected: DNS query: w3valid.com

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Windows Analysis Report
https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ