Edit tour

Windows Analysis Report
https://us.sa/xPuEb

Overview

General Information

Sample URL:	https://us.sa/xPuEb
Analysis ID:	1642761
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2392,i,18123601365568351909,5093385921271692729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us.sa/xPuEb" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js?	Avira URL Cloud: Label: phishing
Source: https://hotel-confirm3494729.com/normal.html	Avira URL Cloud: Label: phishing
Source: https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907	Avira URL Cloud: Label: phishing
Source: https://hotel-confirm3494729.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	Avira URL Cloud: Label: phishing

Source: https://hotel-confirm3494729.com/p/447771807400

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none" viewBox="0 0 26 26"><path fill="#d9d9d9" d="M13 0a13 13 0 1 0 0 26 13 13 0 0 0 0-26m0 24a11 11 0 1 1 0-22 11 11 0 0 1 0 22"/><path fill="#d9d9d9" d="m10.955 16.055-3.95-4.125-1.445...

Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:63911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:63912 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.4:63902 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xPuEb HTTP/1.1Host: us.saConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/447771807400 HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://hotel-confirm3494729.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /normal.html HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hotel-confirm3494729.com/p/447771807400Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hotel-confirm3494729.com/p/447771807400Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js? HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
Source: global traffic	HTTP traffic detected: GET /p/447771807400 HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k; cf_clearance=dwH80EVlqoJeJySDkmOZUhiO3DcqLPbEP2Hd7wDrckQ-1742378356-1.2.1.1-spiJsWnT._DaLDoLgjxGyvu4Srjgst.v9fTxYJv2PjKJnbatV6Z6mmSbRWpIaGdezC0HJMWTI54yC99eUgmqiwHlIkNv9s0MUGI0frHfumyW0UBaTRFaqmGZr4TzV5nAouA3j6FM80IjXh.2SJGoeL1bn4nJIMyJPvUu.m8hquJEMkbPDWpQmvcOKXKNQHgM1PUF_zhqktJXyhoPMM2loAq_r3MSvykl04T9dOQEIl.tfxXyrW8y2Q1_H3xW5cYlvYpGE0KCKLvCzb5ZiFVXE2FZOAGLRgmHkotThssjseDKeiawj6buRoFIjuFEL43iDWhi5cVOVIsOtVb8G8gcXx9VZBYO_aDwitzHRb1W44I
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://hotel-confirm3494729.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Range: bytes=69312-69312If-Range: "28feccc0-15d9d"
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://hotel-confirm3494729.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Range: bytes=69312-89500If-Range: "28feccc0-15d9d"
Source: global traffic	HTTP traffic detected: GET /normal.html HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hotel-confirm3494729.com/p/447771807400Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k; cf_clearance=dwH80EVlqoJeJySDkmOZUhiO3DcqLPbEP2Hd7wDrckQ-1742378356-1.2.1.1-spiJsWnT._DaLDoLgjxGyvu4Srjgst.v9fTxYJv2PjKJnbatV6Z6mmSbRWpIaGdezC0HJMWTI54yC99eUgmqiwHlIkNv9s0MUGI0frHfumyW0UBaTRFaqmGZr4TzV5nAouA3j6FM80IjXh.2SJGoeL1bn4nJIMyJPvUu.m8hquJEMkbPDWpQmvcOKXKNQHgM1PUF_zhqktJXyhoPMM2loAq_r3MSvykl04T9dOQEIl.tfxXyrW8y2Q1_H3xW5cYlvYpGE0KCKLvCzb5ZiFVXE2FZOAGLRgmHkotThssjseDKeiawj6buRoFIjuFEL43iDWhi5cVOVIsOtVb8G8gcXx9VZBYO_aDwitzHRb1W44I
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907 HTTP/1.1Host: hotel-confirm3494729.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCL7VzgEIgNbOAQjB2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: us.sa
Source: global traffic	DNS traffic detected: DNS query: hotel-confirm3494729.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=xNDrwjrm8W6wgvKyLOE1a246aPJ%2FXzwiH7c9jp9mPVv9L%2BSi7%2FE%2FM%2FEpMwfjPM81WdbseJxUbT0tIYopXuYF2%2FR8ATjs4t7Ysq3GQQ3dQLQyUBM2tDh5uymrrUIBvjaj%2FeBo9mxOP8x1H70%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 489Content-Type: application/reports+jsonOrigin: https://hotel-confirm3494729.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Mar 2025 09:59:16 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Powered-By: ExpressETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Cache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZWHVU3rFu3c0oSuAb7FIkUZZo18yEXmWR3cD%2FfI2JwHMMzUorndRtF6ENop8q5Q6luIKAw9ZI8gUkzwYmgwJOl%2FWlIGAgvAje2O31repWW8RnCI7rOiyINVtIMvXkANJL6Sny71453TPzk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 922c1db5dc86d2ab-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=677&min_rtt=550&rtt_var=297&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2861&recv_bytes=1301&delivery_rate=5265454&cwnd=251&unsent_bytes=0&cid=5d6fa3a200395205&ts=124&x=0"

Source: chromecache_52.3.dr

String found in binary or memory: https://code.jquery.com/jquery-3.6.0.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63908
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 63911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 63913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63911
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63910
Source: unknown	Network traffic detected: HTTP traffic on port 63910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:63911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:63912 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5548_1017268988

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5548_1017268988

Jump to behavior

Source: classification engine

Classification label: mal48.win@22/10@14/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2392,i,18123601365568351909,5093385921271692729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us.sa/xPuEb"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2392,i,18123601365568351909,5093385921271692729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://us.sa/xPuEb	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js?	100%	Avira URL Cloud	phishing
https://hotel-confirm3494729.com/normal.html	100%	Avira URL Cloud	phishing
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907	100%	Avira URL Cloud	phishing
https://hotel-confirm3494729.com/favicon.ico	100%	Avira URL Cloud	phishing
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	100%	Avira URL Cloud	phishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
www.google.com	142.250.186.132	true	false	high
us.sa	104.21.96.1	true	false	unknown
hotel-confirm3494729.com	104.21.48.1	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://a.nel.cloudflare.com/report/v4?s=xNDrwjrm8W6wgvKyLOE1a246aPJ%2FXzwiH7c9jp9mPVv9L%2BSi7%2FE%2FM%2FEpMwfjPM81WdbseJxUbT0tIYopXuYF2%2FR8ATjs4t7Ysq3GQQ3dQLQyUBM2tDh5uymrrUIBvjaj%2FeBo9mxOP8x1H70%3D	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907	false	Avira URL Cloud: phishing	unknown
https://hotel-confirm3494729.com/p/447771807400	false		unknown
https://a.nel.cloudflare.com/report/v4?s=KnlK6O3d8StLsRdgIqnEHcCB7Tg2w%2FZgGrSDMcLNNcS1LgP8EEG2XtsLvGcpyWwWttUJpXZcaalJqTSxGcm81CweS07UUWTiXT9YbgV%2BTBvCafPYnKV4riSs%2F6cTdyyI%2FlIi37Nh1Ilc6Mo%3D	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://hotel-confirm3494729.com/normal.html	false	Avira URL Cloud: phishing	unknown
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js?	false	Avira URL Cloud: phishing	unknown
https://hotel-confirm3494729.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=aB%2BrKKavkK5nIMER%2FzCTc85pY7XtK961ZfolWWZ51Um6FkW5NQ1Dth4QSluodh9c5jS4SRrOU1%2FrMPY9y5K5uEzoA5wbznospYZAr8c50hNUstbRr0Z64ctuRyfCSvcmaRqIPIJ25fx4zV4%3D	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	hotel-confirm3494729.com	United States	13335	CLOUDFLARENETUS	false
104.21.64.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.96.1	us.sa	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.9
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642761
Start date and time:	2025-03-19 10:58:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us.sa/xPuEb
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@22/10@14/8

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.185.206, 142.250.185.238, 74.125.133.84, 142.250.186.110, 142.250.184.238, 142.250.186.142, 2.16.100.168, 142.250.74.206, 142.250.185.142, 74.125.11.10, 142.250.185.110, 172.217.133.233, 142.250.186.67, 142.250.186.163, 23.60.203.209, 4.175.87.197
Excluded domains from analysis (whitelisted): r4---sn-4g5edndr.gvt1.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, r5---sn-4g5lznls.gvt1.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, r4.sn-4g5edndr.gvt1.com, clients.l.google.com, c.pki.goog, r5.sn-4g5lznls.gvt1.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://us.sa/xPuEb

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Obn:Obn
MD5:	9D1EAD73E678FA2F51A70A933B0BF017
SHA1:	D205CBD6783332A212C5AE92D73C77178C2D2F28
SHA-256:	0019DFC4B32D63C1392AA264AED2253C1E0C2FB09216F8E2CC269BBFB8BB49B5
SHA-512:	935B3D516E996F6D25948BA8A54C1B7F70F7F0E3F517E36481FDF0196C2C5CFC2841F86E891F3DF9517746B7FB605DB47CDDED1B8FF78D9482DDAA621DB43A34
Malicious:	false
Reputation:	low
URL:	https://hotel-confirm3494729.com/favicon.ico
Preview:	Not Found

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (4833), with CRLF line terminators
Category:	downloaded
Size (bytes):	11945
Entropy (8bit):	5.764372065793101
Encrypted:	false
SSDEEP:	96:PJFtzXoEqjgoSqEb0EqKoqjgoQqEb0En0JqjEowqET0E6nTXlOqET0EVqjEoruva:PLjShvKJqoqlJAR9uypn5W6HhI
MD5:	EBA92FC15757DBF866EB5AE70617F06D
SHA1:	86A1B3FED7B2DBE5445AEC4B67E43E6AC866C7C6
SHA-256:	BFFB82B43A22FBB04C92F3C98997B96E88CB85078C82A38D1E7DC3D48BCC66FC
SHA-512:	42E3D989A8766AC21F0FBA183E59ABD7FFCA65C4B4FB26EDBA60AE041448894796503A94177D6CF85DC67ADDB3F214D532E3EC3D27C9750155EC6F6F40B25525
Malicious:	false
Reputation:	low
URL:	https://hotel-confirm3494729.com/p/447771807400
Preview:	<html lang="en-US" class="lang-ru-ru" dir="ltr"><head>.. <link rel="icon" href="/favicon.ico" sizes="any">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>One moment.</title>.. <meta http-equiv="X-UA-Compatible" content="IE=Edge">.. <meta name="robots" content="noindex,nofollow">.. <meta name="viewport" content="width=device-width,initial-scale=1">.. <style>* {box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button, html.... {font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}@media (prefers-color-scheme: dark){body{background-color:#222;color:#d9d9d9}body a{color:#fff}body a:hover{color:#ee730a;text-decoration:underline}body .lds-ring div{border-color:#999 transparent transparent}body .font-red{color:#b20f03}body .pow-button{background-color:

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8484), with no line terminators
Category:	downloaded
Size (bytes):	8484
Entropy (8bit):	5.741696355193833
Encrypted:	false
SSDEEP:	192:XDgk9nAO50r+vlrXr096qaiWm4V+kLg3e0dZ410kkZVzm8XXhk0q+O0x:zeOUC7MnaW4V+kLYzdZ41028XeFW
MD5:	AEBB293911BA65B97F79B094AD56B898
SHA1:	D557DB0DF0EB94833B042D1B30F6FF0ED84426B1
SHA-256:	A00D3293DDE7F37F7F63E0DD34BD39842502365F679427230E061591099FAAE0
SHA-512:	C1C71051F3C2C7DF2246F22722321F6988E540A30D0764713FD3335000268345773A6CC96BB4D02F475CC72F3E198371E4C1995516A2EEF188DE9A0B75FD0D78
Malicious:	false
Reputation:	low
URL:	https://hotel-confirm3494729.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(546))/1+parseInt(V(470))/2+parseInt(V(500))/3(-parseInt(V(491))/4)+parseInt(V(488))/5+-parseInt(V(557))/6(parseInt(V(516))/7)+-parseInt(V(506))/8(-parseInt(V(544))/9)+parseInt(V(509))/10(parseInt(V(510))/11),g===e)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,141521),h=this\|\|self,i=h[W(570)],j={},j[W(466)]='o',j[W(577)]='s',j[W(476)]='u',j[W(512)]='z',j[W(528)]='n',j[W(494)]='I',j[W(552)]='b',k=j,h[W(556)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|E===void 0)return G;for(I=n(E),g[a1(567)][a1(504)]&&(I=I[a1(554)](g[a1(567)][a1(504)](E))),I=g[a1(568)][a1(480)]&&g[a1(550)]?g[a1(568)][a1(480)](new g[(a1(550))](I)):function(O,a2,P){for(a2=a1,O[a2(499)](),P=0;P<O[a2(464)];O[P+1]===O[P]?O[a2(523)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(541)][a1(542)](J),K=0;K<I[a1(464)];L=I[K],M=m(g,E,L),J(M)?(N='s'===M&&!g[a1(524)](E[L]),a1(553

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6243)
Category:	downloaded
Size (bytes):	6250
Entropy (8bit):	5.8293788962918685
Encrypted:	false
SSDEEP:	96:JlrLzy9PETOlEc6UZVm1seP3tAWt0Tq2xaxZr6FNQ1ecItB+fffffL:/rLzK2OvZV2XtAW2Tq2xaxUk0cIQ
MD5:	501CA82AC19FC9D1FE303496D07D5C49
SHA1:	378CD657311DC23978F841EFF93994813675B77B
SHA-256:	AF0068FB25F5DF45898D948DB1F25FAFEFC6B3356DA15E4E77982C0CE4C7A694
SHA-512:	190B9011C828744DBA9C8188A744CDBAD67B91EBCC5234DD917BD3BC29C1F3D9C6A9D9FC8BEB3409990BC00BBEA7806DF41A60AE533E78E5F82CC14534CCD91D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["sc magdeburg","n.rnberg neues stadion","bambu lab h2d","google pixel 9a","tarifverhandlungen .ffentlichen dienst","byd aktien","zdf mediathek streaming","alemannia aachen"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"CiAIkk4SGwoXVHJlbmRzIGJlaSBTdWNoYW5mcmFnZW4oCg\u003d\u003d","google:suggestdetail":[{"google:entityinfo":"CgkvbS8wODRuNWgSADKOD2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQzBBQUFCQUNBTUFBQUM1cmc0c0FBQUE4MUJNVkVYLy8vL2hBQUR5c2JQZUFBRHVrNWJoQUFib1dsL21SVXppQUJydGhZbnVrWlQwdWJzQWlSOEFpeWNBalMwQWlpUHNmNFAyK3ZkaHEzTHgzYlR5dEFENTNxZ0FnZ0FBanpUMXY4SHFiM1A3NnVyMzBkTDJ4OGdpbFVNeW1rNEFoaExDM01mYm93RENrZ0RPbkFEVG1nRFU1dGVieDZYa0tqU1N3cHpyZG5yakZ5WGpJUzN0WjI3OTlQVGxQVVh2bXAzbzh1cXYwcmQ4dDRsT28yUHk0Yi9kdVdidHhHWHM0TWIyejNyWXUzdmp6cUxteXBEZHRsdjM2OVBsMDYvdzBwSDk5dWp5dXliS25pVHp3VVRPcDBYNDFZcmJ3cmpJdmF5OHY2blhsWXlrclkwQXBsVDRlWVRRcDVxd25ZSFRpSDZTcklVcXVSSE9BQUFFWWtsRVFWUklpYlZWYTNmYU9CQWRXZUZsYklJY0I0T05

Total Packets: 303
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 10:59:00.548501015 CET	49680	443	192.168.2.4	204.79.197.222
Mar 19, 2025 10:59:02.142431021 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:02.454657078 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:03.064058065 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:04.267173052 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:06.704737902 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:10.235492945 CET	49680	443	192.168.2.4	204.79.197.222
Mar 19, 2025 10:59:10.907778025 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:11.235548019 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:11.516771078 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:11.844892025 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:13.048511028 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:13.167191029 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:13.167234898 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:13.167419910 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:13.167576075 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:13.167588949 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:13.202043056 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:13.202116013 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:13.203325987 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:13.203568935 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:13.251610994 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:15.249798059 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.249852896 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.249917984 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.250226974 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.250266075 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.250360012 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.250422001 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.250437021 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.250614882 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.250626087 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.281313896 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.281388044 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.284040928 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.284106970 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.286937952 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.287211895 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.287436008 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.287756920 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.287940979 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.328326941 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.332480907 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.391861916 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.391942978 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.391989946 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.397677898 CET	49730	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:15.397692919 CET	443	49730	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:15.419606924 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.419651985 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.419723988 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.419977903 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.419990063 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.452020884 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.452105045 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.453258991 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.453526020 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.453912020 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.457417965 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:15.496326923 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635025024 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635078907 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635122061 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635134935 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635153055 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635195017 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635231972 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635236979 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635242939 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635270119 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635276079 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635313988 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635318995 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635505915 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635540009 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635582924 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635588884 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635628939 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.635663986 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.635694027 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.636851072 CET	49731	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.636866093 CET	443	49731	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.710616112 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.710659981 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.710951090 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.711283922 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.711299896 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.747781992 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.747850895 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.748864889 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.749219894 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.749519110 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.792336941 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.798685074 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.798789978 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.798827887 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.798850060 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.798867941 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.798909903 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.798916101 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799029112 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799092054 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.799097061 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799177885 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799212933 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799221039 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.799226046 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.799267054 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.800165892 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803369999 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803422928 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.803437948 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803452015 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803498030 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.803503990 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803585052 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803633928 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.803634882 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803647995 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.803765059 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.804500103 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804562092 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804589033 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804613113 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804635048 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.804644108 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804673910 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.804846048 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804869890 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804894924 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804897070 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.804908991 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804943085 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804951906 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.804960012 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.804987907 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.808011055 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.808027029 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.808068037 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.808083057 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.808115959 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.808140039 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.809566021 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.809581995 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.809649944 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.809660912 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.810384989 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.810513020 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.810939074 CET	49732	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:15.810955048 CET	443	49732	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:15.826138973 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.826183081 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.826323986 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.827259064 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.827274084 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.856586933 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.856854916 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.857058048 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.857069969 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.948200941 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.948260069 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.948329926 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.948530912 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.948542118 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971679926 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971726894 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971776009 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.971791029 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971837044 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.971841097 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971878052 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971890926 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.971896887 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.971935034 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.973066092 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.975955009 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976321936 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976350069 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976370096 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.976373911 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976385117 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976413012 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.976438999 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976471901 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.976483107 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976820946 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976847887 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976864100 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.976870060 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976895094 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976924896 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976927996 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.976933956 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.976963997 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.977700949 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977741003 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.977799892 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977844000 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977843046 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.977886915 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977910995 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.977914095 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977922916 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.977946997 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.980876923 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.980906010 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.980931997 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.980943918 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.980957985 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.980977058 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.981091976 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.981113911 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981342077 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981364965 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981386900 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.981389999 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981399059 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981429100 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.981437922 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981475115 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981508970 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.981515884 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.981676102 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.982314110 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.982355118 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.982386112 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.982397079 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.982407093 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.982426882 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.983706951 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.983747959 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.983753920 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.983762026 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.983798981 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.984268904 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.984313011 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.984318972 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.984358072 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.984395027 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.985953093 CET	49734	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:15.985972881 CET	443	49734	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:15.995960951 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:15.995987892 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:15.996041059 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:15.996195078 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:15.996205091 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.026915073 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.027017117 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.039695024 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.039767981 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.039844990 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.059767008 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.059834003 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.060105085 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.060230970 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.060367107 CET	49735	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.060401917 CET	443	49735	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.060614109 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.060760021 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.060774088 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.061145067 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.062700987 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.062747955 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.062891960 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.063853025 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.063868046 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.086682081 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.086954117 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.087115049 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.087126970 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.089133978 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.090115070 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.091151953 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.091176033 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.104336023 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.153481007 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153537989 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153572083 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153590918 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.153601885 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153635025 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153659105 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.153676033 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153712988 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.153719902 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153780937 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.153841972 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.154597998 CET	49738	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.154618025 CET	443	49738	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.190872908 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.191817045 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.191865921 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.191987038 CET	49736	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.192008972 CET	443	49736	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.192720890 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.192744017 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.192837954 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.193017960 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.193028927 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.205625057 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.205697060 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.205744028 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.210597038 CET	49737	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.210632086 CET	443	49737	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.218548059 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.218828917 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.219136953 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.219151974 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.328012943 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.328057051 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.328250885 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.329545021 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.329564095 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.358545065 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.358838081 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.359009981 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.359019041 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.359071016 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.359092951 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.359148026 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.359153032 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.383481026 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.383605003 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.383671999 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.384426117 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.384879112 CET	49741	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.384896994 CET	443	49741	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.385086060 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.385149002 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.388972044 CET	49740	443	192.168.2.4	35.190.80.1
Mar 19, 2025 10:59:16.388978958 CET	443	49740	35.190.80.1	192.168.2.4
Mar 19, 2025 10:59:16.434504986 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.434573889 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.434638977 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.434963942 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.435023069 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.435071945 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.435201883 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.435220003 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.435416937 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.435431957 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.465128899 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.465208054 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.466432095 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.466854095 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.466866970 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.467207909 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.512334108 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704574108 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704622030 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704648018 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704674959 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704674959 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.704693079 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704711914 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.704729080 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704755068 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704787970 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.704791069 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704802990 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.704833031 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.704962969 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.705063105 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.705065966 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.705107927 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.862952948 CET	49743	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:16.862987041 CET	443	49743	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:16.897525072 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.897561073 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.897644997 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.897818089 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.897830963 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.920948029 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.921226978 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.921967030 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.921977043 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.975636959 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.975720882 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.975828886 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.976399899 CET	49744	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.976418018 CET	443	49744	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.978059053 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.978102922 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:16.978203058 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.978332996 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:16.978346109 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.002123117 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.003896952 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.005390882 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.005399942 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059492111 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059565067 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059608936 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059613943 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.059627056 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059662104 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059674025 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.059679985 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059716940 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059721947 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.059726954 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.059753895 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.059758902 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.060906887 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.060939074 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.060966015 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.060973883 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.061012030 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.064228058 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.064275980 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.064315081 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.064332962 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.064342976 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.064359903 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.064383030 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.064409971 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.065391064 CET	49745	443	192.168.2.4	151.101.66.137
Mar 19, 2025 10:59:17.065406084 CET	443	49745	151.101.66.137	192.168.2.4
Mar 19, 2025 10:59:17.096112013 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.096151114 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.152694941 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.152744055 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.152801991 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.153784990 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.153800011 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.156267881 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156322002 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156358004 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156368971 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.156393051 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156445026 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156447887 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.156465054 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156514883 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.156522989 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156958103 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.156989098 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.157016039 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.157025099 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.157078981 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.157656908 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161366940 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161401033 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161411047 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.161417007 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161463976 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.161469936 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161840916 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161870956 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161889076 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.161895990 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.161933899 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.162727118 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.162786007 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.162816048 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.162853956 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.162863970 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.163042068 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.163600922 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.163686037 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.163814068 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.163820982 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.164416075 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.164446115 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.164468050 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.164474964 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.164679050 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.164685965 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.166909933 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.166939974 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.166969061 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.166980982 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.166987896 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167007923 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.167459011 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167490959 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167514086 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.167521000 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167561054 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167591095 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167609930 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.167618990 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.167651892 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.168528080 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.168572903 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.168726921 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.168726921 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.168735981 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.168781996 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.169399977 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.169442892 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.169454098 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.169460058 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.169473886 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.169487953 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.169504881 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.169511080 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.169591904 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.170315027 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.170372963 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.170380116 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.170473099 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.172116041 CET	49742	443	192.168.2.4	104.21.48.1
Mar 19, 2025 10:59:17.172132969 CET	443	49742	104.21.48.1	192.168.2.4
Mar 19, 2025 10:59:17.181639910 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.181735039 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.182769060 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.183001041 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.183461905 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.228322983 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.263006926 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.263071060 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:17.263112068 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.265033960 CET	49746	443	192.168.2.4	104.21.64.1
Mar 19, 2025 10:59:17.265047073 CET	443	49746	104.21.64.1	192.168.2.4
Mar 19, 2025 10:59:18.608848095 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.651344061 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651415110 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651443958 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651460886 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.651482105 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651514053 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651529074 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.651535034 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.651576996 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.651582956 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.654129028 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:18.654184103 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.654496908 CET	49726	443	192.168.2.4	142.250.186.132
Mar 19, 2025 10:59:18.654514074 CET	443	49726	142.250.186.132	192.168.2.4
Mar 19, 2025 10:59:20.266652107 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:21.126488924 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 10:59:22.384278059 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 10:59:22.388885975 CET	80	49750	142.250.185.131	192.168.2.4
Mar 19, 2025 10:59:22.388945103 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 10:59:22.389058113 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 10:59:22.393738985 CET	80	49750	142.250.185.131	192.168.2.4
Mar 19, 2025 10:59:22.404277086 CET	80	49750	142.250.185.131	192.168.2.4
Mar 19, 2025 10:59:22.409564018 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 10:59:22.417408943 CET	80	49750	142.250.185.131	192.168.2.4
Mar 19, 2025 10:59:22.470117092 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 10:59:29.877198935 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 10:59:30.269887924 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:30.269977093 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:30.270036936 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:31.223073006 CET	49729	443	192.168.2.4	104.21.96.1
Mar 19, 2025 10:59:31.223115921 CET	443	49729	104.21.96.1	192.168.2.4
Mar 19, 2025 10:59:31.447628975 CET	63902	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:31.452384949 CET	53	63902	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:31.456121922 CET	63902	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:31.459508896 CET	63902	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:31.464240074 CET	53	63902	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:31.472870111 CET	53	63902	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:31.477642059 CET	63902	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:31.482563972 CET	53	63902	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:31.482613087 CET	63902	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:00:13.221945047 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:13.221981049 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:13.222050905 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:13.222218990 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:13.222234964 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:13.294950962 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:13.295326948 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:13.295342922 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:16.003488064 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.003526926 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.003576040 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.003787994 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.003799915 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.010525942 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.010560036 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.010622978 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.010730028 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.010739088 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.034914017 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.035213947 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.035360098 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.035366058 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.043476105 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.043555021 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.044193029 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.044450998 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.044665098 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.092319012 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.199335098 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.199778080 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.199862003 CET	443	63910	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.199951887 CET	63910	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.200417042 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.200470924 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.200537920 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.200685024 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.200701952 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.212127924 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.212363958 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.212394953 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.212440968 CET	443	63911	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.212469101 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.212488890 CET	63911	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.212939978 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.212981939 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.213044882 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.213193893 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.213207006 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.232302904 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.232448101 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.232899904 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.233676910 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.233921051 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.233947039 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.233994007 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.264413118 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.264729977 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.264760017 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.264898062 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.264910936 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.372138977 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.372493029 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.372654915 CET	443	63912	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.372725010 CET	63912	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.431008101 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.431327105 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:16.431397915 CET	443	63913	35.190.80.1	192.168.2.4
Mar 19, 2025 11:00:16.431463957 CET	63913	443	192.168.2.4	35.190.80.1
Mar 19, 2025 11:00:22.486558914 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 11:00:22.491534948 CET	80	49750	142.250.185.131	192.168.2.4
Mar 19, 2025 11:00:22.491616011 CET	49750	80	192.168.2.4	142.250.185.131
Mar 19, 2025 11:00:23.280879021 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:23.281027079 CET	443	63908	142.250.186.132	192.168.2.4
Mar 19, 2025 11:00:23.281411886 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:25.223963022 CET	63908	443	192.168.2.4	142.250.186.132
Mar 19, 2025 11:00:25.223998070 CET	443	63908	142.250.186.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 10:59:09.238709927 CET	53	58185	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:09.261070967 CET	53	49376	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:09.433022022 CET	53	52334	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:13.159079075 CET	58677	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:13.159332037 CET	49759	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:13.166265011 CET	53	58677	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:13.166306973 CET	53	49759	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.016674995 CET	62125	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.017177105 CET	61682	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.168721914 CET	53	61682	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.248938084 CET	53	62125	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.398447990 CET	50418	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.398797989 CET	56719	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.411722898 CET	53	50418	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.419142008 CET	53	56719	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.702666044 CET	54341	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.703180075 CET	60429	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.709580898 CET	53	54341	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.710067034 CET	53	60429	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.988656998 CET	51379	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.988826990 CET	63603	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:15.995150089 CET	53	63603	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:15.995343924 CET	53	51379	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:17.126089096 CET	53867	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:17.126705885 CET	65085	53	192.168.2.4	1.1.1.1
Mar 19, 2025 10:59:17.148380041 CET	53	53867	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:17.151762962 CET	53	65085	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:26.394844055 CET	53	60213	1.1.1.1	192.168.2.4
Mar 19, 2025 10:59:31.442514896 CET	53	50402	1.1.1.1	192.168.2.4
Mar 19, 2025 11:00:08.685276985 CET	53	53323	1.1.1.1	192.168.2.4
Mar 19, 2025 11:00:10.397898912 CET	138	138	192.168.2.4	192.168.2.255
Mar 19, 2025 11:00:11.088417053 CET	53	57287	1.1.1.1	192.168.2.4
Mar 19, 2025 11:00:16.002706051 CET	49867	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:00:16.003056049 CET	49355	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:00:16.009154081 CET	53	49867	1.1.1.1	192.168.2.4
Mar 19, 2025 11:00:16.010195017 CET	53	49355	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 10:59:13.159079075 CET	192.168.2.4	1.1.1.1	0x5ffb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:13.159332037 CET	192.168.2.4	1.1.1.1	0xf2f7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 19, 2025 10:59:15.016674995 CET	192.168.2.4	1.1.1.1	0xeb7e	Standard query (0)	us.sa	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.017177105 CET	192.168.2.4	1.1.1.1	0xbc72	Standard query (0)	us.sa	65	IN (0x0001)	false
Mar 19, 2025 10:59:15.398447990 CET	192.168.2.4	1.1.1.1	0x4cf0	Standard query (0)	hotel-confirm3494729.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.398797989 CET	192.168.2.4	1.1.1.1	0x90eb	Standard query (0)	hotel-confirm3494729.com	65	IN (0x0001)	false
Mar 19, 2025 10:59:15.702666044 CET	192.168.2.4	1.1.1.1	0xf0da	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.703180075 CET	192.168.2.4	1.1.1.1	0xe456	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 19, 2025 10:59:15.988656998 CET	192.168.2.4	1.1.1.1	0x6b40	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.988826990 CET	192.168.2.4	1.1.1.1	0x856c	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 10:59:17.126089096 CET	192.168.2.4	1.1.1.1	0x2c2a	Standard query (0)	hotel-confirm3494729.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.126705885 CET	192.168.2.4	1.1.1.1	0x9962	Standard query (0)	hotel-confirm3494729.com	65	IN (0x0001)	false
Mar 19, 2025 11:00:16.002706051 CET	192.168.2.4	1.1.1.1	0x9014	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:00:16.003056049 CET	192.168.2.4	1.1.1.1	0xc7b8	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 10:59:13.166265011 CET	1.1.1.1	192.168.2.4	0x5ffb	No error (0)	www.google.com	142.250.186.132	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:13.166306973 CET	1.1.1.1	192.168.2.4	0xf2f7	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 19, 2025 10:59:15.168721914 CET	1.1.1.1	192.168.2.4	0xbc72	No error (0)	us.sa		65	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.248938084 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	us.sa	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.411722898 CET	1.1.1.1	192.168.2.4	0x4cf0	No error (0)	hotel-confirm3494729.com	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.419142008 CET	1.1.1.1	192.168.2.4	0x90eb	No error (0)	hotel-confirm3494729.com		65	IN (0x0001)	false
Mar 19, 2025 10:59:15.709580898 CET	1.1.1.1	192.168.2.4	0xf0da	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.709580898 CET	1.1.1.1	192.168.2.4	0xf0da	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.709580898 CET	1.1.1.1	192.168.2.4	0xf0da	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.709580898 CET	1.1.1.1	192.168.2.4	0xf0da	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:15.995343924 CET	1.1.1.1	192.168.2.4	0x6b40	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.148380041 CET	1.1.1.1	192.168.2.4	0x2c2a	No error (0)	hotel-confirm3494729.com	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 10:59:17.151762962 CET	1.1.1.1	192.168.2.4	0x9962	No error (0)	hotel-confirm3494729.com		65	IN (0x0001)	false
Mar 19, 2025 11:00:16.009154081 CET	1.1.1.1	192.168.2.4	0x9014	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

us.sa

hotel-confirm3494729.com

code.jquery.com

a.nel.cloudflare.com

www.google.com

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49750	142.250.185.131	80

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 10:59:22.389058113 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 19, 2025 10:59:22.404277086 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 09:15:49 GMT Expires: Wed, 19 Mar 2025 10:05:49 GMT Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding Age: 2613
Mar 19, 2025 10:59:22.409564018 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 19, 2025 10:59:22.417408943 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 09:23:06 GMT Expires: Wed, 19 Mar 2025 10:13:06 GMT Age: 2176 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.96.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:15 UTC	660	OUT	GET /xPuEb HTTP/1.1 Host: us.sa Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:15 UTC	1211	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 19 Mar 2025 09:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://hotel-confirm3494729.com/p/447771807400 expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate pragma: no-cache Set-Cookie: PHPSESSID=6c36d0e37f9a7c52fbddd4920672cb85; path=/ Set-Cookie: short_1330=1; expires=Wed, 19-Mar-2025 10:14:15 GMT; Max-Age=900; path=/; HttpOnly cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QjFrJn3TB9qc0jks5h8pWzzOo9S9ob5mW0HzYR9kV0sW20s%2BChYbvdkhPMOW8s%2FqsnUvBK6zjJ6EB%2FJ7HC7KVRpKD%2BzycWv0T5S5ZmM1LBuISfA2O62y8w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} speculation-rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 922c1db0c8b6d2c2-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1124&min_rtt=879&rtt_var=505&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2805&recv_bytes=1232&delivery_rate=3294653&cwnd=248&unsent_bytes=0&cid=ce15de92ba8153c5&ts=120&x=0"
2025-03-19 09:59:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:15 UTC	688	OUT	GET /p/447771807400 HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:15 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Set-Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k; Path=/; Expires=Thu, 20 Mar 2025 09:59:15 GMT; HttpOnly cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cLvAdUetd4g8SyN%2BEAh4rIEnhT%2BcW7dOPLvBDbBsUbseXQdnvfIuBLfoqniFCNf2XpYUtiRrXZwcErUDT7sNNRTLKap2qmaj1AOR0AbO%2FZFCQT44nOMDs47B49vdcXmscjX1PjIurw4xSrQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db1dd836907-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=686&min_rtt=496&rtt_var=322&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2862&recv_bytes=1260&delivery_rate=5838709&cwnd=213&unsent_bytes=0&cid=dc6a6a8928ca971e&ts=193&x=0"
2025-03-19 09:59:15 UTC	360	IN	Data Raw: 33 32 35 33 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 2d 72 75 2d 72 75 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 73 69 7a 65 73 3d 22 61 6e 79 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 65 20 6d 6f 6d 65 6e 74 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 Data Ascii: 3253<html lang="en-US" class="lang-ru-ru" dir="ltr"><head> <link rel="icon" href="/favicon.ico" sizes="any"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>One moment</title> <meta http-equiv="X-UA-Comp
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 2a 20 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 63 6f 6c 6f 72 3a 23 33 31 33 31 33 31 7d 62 75 74 74 6f 6e 2c 20 68 74 6d 6c 0d 0a 0d 0a 20 20 20 20 20 20 20 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 79 73 74 65 6d 2d 75 69 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 53 65 67 6f 65 Data Ascii: " content="width=device-width,initial-scale=1"> <style>* {box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button, html {font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 54 4d 67 4d 43 41 78 49 44 41 67 4d 54 4d 67 4d 54 4e 42 4d 54 4d 75 4d 44 45 31 49 44 45 7a 4c 6a 41 78 4e 53 41 77 49 44 41 67 4d 43 41 78 4e 69 41 7a 62 54 41 67 4d 6a 52 68 4d 54 45 67 4d 54 45 67 4d 43 41 78 49 44 45 67 4d 54 45 74 4d 54 45 67 4d 54 45 75 4d 44 45 67 4d 54 45 75 4d 44 45 67 4d 43 41 77 49 44 45 74 4d 54 45 67 4d 54 45 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 51 6a 49 77 52 6a 41 7a 49 69 42 6b 50 53 4a 4e 4d 54 63 75 4d 44 4d 34 49 44 45 34 4c 6a 59 78 4e 55 67 78 4e 43 34 34 4e 30 77 78 4e 43 34 31 4e 6a 4d 67 4f 53 34 31 61 44 49 75 4e 7a 67 7a 65 6d 30 74 4d 53 34 77 4f 44 51 67 4d 53 34 30 4d 6a 64 78 4c 6a 59 32 49 44 41 67 4d 53 34 77 4e 54 63 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 Data Ascii: TMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a 4d 69 49 67 61 47 56 70 5a 32 68 30 50 53 49 7a 4d 69 49 67 5a 6d 6c 73 62 44 30 69 62 6d 39 75 5a 53 49 2b 50 48 42 68 64 47 67 67 5a 6d 6c 73 62 44 30 69 49 30 49 79 4d 45 59 77 4d 79 49 67 5a 44 30 69 54 54 45 32 49 44 4e 68 4d 54 4d 67 4d 54 4d 67 4d 43 41 78 49 44 41 67 4d 54 4d 67 4d 54 4e 42 4d 54 4d 75 4d 44 45 31 49 44 45 7a 4c 6a 41 78 4e 53 41 77 49 44 41 67 4d 43 41 78 4e 69 41 7a 62 54 41 67 4d 6a 52 68 4d 54 Data Ascii: t{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMT
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 75 4d 7a 63 67 4e 53 34 32 4d 53 41 35 4c 6a 51 35 4e 53 30 35 4c 6a 59 74 4d 53 34 30 4d 69 30 78 4c 6a 51 77 4e 58 6f 69 4c 7a 34 38 4c 33 4e 32 5a 7a 34 3d 29 7d 62 6f 64 79 2e 6c 69 67 68 74 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a 4d 69 49 67 61 47 56 70 5a 32 68 30 50 53 49 7a 4d 69 49 67 5a 6d 6c 73 62 44 30 69 62 6d 39 75 5a 53 49 2b 50 48 42 68 64 47 67 67 5a 6d 6c 73 62 44 30 69 49 32 5a 6a Data Ascii: uMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}body.light #challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI2Zj
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 32 35 72 65 6d 7d 2e 62 6f 64 79 2d 74 65 78 74 2c 20 2e 63 6f 72 65 2d 6d 73 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 62 6f 64 79 2d 74 65 78 74 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 72 65 6d 7d 40 6d 65 64 69 61 20 28 77 69 64 74 68 20 3c 3d 20 37 32 30 70 78 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 7b 2e 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 7d 2e 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 7d 2e 63 6f 72 65 2d 6d 73 67 2c 2e 68 32 Data Ascii: ize:1.5rem;line-height:2.25rem}.body-text, .core-msg{font-weight:400}.body-text {font-size:1rem;line-height:1.25rem}@media (width <= 720px ){.h1{font-size:1.5rem;line-height:1.75rem}.h2{font-size:1.25rem}.core-msg,.h2
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 44 41 67 4d 43 41 78 49 44 41 67 4d 6a 49 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 7a 45 7a 4d 54 4d 78 49 69 42 6b 50 53 4a 74 4d 54 41 75 4f 54 55 31 49 44 45 32 4c 6a 41 31 4e 53 30 7a 4c 6a 6b 31 4c 54 51 75 4d 54 49 31 4c 54 45 75 4e 44 51 31 49 44 45 75 4d 7a 67 31 49 44 55 75 4d 7a 63 67 4e 53 34 32 4d 53 41 35 4c 6a 51 35 4e 53 30 35 4c 6a 59 74 4d 53 34 30 4d 69 30 78 4c 6a 51 77 4e 58 6f 69 4c 7a 34 38 4c 33 4e 32 5a 7a 34 3d 29 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 32 70 78 7d 2e 74 65 78 74 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 70 6f 77 2d 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 31 63 33 3b 62 6f 72 64 65 72 3a 2e 30 36 33 72 Data Ascii: DAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=);padding-left:42px}.text-center{text-align:center}.pow-button{background-color:#0051c3;border:.063r
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 65 2d 74 69 74 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 7d 2e 6c 6f 61 64 69 6e 67 2d 73 70 69 6e 6e 65 72 7b 68 65 69 67 68 74 3a 37 36 2e 33 39 31 70 78 7d 2e 6c 64 73 2d 72 69 6e 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6c 64 73 2d 72 69 6e 67 2c 20 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 68 65 69 67 68 74 3a 31 2e 38 37 35 72 65 6d 3b 77 69 64 74 68 3a 31 2e 38 37 35 72 65 6d 7d 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 64 73 2d 72 69 6e 67 20 31 2e 32 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 2c 30 2c 2e 35 2c 31 29 20 69 6e 66 69 6e 69 74 65 3b 62 6f 72 64 65 72 3a 2e 33 72 65 6d 20 73 6f 6c 69 64 Data Ascii: e-title{margin-bottom:1rem}}.loading-spinner{height:76.391px}.lds-ring{display:inline-block;position:relative}.lds-ring, .lds-ring div{height:1.875rem;width:1.875rem}.lds-ring div{animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:.3rem solid
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 22 63 68 61 6c 6c 65 6e 67 65 2d 73 74 61 67 65 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 74 75 72 6e 73 74 69 6c 65 2d 77 72 61 70 70 65 72 22 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 2f 6e 6f 72 6d 61 6c 2e 68 74 6d 6c 22 20 61 6c 6c 6f 77 3d 22 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 69 73 6f 6c 61 74 65 64 3b 20 66 75 6c 6c 73 63 72 65 65 6e 3b 20 61 75 74 6f 70 6c 61 79 22 20 73 61 6e 64 62 6f 78 3d 22 61 6c 6c 6f 77 2d 73 61 6d 65 2d 6f 72 69 67 69 6e 20 61 6c 6c 6f 77 2d Data Ascii: "challenge-stage" style="display: flex;"> <div id="turnstile-wrapper" class="spacer"> <div> <iframe src="/normal.html" allow="cross-origin-isolated; fullscreen; autoplay" sandbox="allow-same-origin allow-
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 61 76 61 53 63 72 69 70 74 20 61 6e 64 20 63 6f 6f 6b 69 65 73 20 74 6f 20 63 6f 6e 74 69 6e 75 65 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 69 6e 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 64 69 61 67 6e 6f 73 74 69 63 2d 77 72 61 70 70 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 Data Ascii: avaScript and cookies to continue</span></div> </div> </noscript> </div></div><div class="footer" role="contentinfo"> <div class="footer-inner"> <div class="clearfix diagnostic-wrapper"> <div cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	151.101.66.137	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:15 UTC	583	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://hotel-confirm3494729.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:15 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Mar 2025 09:59:15 GMT Age: 3619956 X-Served-By: cache-lga21931-LGA, cache-fra-eddf8230076-FRA X-Cache: MISS, HIT X-Cache-Hits: 0, 199 X-Timer: S1742378356.796275,VS0,VE0 Vary: Accept-Encoding
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-19 09:59:15 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:15 UTC	832	OUT	GET /normal.html HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://hotel-confirm3494729.com/p/447771807400 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:15 UTC	932	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Cache-Control: public, max-age=0 Last-Modified: Thu, 07 Nov 2024 13:41:08 GMT cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNDrwjrm8W6wgvKyLOE1a246aPJ%2FXzwiH7c9jp9mPVv9L%2BSi7%2FE%2FM%2FEpMwfjPM81WdbseJxUbT0tIYopXuYF2%2FR8ATjs4t7Ysq3GQQ3dQLQyUBM2tDh5uymrrUIBvjaj%2FeBo9mxOP8x1H70%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db47997d378-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=887&min_rtt=861&rtt_var=341&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2863&recv_bytes=1404&delivery_rate=3363530&cwnd=250&unsent_bytes=0&cid=655165e5f8db19e4&ts=120&x=0"
2025-03-19 09:59:15 UTC	437	IN	Data Raw: 37 63 64 30 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 2d 72 75 2d 72 75 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 Data Ascii: 7cd0<!DOCTYPE html><html lang="en-US" class="lang-ru-ru" dir="ltr"><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 74 61 74 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 74 72 6f 6b 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: tate { 100% { transform: rotate(360deg); } } @keyframes stroke { 100% { stroke-dashoffset: 0; } } @keyframes scale {
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b Data Ascii: dth: 0; } } html { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; } body { margin: 0; back
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 73 74 61 67 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 62 72 61 6e 64 69 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 36 70 78 20 30 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 Data Ascii: e; } #challenge-stage { display: flex; } #branding { display: flex; flex-direction: column; margin: 0 16px 0 0; text-align: right; }
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 32 34 32 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 33 38 31 32 37 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 74 72 6f 6b 65 20 30 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 35 2c 20 30 2c 20 30 2e 34 35 2c 20 31 29 20 66 6f 72 77 61 72 64 73 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 20 30 2e 35 73 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a Data Ascii: stroke-dashoffset: 242; box-shadow: inset 0 0 0 #038127; animation: stroke 0.4s cubic-bezier(0.65, 0, 0.45, 1) forwards; animation-delay: 0.5s; } .success-circle { stroke-dashoffset:
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 63 74 69 76 65 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 Data Ascii: ctive, .theme-dark #challenge-overlay a:focus, .theme-dark #challenge-error-text a:hover, .theme-dark #challenge-error-text a:active, .theme-dark #challenge-error-text a:focus { color: #949494; }
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 76 65 72 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 65 72 6d 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 65 72 6d 73 20 61 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f Data Ascii: ver, .theme-dark #challenge-error-title a:active, .theme-dark #challenge-error-title a:focus { color: #949494; } .theme-dark #terms { color: #bbb; } .theme-dark #terms a { colo
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 Data Ascii: r-loop-link:focus { color: #949494; } .theme-dark #timeout-refresh-link, .theme-dark #expired-refresh-link { color: #bbb; } .theme-dark #timeout-refresh-link:visited, .theme-dark #
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 2c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 76 69 73 69 74 65 64 2c 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 61 63 74 69 Data Ascii: color: #1d1f20; } #challenge-overlay a:visited, #challenge-overlay a:link, #challenge-error-text a:visited, #challenge-error-text a:link { color: #1d1f20; } #challenge-overlay a:acti
2025-03-19 09:59:15 UTC	1369	IN	Data Raw: 74 3a 20 33 37 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 63 62 2d 6c 62 20 69 6e 70 75 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 70 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 32 34 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 Data Ascii: t: 37px; } .cb-lb input { position: absolute; top: 20px; left: 18px; opacity: 0; z-index: 9999; cursor: pointer; width: 24px; heigh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:15 UTC	646	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:16 UTC	920	IN	HTTP/1.1 302 Found Date: Wed, 19 Mar 2025 09:59:16 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAoBY4kVr2FRhj8OKY7e9ChYxKUJcCHT9Sd1fanhVdpTamDxv3WlEyV7XwrYbXYVem%2FgLdNB9XvH17vDOlS9OWaBMa02IaD4mAQUbIKTNQgY2XaJCY5EQ7RMZkrBjOFMPdxuCC%2FMsOVpqOc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db53a3ddc9a-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=851&min_rtt=845&rtt_var=330&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2861&recv_bytes=1218&delivery_rate=3224944&cwnd=244&unsent_bytes=0&cid=06e2a3d005fb66ab&ts=69&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	571	OUT	OPTIONS /report/v4?s=xNDrwjrm8W6wgvKyLOE1a246aPJ%2FXzwiH7c9jp9mPVv9L%2BSi7%2FE%2FM%2FEpMwfjPM81WdbseJxUbT0tIYopXuYF2%2FR8ATjs4t7Ysq3GQQ3dQLQyUBM2tDh5uymrrUIBvjaj%2FeBo9mxOP8x1H70%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://hotel-confirm3494729.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:16 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 19 Mar 2025 09:59:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	729	OUT	GET /favicon.ico HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hotel-confirm3494729.com/p/447771807400 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:16 UTC	886	IN	HTTP/1.1 404 Not Found Date: Wed, 19 Mar 2025 09:59:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Powered-By: Express ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZWHVU3rFu3c0oSuAb7FIkUZZo18yEXmWR3cD%2FfI2JwHMMzUorndRtF6ENop8q5Q6luIKAw9ZI8gUkzwYmgwJOl%2FWlIGAgvAje2O31repWW8RnCI7rOiyINVtIMvXkANJL6Sny71453TPzk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db5dc86d2ab-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=677&min_rtt=550&rtt_var=297&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2861&recv_bytes=1301&delivery_rate=5265454&cwnd=251&unsent_bytes=0&cid=5d6fa3a200395205&ts=124&x=0"
2025-03-19 09:59:16 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	664	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js? HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:16 UTC	911	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:16 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8484 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sWzrRWVXWe8zKtM6cIUPPAXpjsPdzyTKJfO4I4eqEfukKFIeU%2BS9QS7ugEnpi9QXH9f8q8Yw%2BmlLMTo%2F%2FyIjRt%2BjVx7tnQbrJ9%2BbUfshUJ%2B8rJyydP%2BS86YUCf2wgEcO0cqG2aQkSoWxbaA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db5eb1ad38a-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=564&min_rtt=559&rtt_var=213&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2861&recv_bytes=1236&delivery_rate=5180679&cwnd=251&unsent_bytes=0&cid=37109522e2bdba83&ts=69&x=0"
2025-03-19 09:59:16 UTC	458	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 57 2c 68 2c 69 2c 6a 2c 6b 2c 6f 2c 73 2c 42 29 7b 57 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 56 2c 66 2c 67 29 7b 66 6f 72 28 56 3d 62 2c 66 3d 64 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 67 3d 2d 70 61 72 73 65 49 6e 74 28 56 28 35 34 36 29 29 2f 31 2b 70 61 72 73 65 49 6e 74 28 56 28 34 37 30 29 29 2f 32 2b 70 61 72 73 65 49 6e 74 28 56 28 35 30 30 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 34 39 31 29 29 2f 34 29 2b 70 61 72 73 65 49 6e 74 28 56 28 34 38 38 29 29 2f 35 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 35 35 37 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 56 28 35 31 36 29 29 2f 37 29 2b 2d 70 61 72 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(546))/1+parseInt(V(470))/2+parseInt(V(500))/3(-parseInt(V(491))/4)+parseInt(V(488))/5+-parseInt(V(557))/6(parseInt(V(516))/7)+-par
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 37 37 29 5d 3d 27 73 27 2c 6a 5b 57 28 34 37 36 29 5d 3d 27 75 27 2c 6a 5b 57 28 35 31 32 29 5d 3d 27 7a 27 2c 6a 5b 57 28 35 32 38 29 5d 3d 27 6e 27 2c 6a 5b 57 28 34 39 34 29 5d 3d 27 49 27 2c 6a 5b 57 28 35 35 32 29 5d 3d 27 62 27 2c 6b 3d 6a 2c 68 5b 57 28 35 35 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 45 2c 46 2c 47 2c 61 31 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 29 7b 69 66 28 61 31 3d 57 2c 45 3d 3d 3d 6e 75 6c 6c 7c 7c 45 3d 3d 3d 76 6f 69 64 20 30 29 72 65 74 75 72 6e 20 47 3b 66 6f 72 28 49 3d 6e 28 45 29 2c 67 5b 61 31 28 35 36 37 29 5d 5b 61 31 28 35 30 34 29 5d 26 26 28 49 3d 49 5b 61 31 28 35 35 34 29 5d 28 67 5b 61 31 28 35 36 37 29 5d 5b 61 31 28 35 30 34 29 5d 28 45 29 29 29 2c 49 3d 67 5b 61 31 28 35 36 38 29 5d 5b 61 31 28 34 38 30 29 Data Ascii: 77)]='s',j[W(476)]='u',j[W(512)]='z',j[W(528)]='n',j[W(494)]='I',j[W(552)]='b',k=j,h[W(556)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|E===void 0)return G;for(I=n(E),g[a1(567)][a1(504)]&&(I=I[a1(554)](g[a1(567)][a1(504)](E))),I=g[a1(568)][a1(480)
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 7c 7c 28 49 5b 53 5d 3d 4d 2b 2b 2c 4a 5b 53 5d 3d 21 30 29 2c 54 3d 4b 2b 53 2c 4f 62 6a 65 63 74 5b 61 65 28 34 39 30 29 5d 5b 61 65 28 35 33 32 29 5d 5b 61 65 28 34 38 39 29 5d 28 49 2c 54 29 29 4b 3d 54 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 61 65 28 34 39 30 29 5d 5b 61 65 28 35 33 32 29 5d 5b 61 65 28 34 38 39 29 5d 28 4a 2c 4b 29 29 7b 69 66 28 32 35 36 3e 4b 5b 61 65 28 35 32 31 29 5d 28 30 29 29 7b 66 6f 72 28 48 3d 30 3b 48 3c 4e 3b 50 3c 3c 3d 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 65 28 35 30 32 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 48 2b 2b 29 3b 66 6f 72 28 55 3d 4b 5b 61 65 28 35 32 31 29 5d 28 30 29 2c 48 3d 30 3b 38 3e 48 3b 50 3d 55 26 31 2e 35 38 7c 50 3c 3c 31 2c 46 2d 31 3d 3d 51 3f 28 51 3d 30 2c Data Ascii: \|\|(I[S]=M++,J[S]=!0),T=K+S,Object[ae(490)][ae(532)][ae(489)](I,T))K=T;else{if(Object[ae(490)][ae(532)][ae(489)](J,K)){if(256>K[ae(521)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[ae(502)](G(P)),P=0):Q++,H++);for(U=K[ae(521)](0),H=0;8>H;P=U&1.58\|P<<1,F-1==Q?(Q=0,
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 7d 2c 27 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 61 66 29 7b 72 65 74 75 72 6e 20 61 66 3d 61 63 2c 6e 75 6c 6c 3d 3d 45 3f 27 27 3a 27 27 3d 3d 45 3f 6e 75 6c 6c 3a 66 2e 69 28 45 5b 61 66 28 34 36 34 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 61 67 29 7b 72 65 74 75 72 6e 20 61 67 3d 61 66 2c 45 5b 61 67 28 35 32 31 29 5d 28 46 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 61 68 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 53 2c 55 2c 54 29 7b 66 6f 72 28 61 68 3d 61 63 2c 48 3d 5b 5d 2c 49 3d 34 2c 4a 3d 34 2c 4b 3d 33 2c 4c 3d 5b 5d 2c 4f 3d 47 28 30 29 2c 50 3d 46 2c 51 3d 31 2c 4d 3d 30 3b 33 3e 4d 3b 48 5b 4d 5d 3d 4d 2c 4d 2b 3d 31 29 3b 66 6f 72 28 52 3d 30 2c 53 3d 4d 61 74 68 Data Ascii: },'j':function(E,af){return af=ac,null==E?'':''==E?null:f.i(E[af(464)],32768,function(F,ag){return ag=af,E[ag(521)](F)})},'i':function(E,F,G,ah,H,I,J,K,L,M,N,O,P,Q,R,S,U,T){for(ah=ac,H=[],I=4,J=4,K=3,L=[],O=G(0),P=F,Q=1,M=0;3>M;H[M]=M,M+=1);for(R=0,S=Math
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 37 28 34 38 33 29 5d 3d 35 65 33 2c 67 5b 61 37 28 35 33 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 61 38 29 7b 61 38 3d 61 37 2c 65 28 61 38 28 34 38 33 29 29 7d 29 2c 67 5b 61 37 28 35 37 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 61 39 29 7b 61 39 3d 61 37 2c 67 5b 61 39 28 35 30 31 29 5d 3e 3d 32 30 30 26 26 67 5b 61 39 28 35 30 31 29 5d 3c 33 30 30 3f 65 28 61 39 28 34 39 32 29 29 3a 65 28 61 39 28 35 36 31 29 2b 67 5b 61 39 28 35 30 31 29 5d 29 7d 2c 67 5b 61 37 28 35 31 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 61 61 29 7b 61 61 3d 61 37 2c 65 28 61 61 28 35 33 34 29 29 7d 2c 67 5b 61 37 28 35 37 33 29 5d 28 42 5b 61 37 28 35 36 39 29 5d 28 4a 53 4f 4e 5b 61 37 28 35 36 35 29 5d 28 64 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 61 69 2c 64 2c 65 2c 66 2c 67 Data Ascii: 7(483)]=5e3,g[a7(538)]=function(a8){a8=a7,e(a8(483))}),g[a7(578)]=function(a9){a9=a7,g[a9(501)]>=200&&g[a9(501)]<300?e(a9(492)):e(a9(561)+g[a9(501)])},g[a7(514)]=function(aa){aa=a7,e(aa(534))},g[a7(573)](B[a7(569)](JSON[a7(565)](d)))}function C(ai,d,e,f,g
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 61 74 6f 72 2c 5f 63 66 5f 63 68 6c 5f 6f 70 74 2c 73 74 72 69 6e 67 2c 6f 6e 6c 6f 61 64 2c 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 2c 6c 65 6e 67 74 68 2c 70 6f 77 2c 6f 62 6a 65 63 74 2c 63 68 6c 41 70 69 55 72 6c 2c 5f 63 66 5f 63 68 6c 5f 6f 70 74 3b 66 74 6c 5a 78 34 3b 42 62 59 70 36 3b 67 73 58 4f 42 32 3b 77 47 77 49 31 3b 74 54 65 77 30 3b 61 6e 79 6a 37 3b 73 54 55 4c 35 3b 53 4c 65 6f 32 3b 45 46 70 47 49 30 3b 48 61 50 72 34 3b 57 6c 67 56 44 31 3b 4d 6a 76 79 31 3b 6c 43 4e 72 50 34 3b 6f 70 6d 65 47 34 3b 51 4d 66 75 76 34 3b 44 69 53 44 34 3b 4e 4c 64 43 32 2c 72 61 6e 64 6f 6d 2c 35 33 33 33 38 38 6f 44 72 62 50 70 2c 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 2c 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2c 66 6c 6f 6f 72 2c 72 65 61 64 79 Data Ascii: ator,_cf_chl_opt,string,onload,display: none,length,pow,object,chlApiUrl,_cf_chl_opt;ftlZx4;BbYp6;gsXOB2;wGwI1;tTew0;anyj7;sTUL5;SLeo2;EFpGI0;HaPr4;WlgVD1;Mjvy1;lCNrP4;opmeG4;QMfuv4;DiSD4;NLdC2,random,533388oDrbPp,contentDocument,contentWindow,floor,ready
2025-03-19 09:59:16 UTC	1181	IN	Data Raw: 27 2e 73 70 6c 69 74 28 27 2c 27 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 6d 7d 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 2c 61 35 29 7b 72 65 74 75 72 6e 20 61 35 3d 57 2c 4d 61 74 68 5b 61 35 28 34 36 39 29 5d 28 29 3c 64 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 64 2c 65 2c 58 29 7b 72 65 74 75 72 6e 20 58 3d 57 2c 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 64 5b 58 28 34 39 35 29 5d 26 26 30 3c 64 5b 58 28 34 39 35 29 5d 5b 58 28 34 39 30 29 5d 5b 58 28 34 39 38 29 5d 5b 58 28 34 38 39 29 5d 28 65 29 5b 58 28 35 32 37 29 5d 28 58 28 35 37 31 29 29 7d 66 75 6e 63 74 69 6f 6e 20 79 28 61 36 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 61 36 3d 57 2c 64 3d 68 5b 61 36 28 35 33 31 29 5d 2c 65 3d 33 36 30 30 2c 66 3d 4d 61 Data Ascii: '.split(','),a=function(){return am},a()}function x(d,a5){return a5=W,Math[a5(469)]()<d}function l(d,e,X){return X=W,e instanceof d[X(495)]&&0<d[X(495)][X(490)][X(498)][X(489)](e)[X(527)](X(571))}function y(a6,d,e,f,g){return a6=W,d=h[a6(531)],e=3600,f=Ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49740	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	546	OUT	POST /report/v4?s=xNDrwjrm8W6wgvKyLOE1a246aPJ%2FXzwiH7c9jp9mPVv9L%2BSi7%2FE%2FM%2FEpMwfjPM81WdbseJxUbT0tIYopXuYF2%2FR8ATjs4t7Ysq3GQQ3dQLQyUBM2tDh5uymrrUIBvjaj%2FeBo9mxOP8x1H70%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 489 Content-Type: application/reports+json Origin: https://hotel-confirm3494729.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:16 UTC	489	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 36 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 68 6f 74 65 6c 2d 63 6f 6e 66 69 72 6d 33 34 39 34 37 32 39 2e 63 6f 6d 2f 70 2f 34 34 37 37 37 31 38 30 37 34 30 30 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 34 38 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 72 65 73 70 6f 6e 73 65 2e 69 6e 76 61 6c 69 64 2e Data Ascii: [{"age":2,"body":{"elapsed_time":160,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://hotel-confirm3494729.com/p/447771807400","sampling_fraction":1.0,"server_ip":"104.21.48.1","status_code":200,"type":"http.response.invalid.
2025-03-19 09:59:16 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 19 Mar 2025 09:59:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49741	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	830	OUT	POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907 HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive Content-Length: 16592 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://hotel-confirm3494729.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:16 UTC	16384	OUT	Data Raw: 4c 48 5a 64 6f 67 75 50 6f 56 5a 6f 35 46 72 75 66 75 4d 44 63 64 67 6a 44 30 51 44 4e 39 4e 6b 6b 67 50 75 65 47 44 41 33 6a 68 33 79 5a 44 57 41 6e 76 72 33 56 75 52 44 35 66 5a 53 61 48 48 44 30 6d 6b 44 32 44 6b 6a 6b 5a 75 44 24 6b 75 36 72 7a 64 6d 56 48 34 2d 78 64 41 33 31 48 51 30 49 52 4d 46 53 73 64 36 31 6f 45 51 4b 75 49 47 41 6d 4e 44 6f 5a 5a 4f 4e 57 67 34 61 44 58 53 61 79 6c 34 44 6c 64 46 57 44 67 45 5a 44 4e 64 67 67 64 31 35 64 4e 44 75 33 44 63 56 4a 44 75 4b 34 44 71 37 50 30 53 48 6e 75 30 6d 61 5a 44 67 37 34 44 67 72 76 63 44 76 67 44 75 34 24 79 42 5a 78 52 51 6a 67 53 67 75 6c 36 51 48 47 6f 31 59 38 6c 41 44 39 64 67 4e 54 43 48 44 50 4a 48 33 46 79 41 62 24 53 44 76 38 6c 6d 31 39 30 64 44 42 6d 39 79 4e 5a 4b 6f 38 6d 56 59 Data Ascii: LHZdoguPoVZo5FrufuMDcdgjD0QDN9NkkgPueGDA3jh3yZDWAnvr3VuRD5fZSaHHD0mkD2DkjkZuD$ku6rzdmVH4-xdA31HQ0IRMFSsd61oEQKuIGAmNDoZZONWg4aDXSayl4DldFWDgEZDNdggd15dNDu3DcVJDuK4Dq7P0SHnu0maZDg74DgrvcDvgDu4$yBZxRQjgSgul6QHGo1Y8lAD9dgNTCHDPJH3FyAb$SDv8lm190dDBm9yNZKo8mVY
2025-03-19 09:59:16 UTC	208	OUT	Data Raw: 5a 44 75 6c 53 69 67 6b 44 24 6b 41 56 67 2b 64 39 39 53 41 35 6e 4a 31 4e 67 32 4e 48 44 4d 69 79 6f 5a 6b 35 74 48 41 62 77 56 5a 4e 62 4a 51 75 39 44 65 55 45 58 31 6b 50 48 55 64 4e 75 6f 48 58 72 71 34 67 57 41 78 74 4c 4e 42 5a 56 34 59 53 4b 4a 30 74 58 63 72 64 30 48 44 6a 6c 41 74 37 6a 4e 4f 45 6f 31 4d 52 74 73 4a 5a 37 44 44 44 6a 75 68 54 59 57 74 48 30 36 4e 36 4e 59 58 47 36 31 69 72 31 4f 71 69 77 45 57 49 6b 4c 69 31 39 76 43 4f 44 66 31 4c 57 63 4f 30 66 77 46 57 42 64 72 69 77 76 64 77 4f 46 37 75 24 64 24 6b 6f 75 75 24 64 65 5a 30 44 44 52 24 6b 42 79 77 79 38 33 68 78 49 57 44 44 44 2d 57 44 44 Data Ascii: ZDulSigkD$kAVg+d99SA5nJ1Ng2NHDMiyoZk5tHAbwVZNbJQu9DeUEX1kPHUdNuoHXrq4gWAxtLNBZV4YSKJ0tXcrd0HDjlAt7jNOEo1MRtsJZ7DDDjuhTYWtH06N6NYXG61ir1OqiwEWIkLi19vCODf1LWcO0fwFWBdriwvdwOF7u$d$kouu$deZ0DDR$kBywy83hxIWDDD-WDD
2025-03-19 09:59:16 UTC	1265	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:16 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=hotel-confirm3494729.com; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=dwH80EVlqoJeJySDkmOZUhiO3DcqLPbEP2Hd7wDrckQ-1742378356-1.2.1.1-spiJsWnT._DaLDoLgjxGyvu4Srjgst.v9fTxYJv2PjKJnbatV6Z6mmSbRWpIaGdezC0HJMWTI54yC99eUgmqiwHlIkNv9s0MUGI0frHfumyW0UBaTRFaqmGZr4TzV5nAouA3j6FM80IjXh.2SJGoeL1bn4nJIMyJPvUu.m8hquJEMkbPDWpQmvcOKXKNQHgM1PUF_zhqktJXyhoPMM2loAq_r3MSvykl04T9dOQEIl.tfxXyrW8y2Q1_H3xW5cYlvYpGE0KCKLvCzb5ZiFVXE2FZOAGLRgmHkotThssjseDKeiawj6buRoFIjuFEL43iDWhi5cVOVIsOtVb8G8gcXx9VZBYO_aDwitzHRb1W44I; Path=/; Expires=Thu, 19-Mar-26 09:59:16 GMT; Domain=hotel-confirm3494729.com; HttpOnly; Secure; SameSite=None; Partitioned Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHsFkUvKvKaznAZXdgbMUQ7WZr1gMMbu2uLv72ruGYMXxvOPsrVIhGe8D7xBcy%2B%2FjzCKdt2aSAmx6QDQV0%2BCSw3iXoq5MeQP2Potz9sP5xBGzvBNeFzeH8KgTd3Oori1cnnIaNxTxdUAPkY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db74c1471af-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 09:59:16 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 38 35 37 26 6d 69 6e 5f 72 74 74 3d 36 36 34 26 72 74 74 5f 76 61 72 3d 33 38 37 26 73 65 6e 74 3d 38 26 72 65 63 76 3d 31 39 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 36 32 26 72 65 63 76 5f 62 79 74 65 73 3d 31 38 30 36 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 34 33 36 31 34 34 35 26 63 77 6e 64 3d 32 34 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 35 63 34 33 38 31 37 65 66 34 35 36 64 63 65 32 26 74 73 3d 33 30 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=857&min_rtt=664&rtt_var=387&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2862&recv_bytes=18060&delivery_rate=4361445&cwnd=246&unsent_bytes=0&cid=5c43817ef456dce2&ts=30&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49743	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	1259	OUT	GET /p/447771807400 HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k; cf_clearance=dwH80EVlqoJeJySDkmOZUhiO3DcqLPbEP2Hd7wDrckQ-1742378356-1.2.1.1-spiJsWnT._DaLDoLgjxGyvu4Srjgst.v9fTxYJv2PjKJnbatV6Z6mmSbRWpIaGdezC0HJMWTI54yC99eUgmqiwHlIkNv9s0MUGI0frHfumyW0UBaTRFaqmGZr4TzV5nAouA3j6FM80IjXh.2SJGoeL1bn4nJIMyJPvUu.m8hquJEMkbPDWpQmvcOKXKNQHgM1PUF_zhqktJXyhoPMM2loAq_r3MSvykl04T9dOQEIl.tfxXyrW8y2Q1_H3xW5cYlvYpGE0KCKLvCzb5ZiFVXE2FZOAGLRgmHkotThssjseDKeiawj6buRoFIjuFEL43iDWhi5cVOVIsOtVb8G8gcXx9VZBYO_aDwitzHRb1W44I
2025-03-19 09:59:16 UTC	848	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PtFZBip%2BRJa%2FgAHaGAgAWPZ1oXTu%2BKrNlICMMuufxt27WjlIkEeOiH7xvDwwhSJjCvn1xcEUEuZhOB8obB8VPNvIes1HQIEakSbIFxiNKdKlIBBfHh4uJMyR%2Bo41zx4cz2ssFo%2FnYt717LM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1db7fb58c244-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=663&min_rtt=573&rtt_var=279&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2862&recv_bytes=1831&delivery_rate=5054101&cwnd=248&unsent_bytes=0&cid=43a1d3fc0f6d4502&ts=247&x=0"
2025-03-19 09:59:16 UTC	521	IN	Data Raw: 32 65 61 39 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 2d 72 75 2d 72 75 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 73 69 7a 65 73 3d 22 61 6e 79 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 65 20 6d 6f 6d 65 6e 74 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 Data Ascii: 2ea9<html lang="en-US" class="lang-ru-ru" dir="ltr"><head> <link rel="icon" href="/favicon.ico" sizes="any"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>One moment</title> <meta http-equiv="X-UA-Comp
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 3a 23 33 31 33 31 33 31 7d 62 75 74 74 6f 6e 2c 20 68 74 6d 6c 0d 0a 0d 0a 20 20 20 20 20 20 20 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 79 73 74 65 6d 2d 75 69 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 41 72 69 61 6c 2c 4e 6f 74 6f 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 2c 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 7b 62 6f 64 79 7b 62 Data Ascii: :#313131}button, html {font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}@media (prefers-color-scheme: dark){body{b
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 45 34 4c 6a 59 78 4e 55 67 78 4e 43 34 34 4e 30 77 78 4e 43 34 31 4e 6a 4d 67 4f 53 34 31 61 44 49 75 4e 7a 67 7a 65 6d 30 74 4d 53 34 77 4f 44 51 67 4d 53 34 30 4d 6a 64 78 4c 6a 59 32 49 44 41 67 4d 53 34 77 4e 54 63 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 Data Ascii: E4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 62 44 30 69 49 30 49 79 4d 45 59 77 4d 79 49 67 5a 44 30 69 54 54 45 32 49 44 4e 68 4d 54 4d 67 4d 54 4d 67 4d 43 41 78 49 44 41 67 4d 54 4d 67 4d 54 4e 42 4d 54 4d 75 4d 44 45 31 49 44 45 7a 4c 6a 41 78 4e 53 41 77 49 44 41 67 4d 43 41 78 4e 69 41 7a 62 54 41 67 4d 6a 52 68 4d 54 45 67 4d 54 45 67 4d 43 41 78 49 44 45 67 4d 54 45 74 4d 54 45 67 4d 54 45 75 4d 44 45 67 4d 54 45 75 4d 44 45 67 4d 43 41 77 49 44 45 74 4d 54 45 67 4d 54 45 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 51 6a 49 77 52 6a 41 7a 49 69 42 6b 50 53 4a 4e 4d 54 63 75 4d 44 4d 34 49 44 45 34 4c 6a 59 78 4e 55 67 78 4e 43 34 34 4e 30 77 78 4e 43 34 31 4e 6a 4d 67 4f 53 34 31 61 44 49 75 4e 7a 67 7a 65 6d 30 74 4d 53 34 77 4f 44 51 67 4d 53 34 30 4d 6a 64 78 4c 6a 59 Data Ascii: bD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a 4d 69 49 67 61 47 56 70 5a 32 68 30 50 53 49 7a 4d 69 49 67 5a 6d 6c 73 62 44 30 69 62 6d 39 75 5a 53 49 2b 50 48 42 68 64 47 67 67 5a 6d 6c 73 62 44 30 69 49 32 5a 6a 4e 54 63 30 59 53 49 67 5a 44 30 69 54 54 45 32 49 44 4e 68 4d 54 4d 67 4d 54 4d 67 4d 43 41 78 49 44 41 67 4d 54 4d 67 4d 54 4e 42 4d 54 4d 75 4d 44 45 31 49 44 45 7a 4c 6a 41 78 4e 53 41 77 49 44 41 67 4d 43 41 78 4e 69 41 7a 62 54 41 67 4d 6a 52 68 4d 54 45 67 4d 54 45 67 4d 43 41 78 49 44 45 67 4d 54 45 74 4d 54 45 67 4d 54 45 75 4d 44 45 67 4d 54 45 75 4d 44 45 67 4d 43 41 77 49 44 45 74 4d 54 45 67 4d 54 45 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a Data Ascii: d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI2ZjNTc0YSIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjZ
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 7b 2e 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 7d 2e 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 7d 2e 63 6f 72 65 2d 6d 73 67 2c 2e 68 32 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 72 65 6d 7d 2e 63 6f 72 65 2d 6d 73 67 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 7d 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 Data Ascii: ){.h1{font-size:1.5rem;line-height:1.75rem}.h2{font-size:1.25rem}.core-msg,.h2{line-height:1.5rem}.core-msg{font-size:1rem}}#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 69 6e 67 2d 6c 65 66 74 3a 34 32 70 78 7d 2e 74 65 78 74 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 70 6f 77 2d 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 31 63 33 3b 62 6f 72 64 65 72 3a 2e 30 36 33 72 65 6d 20 73 6f 6c 69 64 20 23 30 30 35 31 63 33 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 31 33 72 65 6d 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 31 33 72 65 6d 3b 6d 61 72 67 69 6e 3a 32 72 65 6d 20 30 3b 70 61 64 64 69 6e 67 3a 2e 33 37 35 72 65 6d 20 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 2e 32 73 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 Data Ascii: ing-left:42px}.text-center{text-align:center}.pow-button{background-color:#0051c3;border:.063rem solid #0051c3;border-radius:.313rem;color:#fff;font-size:.875rem;line-height:1.313rem;margin:2rem 0;padding:.375rem 1rem;transition-duration:.2s;transition-pr
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 35 72 65 6d 7d 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 64 73 2d 72 69 6e 67 20 31 2e 32 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 2c 30 2c 2e 35 2c 31 29 20 69 6e 66 69 6e 69 74 65 3b 62 6f 72 64 65 72 3a 2e 33 72 65 6d 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 33 31 33 31 33 31 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 34 35 73 7d 2e 6c 64 Data Ascii: 5rem}.lds-ring div{animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:.3rem solid transparent;border-radius:50%;border-top-color:#313131;box-sizing:border-box;display:block;position:absolute}.lds-ring div:first-child{animation-delay:-.45s}.ld
2025-03-19 09:59:16 UTC	1369	IN	Data Raw: 61 6c 2e 68 74 6d 6c 22 20 61 6c 6c 6f 77 3d 22 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 69 73 6f 6c 61 74 65 64 3b 20 66 75 6c 6c 73 63 72 65 65 6e 3b 20 61 75 74 6f 70 6c 61 79 22 20 73 61 6e 64 62 6f 78 3d 22 61 6c 6c 6f 77 2d 73 61 6d 65 2d 6f 72 69 67 69 6e 20 61 6c 6c 6f 77 2d 73 63 72 69 70 74 73 20 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 22 20 69 64 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 6e 79 73 7a 74 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 73 74 79 6c 65 3d 22 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 20 77 69 64 74 68 3a 20 33 30 30 70 78 3b 20 68 65 69 67 68 74 3a 20 36 35 70 78 3b 22 3e 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 Data Ascii: al.html" allow="cross-origin-isolated; fullscreen; autoplay" sandbox="allow-same-origin allow-scripts allow-popups" id="cf-chl-widget-nyszt" tabindex="0" style="border: none; overflow: hidden; width: 300px; height: 65px;"></iframe> <i
2025-03-19 09:59:16 UTC	480	IN	Data Raw: 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 69 6e 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 64 69 61 67 6e 6f 73 74 69 63 2d 77 72 61 70 70 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 61 79 2d 69 64 22 3e 52 61 79 20 49 44 3a 20 3c 63 6f 64 65 3e 33 61 38 34 66 62 64 36 66 34 35 35 37 31 35 39 3c 2f 63 6f 64 65 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65 72 22 20 69 64 3d 22 66 6f 6f 74 65 72 2d 74 65 78 74 22 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 61 6e 64 20 53 65 63 75 72 69 74 79 20 6f 6e 20 74 68 65 20 43 6c 6f 75 64 66 Data Ascii: class="footer-inner"> <div class="clearfix diagnostic-wrapper"> <div class="ray-id">Ray ID: <code>3a84fbd6f4557159</code></div> </div> <div class="text-center" id="footer-text">Performance and Security on the Cloudf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49744	151.101.66.137	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:16 UTC	637	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://hotel-confirm3494729.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Range: bytes=69312-69312 If-Range: "28feccc0-15d9d"
2025-03-19 09:59:16 UTC	661	IN	HTTP/1.1 206 Partial Content Connection: close Content-Length: 1 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Mar 2025 09:59:16 GMT Age: 3619958 X-Served-By: cache-lga21931-LGA, cache-fra-eddf8230056-FRA X-Cache: MISS, HIT X-Cache-Hits: 0, 65 X-Timer: S1742378357.973668,VS0,VE0 Vary: Accept-Encoding Content-Range: bytes 69312-69312/89501
2025-03-19 09:59:16 UTC	1	IN	Data Raw: 3a Data Ascii: :

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49745	151.101.66.137	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:17 UTC	637	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://hotel-confirm3494729.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Range: bytes=69312-89500 If-Range: "28feccc0-15d9d"
2025-03-19 09:59:17 UTC	666	IN	HTTP/1.1 206 Partial Content Connection: close Content-Length: 20189 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Mar 2025 09:59:17 GMT Age: 3619958 X-Served-By: cache-lga21931-LGA, cache-fra-eddf8230087-FRA X-Cache: MISS, HIT X-Cache-Hits: 0, 160 X-Timer: S1742378357.057501,VS0,VE0 Vary: Accept-Encoding Content-Range: bytes 69312-89500/89501
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 3a 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 2b 3d 22 22 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 26 26 28 74 3d 53 2e 6d 61 70 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 22 22 3a 65 2b 22 22 7d 29 29 2c 28 72 3d 53 2e 76 61 6c 48 6f 6f 6b 73 5b 74 68 69 73 2e 74 79 70 65 5d 7c 7c 53 2e 76 61 6c 48 6f 6f 6b 73 5b 74 68 69 73 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 29 26 26 22 73 65 74 22 69 6e 20 72 26 26 76 6f 69 64 20 30 21 3d 3d 72 2e 73 65 74 28 74 68 69 73 2c 74 2c 22 76 61 6c 75 65 22 29 7c 7c 28 74 68 69 73 2e 76 61 6c 75 65 3d 74 29 29 7d 29 29 3a 74 3f 28 72 3d 53 2e 76 61 6c 48 6f 6f 6b 73 5b 74 2e 74 79 70 65 5d 7c 7c 53 2e 76 61 6c 48 6f Data Ascii: :"number"==typeof t?t+="":Array.isArray(t)&&(t=S.map(t,function(e){return null==e?"":e+""})),(r=S.valHooks[this.type]\|\|S.valHooks[this.nodeName.toLowerCase()])&&"set"in r&&void 0!==r.set(this,t,"value")\|\|(this.value=t))})):t?(r=S.valHooks[t.type]\|\|S.valHo
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 6c 2c 63 2c 66 2c 70 3d 5b 6e 7c 7c 45 5d 2c 64 3d 76 2e 63 61 6c 6c 28 65 2c 22 74 79 70 65 22 29 3f 65 2e 74 79 70 65 3a 65 2c 68 3d 76 2e 63 61 6c 6c 28 65 2c 22 6e 61 6d 65 73 70 61 63 65 22 29 3f 65 2e 6e 61 6d 65 73 70 61 63 65 2e 73 70 6c 69 74 28 22 2e 22 29 3a 5b 5d 3b 69 66 28 6f 3d 66 3d 61 3d 6e 3d 6e 7c 7c 45 2c 33 21 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 26 26 38 21 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 26 26 21 6d 74 2e 74 65 73 74 28 64 2b 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 65 64 29 26 26 28 2d 31 3c 64 2e 69 6e 64 65 78 4f 66 28 22 2e 22 29 26 26 28 64 3d 28 68 3d 64 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 73 68 69 66 74 28 29 2c 68 2e 73 6f 72 74 28 29 29 2c 75 3d 64 2e 69 6e 64 65 78 4f 66 28 22 3a 22 29 3c 30 26 26 22 6f 6e 22 2b Data Ascii: l,c,f,p=[n\|\|E],d=v.call(e,"type")?e.type:e,h=v.call(e,"namespace")?e.namespace.split("."):[];if(o=f=a=n=n\|\|E,3!==n.nodeType&&8!==n.nodeType&&!mt.test(d+S.event.triggered)&&(-1<d.indexOf(".")&&(d=(h=d.split(".")).shift(),h.sort()),u=d.indexOf(":")<0&&"on"+
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 6e 74 2c 6e 2c 7b 74 79 70 65 3a 65 2c 69 73 53 69 6d 75 6c 61 74 65 64 3a 21 30 7d 29 3b 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 72 2c 6e 75 6c 6c 2c 74 29 7d 7d 29 2c 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 65 2c 74 2c 74 68 69 73 29 7d 29 7d 2c 74 72 69 67 67 65 72 48 61 6e 64 6c 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 68 69 73 5b 30 5d 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 65 2c 74 2c 6e 2c 21 30 29 7d 7d 29 2c 79 2e 66 6f 63 75 73 69 6e 7c 7c 53 2e 65 61 63 68 28 7b 66 Data Ascii: nt,n,{type:e,isSimulated:!0});S.event.trigger(r,null,t)}}),S.fn.extend({trigger:function(e,t){return this.each(function(){S.event.trigger(e,t,this)})},triggerHandler:function(e,t){var n=this[0];if(n)return S.event.trigger(e,t,n,!0)}}),y.focusin\|\|S.each({f
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 6d 28 74 29 3f 74 28 29 3a 74 3b 72 5b 72 2e 6c 65 6e 67 74 68 5d 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 75 6c 6c 3d 3d 6e 3f 22 22 3a 6e 29 7d 3b 69 66 28 6e 75 6c 6c 3d 3d 65 29 72 65 74 75 72 6e 22 22 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 7c 7c 65 2e 6a 71 75 65 72 79 26 26 21 53 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 65 29 29 53 2e 65 61 63 68 28 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 74 68 69 73 2e 6e 61 6d 65 2c 74 68 69 73 2e 76 61 6c 75 65 29 7d 29 3b 65 6c 73 65 20 66 6f 72 28 6e 20 69 6e 20 65 29 41 74 28 6e 2c 65 5b 6e 5d 2c 74 2c 69 29 3b 72 65 74 75 72 6e Data Ascii: nction(e,t){var n=m(t)?t():t;r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(null==n?"":n)};if(null==e)return"";if(Array.isArray(e)\|\|e.jquery&&!S.isPlainObject(e))S.each(e,function(){i(this.name,this.value)});else for(n in e)At(n,e[n],t,i);return
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 72 7d 72 65 74 75 72 6e 20 6c 28 69 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 7c 7c 21 73 5b 22 2a 22 5d 26 26 6c 28 22 2a 22 29 7d 66 75 6e 63 74 69 6f 6e 20 46 74 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 66 6c 61 74 4f 70 74 69 6f 6e 73 7c 7c 7b 7d 3b 66 6f 72 28 6e 20 69 6e 20 74 29 76 6f 69 64 20 30 21 3d 3d 74 5b 6e 5d 26 26 28 28 69 5b 6e 5d 3f 65 3a 72 7c 7c 28 72 3d 7b 7d 29 29 5b 6e 5d 3d 74 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 72 26 26 53 2e 65 78 74 65 6e 64 28 21 30 2c 65 2c 72 29 2c 65 7d 4d 74 2e 68 72 65 66 3d 62 74 2e 68 72 65 66 2c 53 2e 65 78 74 65 6e 64 28 7b 61 63 74 69 76 65 3a 30 2c 6c 61 73 74 4d 6f 64 69 66 69 65 64 3a 7b 7d 2c 65 74 61 67 3a 7b 7d 2c 61 6a 61 78 53 65 74 74 69 6e Data Ascii: r}return l(i.dataTypes[0])\|\|!s[""]&&l("")}function Ft(e,t){var n,r,i=S.ajaxSettings.flatOptions\|\|{};for(n in t)void 0!==t[n]&&((i[n]?e:r\|\|(r={}))[n]=t[n]);return r&&S.extend(!0,e,r),e}Mt.href=bt.href,S.extend({active:0,lastModified:{},etag:{},ajaxSettin
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 32 5d 29 7d 74 3d 6e 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 20 22 5d 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 6e 75 6c 6c 3a 74 2e 6a 6f 69 6e 28 22 2c 20 22 29 7d 2c 67 65 74 41 6c 6c 52 65 73 70 6f 6e 73 65 48 65 61 64 65 72 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 3f 70 3a 6e 75 6c 6c 7d 2c 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 68 26 26 28 65 3d 73 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 73 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 65 2c 61 5b 65 5d 3d 74 29 2c 74 68 69 73 7d 2c 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e Data Ascii: 2])}t=n[e.toLowerCase()+" "]}return null==t?null:t.join(", ")},getAllResponseHeaders:function(){return h?p:null},setRequestHeader:function(e,t){return null==h&&(e=s[e.toLowerCase()]=s[e.toLowerCase()]\|\|e,a[e]=t),this},overrideMimeType:function(e){return n
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 26 22 3a 22 3f 22 29 2b 22 5f 3d 22 2b 77 74 2e 67 75 69 64 2b 2b 2b 6f 29 2c 76 2e 75 72 6c 3d 66 2b 6f 29 2c 76 2e 69 66 4d 6f 64 69 66 69 65 64 26 26 28 53 2e 6c 61 73 74 4d 6f 64 69 66 69 65 64 5b 66 5d 26 26 54 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 49 66 2d 4d 6f 64 69 66 69 65 64 2d 53 69 6e 63 65 22 2c 53 2e 6c 61 73 74 4d 6f 64 69 66 69 65 64 5b 66 5d 29 2c 53 2e 65 74 61 67 5b 66 5d 26 26 54 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 49 66 2d 4e 6f 6e 65 2d 4d 61 74 63 68 22 2c 53 2e 65 74 61 67 5b 66 5d 29 29 2c 28 76 2e 64 61 74 61 26 26 76 2e 68 61 73 43 6f 6e 74 65 6e 74 26 26 21 31 21 3d 3d 76 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 74 2e 63 6f 6e 74 65 6e 74 54 79 70 65 29 26 26 54 2e 73 65 74 52 65 71 75 Data Ascii: &":"?")+"_="+wt.guid+++o),v.url=f+o),v.ifModified&&(S.lastModified[f]&&T.setRequestHeader("If-Modified-Since",S.lastModified[f]),S.etag[f]&&T.setRequestHeader("If-None-Match",S.etag[f])),(v.data&&v.hasContent&&!1!==v.contentType\|\|t.contentType)&&T.setRequ
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 22 2c 76 2e 64 61 74 61 54 79 70 65 73 29 26 26 53 2e 69 6e 41 72 72 61 79 28 22 6a 73 6f 6e 22 2c 76 2e 64 61 74 61 54 79 70 65 73 29 3c 30 26 26 28 76 2e 63 6f 6e 76 65 72 74 65 72 73 5b 22 74 65 78 74 20 73 63 72 69 70 74 22 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 7b 7d 2c 63 3d 65 2e 64 61 74 61 54 79 70 65 73 2e 73 6c 69 63 65 28 29 3b 69 66 28 63 5b 31 5d 29 66 6f 72 28 61 20 69 6e 20 65 2e 63 6f 6e 76 65 72 74 65 72 73 29 6c 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 65 2e 63 6f 6e 76 65 72 74 65 72 73 5b 61 5d 3b 6f 3d 63 2e 73 68 69 66 74 28 29 3b 77 68 69 6c 65 28 6f 29 69 66 28 65 2e 72 65 73 70 6f 6e 73 65 46 69 65 6c Data Ascii: ",v.dataTypes)&&S.inArray("json",v.dataTypes)<0&&(v.converters["text script"]=function(){}),s=function(e,t,n,r){var i,o,a,s,u,l={},c=e.dataTypes.slice();if(c[1])for(a in e.converters)l[a.toLowerCase()]=e.converters[a];o=c.shift();while(o)if(e.responseFiel
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 53 2e 65 61 63 68 28 5b 22 67 65 74 22 2c 22 70 6f 73 74 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 53 5b 69 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6d 28 74 29 26 26 28 72 3d 72 7c 7c 6e 2c 6e 3d 74 2c 74 3d 76 6f 69 64 20 30 29 2c 53 2e 61 6a 61 78 28 53 2e 65 78 74 65 6e 64 28 7b 75 72 6c 3a 65 2c 74 79 70 65 3a 69 2c 64 61 74 61 54 79 70 65 3a 72 2c 64 61 74 61 3a 74 2c 73 75 63 63 65 73 73 3a 6e 7d 2c 53 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 65 29 26 26 65 29 29 7d 7d 29 2c 53 2e 61 6a 61 78 50 72 65 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 2e 68 65 61 64 65 72 73 29 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3d 3d 3d 74 2e 74 6f 4c Data Ascii: S.each(["get","post"],function(e,i){S[i]=function(e,t,n,r){return m(t)&&(r=r\|\|n,n=t,t=void 0),S.ajax(S.extend({url:e,type:i,dataType:r,data:t,success:n},S.isPlainObject(e)&&e))}}),S.ajaxPrefilter(function(e){var t;for(t in e.headers)"content-type"===t.toL
2025-03-19 09:59:17 UTC	1378	IN	Data Raw: 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 72 20 42 74 3d 7b 30 3a 32 30 30 2c 31 32 32 33 3a 32 30 34 7d 2c 24 74 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 3b 79 2e 63 6f 72 73 3d 21 21 24 74 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 24 74 2c 79 2e 61 6a 61 78 3d 24 74 3d 21 21 24 74 2c 53 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 6f 2c 61 3b 69 66 28 79 2e 63 6f 72 73 7c 7c 24 74 26 26 21 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 29 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 Data Ascii: C.XMLHttpRequest}catch(e){}};var Bt={0:200,1223:204},$t=S.ajaxSettings.xhr();y.cors=!!$t&&"withCredentials"in $t,y.ajax=$t=!!$t,S.ajaxTransport(function(i){var o,a;if(y.cors\|\|$t&&!i.crossDomain)return{send:function(e,t){var n,r=i.xhr();if(r.open(i.type,i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49742	104.21.48.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:17 UTC	1273	OUT	GET /normal.html HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://hotel-confirm3494729.com/p/447771807400 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k; cf_clearance=dwH80EVlqoJeJySDkmOZUhiO3DcqLPbEP2Hd7wDrckQ-1742378356-1.2.1.1-spiJsWnT._DaLDoLgjxGyvu4Srjgst.v9fTxYJv2PjKJnbatV6Z6mmSbRWpIaGdezC0HJMWTI54yC99eUgmqiwHlIkNv9s0MUGI0frHfumyW0UBaTRFaqmGZr4TzV5nAouA3j6FM80IjXh.2SJGoeL1bn4nJIMyJPvUu.m8hquJEMkbPDWpQmvcOKXKNQHgM1PUF_zhqktJXyhoPMM2loAq_r3MSvykl04T9dOQEIl.tfxXyrW8y2Q1_H3xW5cYlvYpGE0KCKLvCzb5ZiFVXE2FZOAGLRgmHkotThssjseDKeiawj6buRoFIjuFEL43iDWhi5cVOVIsOtVb8G8gcXx9VZBYO_aDwitzHRb1W44I
2025-03-19 09:59:17 UTC	924	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Cache-Control: public, max-age=0 Last-Modified: Thu, 07 Nov 2024 13:41:08 GMT cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aB%2BrKKavkK5nIMER%2FzCTc85pY7XtK961ZfolWWZ51Um6FkW5NQ1Dth4QSluodh9c5jS4SRrOU1%2FrMPY9y5K5uEzoA5wbznospYZAr8c50hNUstbRr0Z64ctuRyfCSvcmaRqIPIJ25fx4zV4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1dbbeafa18ef-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=464&min_rtt=408&rtt_var=193&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2861&recv_bytes=1845&delivery_rate=7098039&cwnd=242&unsent_bytes=0&cid=09fca6eb1340e153&ts=700&x=0"
2025-03-19 09:59:17 UTC	445	IN	Data Raw: 37 63 64 38 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 2d 72 75 2d 72 75 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 Data Ascii: 7cd8<!DOCTYPE html><html lang="en-US" class="lang-ru-ru" dir="ltr"><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 74 72 6f 6b 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 30 25 2c 20 31 30 30 Data Ascii: 100% { transform: rotate(360deg); } } @keyframes stroke { 100% { stroke-dashoffset: 0; } } @keyframes scale { 0%, 100
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: } } html { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; } body { margin: 0; background-c
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 73 74 61 67 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 62 72 61 6e 64 69 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 36 70 78 20 30 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 73 70 69 6e Data Ascii: } #challenge-stage { display: flex; } #branding { display: flex; flex-direction: column; margin: 0 16px 0 0; text-align: right; } #spin
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 64 61 73 68 6f 66 66 73 65 74 3a 20 32 34 32 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 33 38 31 32 37 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 74 72 6f 6b 65 20 30 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 35 2c 20 30 2c 20 30 2e 34 35 2c 20 31 29 20 66 6f 72 77 61 72 64 73 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 20 30 2e 35 73 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 20 30 3b 0d 0a 20 20 20 Data Ascii: dashoffset: 242; box-shadow: inset 0 0 0 #038127; animation: stroke 0.4s cubic-bezier(0.65, 0, 0.45, 1) forwards; animation-delay: 0.5s; } .success-circle { stroke-dashoffset: 0;
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d Data Ascii: theme-dark #challenge-overlay a:focus, .theme-dark #challenge-error-text a:hover, .theme-dark #challenge-error-text a:active, .theme-dark #challenge-error-text a:focus { color: #949494; } .theme-
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 65 72 6d 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 65 72 6d 73 20 61 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b Data Ascii: eme-dark #challenge-error-title a:active, .theme-dark #challenge-error-title a:focus { color: #949494; } .theme-dark #terms { color: #bbb; } .theme-dark #terms a { color: #bbb;
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 69 6e 6b 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 2c 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d Data Ascii: ink:focus { color: #949494; } .theme-dark #timeout-refresh-link, .theme-dark #expired-refresh-link { color: #bbb; } .theme-dark #timeout-refresh-link:visited, .theme-dark #timeout-
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 20 23 31 64 31 66 32 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 2c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 76 69 73 69 74 65 64 2c 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 61 63 74 69 76 65 2c 20 23 63 68 61 Data Ascii: #1d1f20; } #challenge-overlay a:visited, #challenge-overlay a:link, #challenge-error-text a:visited, #challenge-error-text a:link { color: #1d1f20; } #challenge-overlay a:active, #cha
2025-03-19 09:59:17 UTC	1369	IN	Data Raw: 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 63 62 2d 6c 62 20 69 6e 70 75 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 70 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 32 34 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 32 34 70 78 3b Data Ascii: } .cb-lb input { position: absolute; top: 20px; left: 18px; opacity: 0; z-index: 9999; cursor: pointer; width: 24px; height: 24px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49746	104.21.64.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:17 UTC	620	OUT	GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.18098906586209224:1742376653:g3Cz6NnbCxn8rmpxnEmVYHsQm7txrAZHxrgrC0S1MJk/922c1db1dd836907 HTTP/1.1 Host: hotel-confirm3494729.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: connect.sid=s%3AQLD7DtYGEFYsfqu0ScbH9cnyjX1TGmtw.8PbmvPxt2N4lo%2BAj4Y7hsIyFbytMpDoOCKMVyfHWG9k
2025-03-19 09:59:17 UTC	753	IN	HTTP/1.1 405 Method Not Allowed Date: Wed, 19 Mar 2025 09:59:17 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KnlK6O3d8StLsRdgIqnEHcCB7Tg2w%2FZgGrSDMcLNNcS1LgP8EEG2XtsLvGcpyWwWttUJpXZcaalJqTSxGcm81CweS07UUWTiXT9YbgV%2BTBvCafPYnKV4riSs%2F6cTdyyI%2FlIi37Nh1Ilc6Mo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922c1dbcce3edbab-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=645&min_rtt=545&rtt_var=276&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2862&recv_bytes=1192&delivery_rate=5313761&cwnd=246&unsent_bytes=0&cid=a045982b44b62cb4&ts=87&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49726	142.250.186.132	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 09:59:18 UTC	587	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCL7VzgEIgNbOAQjB2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 09:59:18 UTC	1348	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 09:59:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-zzDH-oS3R_foMGfMJSZgWw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Document-Policy: expect-no-linked-resources Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-19 09:59:18 UTC	30	IN	Data Raw: 31 36 33 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 63 20 6d 61 67 64 65 62 75 72 67 22 Data Ascii: 1631)]}'["",["sc magdeburg"
2025-03-19 09:59:18 UTC	1378	IN	Data Raw: 2c 22 6e c3 bc 72 6e 62 65 72 67 20 6e 65 75 65 73 20 73 74 61 64 69 6f 6e 22 2c 22 62 61 6d 62 75 20 6c 61 62 20 68 32 64 22 2c 22 67 6f 6f 67 6c 65 20 70 69 78 65 6c 20 39 61 22 2c 22 74 61 72 69 66 76 65 72 68 61 6e 64 6c 75 6e 67 65 6e 20 c3 b6 66 66 65 6e 74 6c 69 63 68 65 6e 20 64 69 65 6e 73 74 22 2c 22 62 79 64 20 61 6b 74 69 65 6e 22 2c 22 7a 64 66 20 6d 65 64 69 61 74 68 65 6b 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 61 6c 65 6d 61 6e 6e 69 61 20 61 61 63 68 65 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 Data Ascii: ,"nrnberg neues stadion","bambu lab h2d","google pixel 9a","tarifverhandlungen ffentlichen dienst","byd aktien","zdf mediathek streaming","alemannia aachen"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinf
2025-03-19 09:59:18 UTC	1378	IN	Data Raw: 45 70 70 65 44 6c 30 5a 31 59 77 64 30 38 78 4f 58 4e 7a 4d 54 4d 79 4b 7a 4d 33 63 6c 67 32 4b 33 70 76 54 56 42 34 5a 6a 56 70 61 6d 35 79 56 6a 6c 70 63 54 5a 54 65 58 51 7a 63 54 6c 6a 62 56 4e 72 56 32 31 4b 5a 6a 46 51 57 6e 70 47 62 56 68 42 65 57 78 7a 4d 31 52 79 54 57 6f 76 53 46 64 54 64 44 64 4c 52 45 74 42 4f 54 6b 33 4e 6a 46 7a 51 30 4a 71 64 79 39 44 4d 58 4e 31 55 6e 42 6c 4e 6d 35 79 54 47 74 30 53 57 34 34 65 6c 42 7a 53 6d 77 79 57 45 74 32 54 31 52 4c 54 55 78 53 63 47 38 77 65 6a 64 49 62 32 78 73 62 55 39 31 52 6c 52 4d 54 6d 46 76 57 45 31 55 4e 30 68 75 52 6a 5a 53 54 31 56 6e 52 6d 4a 73 61 57 46 46 53 7a 52 70 62 47 78 30 5a 6c 6c 55 62 48 6c 32 4d 54 4a 4e 59 6a 41 72 65 46 6c 74 62 30 56 4d 54 6c 64 36 56 58 52 49 64 45 74 54 Data Ascii: EppeDl0Z1Ywd08xOXNzMTMyKzM3clg2K3pvTVB4ZjVpam5yVjlpcTZTeXQzcTljbVNrV21KZjFQWnpGbVhBeWxzM1RyTWovSFdTdDdLREtBOTk3NjFzQ0Jqdy9DMXN1UnBlNm5yTGt0SW44elBzSmwyWEt2T1RLTUxScG8wejdIb2xsbU91RlRMTmFvWE1UN0huRjZST1VnRmJsaWFFSzRpbGx0ZllUbHl2MTJNYjAreFltb0VMTld6VXRIdEtT
2025-03-19 09:59:18 UTC	1378	IN	Data Raw: 53 59 55 64 49 51 33 64 6a 4d 32 31 30 5a 55 31 45 51 7a 5a 4c 65 6c 5a 55 63 31 46 75 65 6a 5a 6c 52 7a 52 4c 64 6e 4d 34 65 55 5a 76 5a 32 68 55 52 33 52 32 4c 30 6c 4c 54 32 46 48 63 44 41 31 5a 32 56 48 61 54 42 70 52 45 78 52 54 30 31 31 54 6d 6c 6a 64 44 45 76 56 46 46 75 51 33 46 30 63 54 6c 71 55 46 42 4e 52 58 52 33 63 33 68 58 4f 45 4e 73 55 46 51 7a 51 6d 77 76 53 46 4e 43 64 46 5a 30 56 56 6f 35 56 6d 46 75 56 6b 52 54 5a 48 4d 31 64 30 35 36 64 44 42 56 4e 31 64 6f 63 48 4e 79 4e 6b 64 54 4c 31 6f 7a 65 6c 46 50 5a 54 64 69 4d 6b 74 59 63 44 56 42 51 55 46 42 51 55 56 73 52 6c 52 72 55 33 56 52 62 55 4e 44 4f 67 78 54 51 79 42 4e 59 57 64 6b 5a 57 4a 31 63 6d 64 4b 42 79 4e 68 4d 7a 41 78 4d 54 46 53 4e 6d 64 7a 58 33 4e 7a 63 44 31 6c 53 6e Data Ascii: SYUdIQ3djM210ZU1EQzZLelZUc1FuejZlRzRLdnM4eUZvZ2hUR3R2L0lLT2FHcDA1Z2VHaTBpRExRT011TmljdDEvVFFuQ3F0cTlqUFBNRXR3c3hXOENsUFQzQmwvSFNCdFZ0VVo5VmFuVkRTZHM1d056dDBVN1docHNyNkdTL1ozelFPZTdiMktYcDVBQUFBQUVsRlRrU3VRbUNDOgxTQyBNYWdkZWJ1cmdKByNhMzAxMTFSNmdzX3NzcD1lSn
2025-03-19 09:59:18 UTC	1378	IN	Data Raw: 6a 4c 32 4a 7a 57 46 51 35 62 69 39 56 55 33 52 70 64 32 52 4a 51 32 30 78 4d 6e 63 79 63 6b 64 68 65 6a 5a 73 62 6e 6c 77 4d 47 74 75 64 48 68 79 5a 30 35 56 51 55 68 70 4f 57 6c 31 63 32 46 55 64 45 74 32 61 6d 64 5a 51 6d 51 32 62 46 56 79 4e 58 46 73 65 6d 55 76 62 57 46 56 53 33 68 59 4e 57 4e 56 57 45 78 35 62 54 64 6b 5a 33 6b 30 4e 6b 51 33 64 56 4e 55 62 58 64 6d 57 57 5a 54 55 6b 64 34 63 30 49 72 64 6c 70 72 5a 6e 68 56 63 6b 5a 52 4d 7a 6c 4a 4d 6d 30 32 5a 31 68 34 4d 58 56 4e 52 54 46 54 65 45 67 32 64 56 4d 7a 51 6e 52 69 61 53 74 51 64 79 38 78 51 56 5a 50 4d 6c 42 78 55 6a 56 54 5a 33 56 69 64 46 5a 36 59 57 70 45 54 54 46 50 5a 79 39 57 62 58 52 6f 55 33 5a 4c 54 6d 64 34 63 7a 5a 74 51 6a 64 72 4d 47 31 36 54 57 30 33 63 7a 56 44 4d 45 Data Ascii: jL2JzWFQ5bi9VU3Rpd2RJQ20xMncyckdhejZsbnlwMGtudHhyZ05VQUhpOWl1c2FUdEt2amdZQmQ2bFVyNXFsemUvbWFVS3hYNWNVWEx5bTdkZ3k0NkQ3dVNUbXdmWWZTUkd4c0IrdlprZnhVckZRMzlJMm02Z1h4MXVNRTFTeEg2dVMzQnRiaStQdy8xQVZPMlBxUjVTZ3VidFZ6YWpETTFPZy9WbXRoU3ZLTmd4czZtQjdrMG16TW03czVDME
2025-03-19 09:59:18 UTC	147	IN	Data Raw: 6e 4e 54 53 6e 59 30 64 53 39 4b 4f 46 56 71 62 56 64 31 63 33 64 59 52 69 38 77 63 47 31 4a 65 54 45 76 53 31 5a 35 4f 54 56 56 65 6b 74 53 52 58 4a 32 57 44 4e 69 4e 45 55 7a 52 6c 4e 4f 5a 46 4d 35 5a 6b 34 35 4e 46 70 43 62 6e 4e 35 4d 55 4e 79 4d 6e 42 48 52 47 74 6a 55 47 70 42 54 54 68 76 65 6d 4a 70 4d 54 56 32 4d 46 52 5a 4c 32 31 54 57 6d 52 44 4e 6c 41 7a 61 44 42 46 5a 55 64 6e 4e 47 5a 48 55 56 6f 31 53 6d 6b 78 54 69 0d 0a Data Ascii: nNTSnY0dS9KOFVqbVd1c3dYRi8wcG1JeTEvS1Z5OTVVektSRXJ2WDNiNEUzRlNOZFM5Zk45NFpCbnN5MUNyMnBHRGtjUGpBTThvemJpMTV2MFRZL21TWmRDNlAzaDBFZUdnNGZHUVo1SmkxTi
2025-03-19 09:59:18 UTC	90	IN	Data Raw: 35 34 0d 0a 73 34 5a 33 64 35 53 6b 39 4b 4e 69 39 4f 53 57 4e 6d 4d 55 68 48 61 6e 6b 72 4d 46 64 71 4c 30 46 4f 61 30 68 68 62 56 55 33 54 57 35 4e 4b 30 46 42 51 55 46 42 52 57 78 47 56 47 74 54 64 56 46 74 51 30 4d 36 45 45 46 73 5a 57 31 68 62 6d 35 70 59 53 0d 0a Data Ascii: 54s4Z3d5Sk9KNi9OSWNmMUhHankrMFdqL0FOa0hhbVU3TW5NK0FBQUFBRWxGVGtTdVFtQ0M6EEFsZW1hbm5pYS
2025-03-19 09:59:18 UTC	492	IN	Data Raw: 31 65 35 0d 0a 42 42 59 57 4e 6f 5a 57 35 4b 42 79 4d 34 4d 6a 63 35 4d 44 6c 53 4f 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 55 55 44 46 55 59 33 64 79 61 6b 45 7a 54 58 70 4b 5a 7a 6c 43 53 6b 6c 36 52 57 35 4f 56 47 4e 36 54 48 6b 77 65 46 56 54 52 58 68 4e 65 6d 74 71 54 6b 46 33 51 6a 5a 51 55 57 74 4c 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 36 37 36 33 31 32 34 33 32 30 38 32 39 39 38 37 31 32 38 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 Data Ascii: 1e5BBYWNoZW5KByM4Mjc5MDlSO2dzX3NzcD1lSnpqNHRUUDFUY3dyakEzTXpKZzlCSkl6RW5OVGN6THkweFVTRXhNemtqTkF3QjZQUWtLcAc\u003d","zl":10002}],"google:suggesteventid":"6763124320829987128","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:su
2025-03-19 09:59:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	63910	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:00:16 UTC	563	OUT	OPTIONS /report/v4?s=aB%2BrKKavkK5nIMER%2FzCTc85pY7XtK961ZfolWWZ51Um6FkW5NQ1Dth4QSluodh9c5jS4SRrOU1%2FrMPY9y5K5uEzoA5wbznospYZAr8c50hNUstbRr0Z64ctuRyfCSvcmaRqIPIJ25fx4zV4%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://hotel-confirm3494729.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:00:16 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 19 Mar 2025 10:00:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	63911	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:00:16 UTC	565	OUT	OPTIONS /report/v4?s=KnlK6O3d8StLsRdgIqnEHcCB7Tg2w%2FZgGrSDMcLNNcS1LgP8EEG2XtsLvGcpyWwWttUJpXZcaalJqTSxGcm81CweS07UUWTiXT9YbgV%2BTBvCafPYnKV4riSs%2F6cTdyyI%2FlIi37Nh1Ilc6Mo%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://hotel-confirm3494729.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:00:16 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 19 Mar 2025 10:00:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	63912	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:00:16 UTC	538	OUT	POST /report/v4?s=aB%2BrKKavkK5nIMER%2FzCTc85pY7XtK961ZfolWWZ51Um6FkW5NQ1Dth4QSluodh9c5jS4SRrOU1%2FrMPY9y5K5uEzoA5wbznospYZAr8c50hNUstbRr0Z64ctuRyfCSvcmaRqIPIJ25fx4zV4%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 945 Content-Type: application/reports+json Origin: https://hotel-confirm3494729.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:00:16 UTC	945	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 37 39 35 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 34 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 68 6f 74 65 6c 2d 63 6f 6e 66 69 72 6d 33 34 39 34 37 32 39 2e 63 6f 6d 2f 70 2f 34 34 37 37 37 31 38 30 37 34 30 30 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 34 38 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 Data Ascii: [{"age":59795,"body":{"elapsed_time":148,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://hotel-confirm3494729.com/p/447771807400","sampling_fraction":1.0,"server_ip":"104.21.48.1","status_code":404,"type":"http.error"},"type
2025-03-19 10:00:16 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 19 Mar 2025 10:00:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	63913	35.190.80.1	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:00:16 UTC	540	OUT	POST /report/v4?s=KnlK6O3d8StLsRdgIqnEHcCB7Tg2w%2FZgGrSDMcLNNcS1LgP8EEG2XtsLvGcpyWwWttUJpXZcaalJqTSxGcm81CweS07UUWTiXT9YbgV%2BTBvCafPYnKV4riSs%2F6cTdyyI%2FlIi37Nh1Ilc6Mo%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 524 Content-Type: application/reports+json Origin: https://hotel-confirm3494729.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:00:16 UTC	524	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 38 37 33 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 36 34 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 68 6f 74 65 6c 2d 63 6f 6e 66 69 72 6d 33 Data Ascii: [{"age":58737,"body":{"elapsed_time":138,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.64.1","status_code":405,"type":"http.error"},"type":"network-error","url":"https://hotel-confirm3
2025-03-19 10:00:16 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 19 Mar 2025 10:00:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	1
Start time:	05:59:03
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:59:07
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2392,i,18123601365568351909,5093385921271692729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:59:14
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us.sa/xPuEb"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://us.sa/xPuEb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5548, Parent PID: 3448

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Windows Analysis Report
https://us.sa/xPuEb