Edit tour

Windows Analysis Report
http://project-may10.pages.dev/

Overview

General Information

Sample URL:	http://project-may10.pages.dev/
Analysis ID:	1521156
Infos:

Detection

HTMLPhisher, TechSupportScam

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected BlockedWebSite

Yara detected TechSupportScam

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://project-may10.pages.dev/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
dropped/chromecache_44	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
dropped/chromecache_43	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
dropped/chromecache_46	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.1.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
0.0.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://project-may10.pages.dev/

SlashNext: detection malicious, Label: Scareware type: Phishing & Social usering

Multi AV Scanner detection for domain / URL

Source: project-may10.pages.dev

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: http://project-may10.pages.dev/

Virustotal: Detection: 10%

Perma Link

Phishing

Yara detected BlockedWebSite

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_44, type: DROPPED

Yara detected TechSupportScam

Source: Yara match	File source: dropped/chromecache_43, type: DROPPED
Source: Yara match	File source: dropped/chromecache_46, type: DROPPED

Source: https://project-may10.pages.dev/	HTTP Parser: No favicon
Source: https://project-may10.pages.dev/	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49739 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49745 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49739 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: project-may10.pages.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: project-may10.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://project-may10.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: project-may10.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://project-may10.pages.dev/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: project-may10.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://project-may10.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: project-may10.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: project-may10.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dZTvWG6rc9URFDZ&MD=R+UUTuZ4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dZTvWG6rc9URFDZ&MD=R+UUTuZ4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: project-may10.pages.dev
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_43.2.dr, chromecache_46.2.dr	String found in binary or memory: https://code.jquery.com/jquery-1.4.4.min.js
Source: chromecache_43.2.dr, chromecache_46.2.dr	String found in binary or memory: https://ipwho.is/?lang=en
Source: chromecache_43.2.dr, chromecache_46.2.dr	String found in binary or memory: https://www.clarity.ms/tag/
Source: chromecache_44.2.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: chromecache_44.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: chromecache_43.2.dr, chromecache_46.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-xxx-x

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49745 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected TechSupportScam

Source: Yara match	File source: dropped/chromecache_43, type: DROPPED
Source: Yara match	File source: dropped/chromecache_46, type: DROPPED

Source: classification engine

Classification label: mal80.phis.win@17/10@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://project-may10.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://project-may10.pages.dev/	10%	Virustotal		Browse
http://project-may10.pages.dev/	100%	SlashNext	Scareware type: Phishing & Social usering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
project-may10.pages.dev	10%	Virustotal	Browse

URLs

Source	Detection	Scanner	Link
https://ipwho.is/?lang=en	0%	Virustotal	Browse
https://code.jquery.com/jquery-1.4.4.min.js	1%	Virustotal	Browse
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Virustotal	Browse
https://www.clarity.ms/tag/	0%	Virustotal	Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.74.196	true	false	0%, Virustotal, Browse	unknown
project-may10.pages.dev	172.66.44.124	true	false	10%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
https://project-may10.pages.dev/cdn-cgi/styles/cf.errors.css	false	unknown
https://project-may10.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637	false	unknown
https://project-may10.pages.dev/	false	unknown
https://project-may10.pages.dev/favicon.ico	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	chromecache_44.2.dr	false	0%, Virustotal, Browse	unknown
https://ipwho.is/?lang=en	chromecache_43.2.dr, chromecache_46.2.dr	false	0%, Virustotal, Browse	unknown
https://code.jquery.com/jquery-1.4.4.min.js	chromecache_43.2.dr, chromecache_46.2.dr	false	1%, Virustotal, Browse	unknown
https://www.clarity.ms/tag/	chromecache_43.2.dr, chromecache_46.2.dr	false	0%, Virustotal, Browse	unknown
https://www.cloudflare.com/5xx-error-landing	chromecache_44.2.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.66.44.124	project-may10.pages.dev	United States	13335	CLOUDFLARENETUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521156
Start date and time:	2024-09-28 05:10:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://project-may10.pages.dev/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@17/10@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.174, 64.233.184.84, 34.104.35.123, 192.229.221.95, 20.3.187.198, 93.184.221.240, 142.250.185.131
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://project-may10.pages.dev/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://project-may10.pages.dev/ Model: jbxai	{ "brand":["Cloudflare"], "contains_trigger_text":true, "trigger_text":"This website has been reported for potential phishing. Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.", "prominent_button_name":"Learn More", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 43

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (522)
Category:	dropped
Size (bytes):	24826
Entropy (8bit):	4.620225065066007
Encrypted:	false
SSDEEP:	384:7MLzDcD2sNHNB+7OrXdzmGQBByP5EEDzEDi/ihH:oLp6tB+74XdzmG8yP5EEDzEm6hH
MD5:	FBCEDC9AED3034A38FDFF5260941CFC9
SHA1:	5B9C9E741605EF67675DECFB4CD3EE21E343C3E9
SHA-256:	A827671816C5CA53F7F383665AFBF14B29ACD817D97F0BD1FBA5E907CEE6E1EA
SHA-512:	1CCFCA33A9C8413BEDFF3320B443B428BA2B5125972BDA270DC2EB3CD8B9AE195053A73043E87E5A1F628543C6E53427453A0EB92FA452412A2F52D972E2CB0B
Malicious:	false
Reputation:	low
Preview:	.<html lang="en">. <head>. <meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,shrink-to-fit=no" name="viewport">. <meta content="noindex,nofollow" name="robots">. <title>Computer Err00r Code #B87AmP100d87</title>. <link href="msmm.png" rel="icon" id="favicon" type="image/png">. <link href="tapa.css" rel="stylesheet">.. <script type='text/javascript' src="https://code.jquery.com/jquery-1.4.4.min.js"></script>. <script type="text/javascript">//<![CDATA[. $(function(){. $('body').bind('contextmenu', function(e){. return false;. });. });// . </script>.<script type="text/javascript">. (function(c,l,a,r,i,t,y){. c[a]=c[a]\|\|function(){(c[a].q=c[a].q\|\|[]).push(arguments)};. t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;. y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);. })(window, document, "clarity", "script", "milyfyjki4");.</script>. Google tag (gtag.js) -->.

Chrome Cache Entry: 44

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	downloaded
Size (bytes):	4394
Entropy (8bit):	5.089240897577867
Encrypted:	false
SSDEEP:	96:1j9jwIjYjUDK/D5DMF+BOis35A2ZLimWrR49PaQxJbGD:1j9jhjYjIK/Vo+ts3zZOmWrO9ieJGD
MD5:	13008AAD26DAD16081E57E836C058556
SHA1:	613EB8316CC399F5C72059A1A15B0978EA670FCD
SHA-256:	A683DE3F63F8826871D53FB3E0C8BC33B343936E54271B21D961FC8D2BFF8B01
SHA-512:	DB904E6D70B48BCE3C703B807F564E3120064BF9D013B6CF93840C6B308644DBCB470B33F697B4A7811F4EEAD6861E58D5C5AF19013EFAAE846ADD6FD2789005
Malicious:	false
Reputation:	low
URL:	https://project-may10.pages.dev/
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded

Chrome Cache Entry: 45

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 46

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	24826
Entropy (8bit):	4.620225065066007
Encrypted:	false
SSDEEP:	384:7MLzDcD2sNHNB+7OrXdzmGQBByP5EEDzEDi/ihH:oLp6tB+74XdzmG8yP5EEDzEm6hH
MD5:	FBCEDC9AED3034A38FDFF5260941CFC9
SHA1:	5B9C9E741605EF67675DECFB4CD3EE21E343C3E9
SHA-256:	A827671816C5CA53F7F383665AFBF14B29ACD817D97F0BD1FBA5E907CEE6E1EA
SHA-512:	1CCFCA33A9C8413BEDFF3320B443B428BA2B5125972BDA270DC2EB3CD8B9AE195053A73043E87E5A1F628543C6E53427453A0EB92FA452412A2F52D972E2CB0B
Malicious:	false
Reputation:	low
URL:	https://project-may10.pages.dev/favicon.ico
Preview:	.<html lang="en">. <head>. <meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,shrink-to-fit=no" name="viewport">. <meta content="noindex,nofollow" name="robots">. <title>Computer Err00r Code #B87AmP100d87</title>. <link href="msmm.png" rel="icon" id="favicon" type="image/png">. <link href="tapa.css" rel="stylesheet">.. <script type='text/javascript' src="https://code.jquery.com/jquery-1.4.4.min.js"></script>. <script type="text/javascript">//<![CDATA[. $(function(){. $('body').bind('contextmenu', function(e){. return false;. });. });// . </script>.<script type="text/javascript">. (function(c,l,a,r,i,t,y){. c[a]=c[a]\|\|function(){(c[a].q=c[a].q\|\|[]).push(arguments)};. t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;. y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);. })(window, document, "clarity", "script", "milyfyjki4");.</script>. Google tag (gtag.js) -->.

Chrome Cache Entry: 47

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
URL:	https://project-may10.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 48

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24050)
Category:	downloaded
Size (bytes):	24051
Entropy (8bit):	4.941039417164537
Encrypted:	false
SSDEEP:	192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk
MD5:	5E8C69A459A691B5D1B9BE442332C87D
SHA1:	F24DD1AD7C9080575D92A9A9A2C42620725EF836
SHA-256:	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
SHA-512:	6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42
Malicious:	false
Reputation:	low
URL:	https://project-may10.pages.dev/cdn-cgi/styles/cf.errors.css
Preview:	#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-w

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 05:10:50.822371006 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:10:50.869216919 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:10:51.181817055 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:10:59.779927015 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:10:59.780054092 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:10:59.780517101 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:10:59.781037092 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:10:59.781063080 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.480927944 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:00.492737055 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:00.576469898 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:00.576613903 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:00.576689959 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:00.576981068 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:00.577007055 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:00.582866907 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.582951069 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.588902950 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.588924885 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.590850115 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.592597961 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.592659950 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.592674017 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.592854023 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.639403105 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.764439106 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.764673948 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.765038967 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.765754938 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.765783072 CEST	443	49715	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:00.765795946 CEST	49715	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:00.871098995 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:01.055016994 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.055737019 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.055767059 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.057332039 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.057420015 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.061521053 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.061549902 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.061608076 CEST	443	49716	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.061659098 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.061686993 CEST	49716	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.061995983 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.062067032 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.062131882 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.062319040 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.062335014 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.532113075 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.532821894 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.532860994 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.534286976 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.534364939 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.536556005 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.536638975 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.537542105 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.537549019 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.591057062 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.647238970 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.647468090 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.647532940 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.647582054 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.647658110 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.647707939 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.647716999 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.647968054 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.648025036 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.657344103 CEST	49717	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.657381058 CEST	443	49717	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.835555077 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.835633039 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:01.835696936 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.836119890 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:01.836143017 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.325715065 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.367141008 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.398439884 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:02.398550034 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:02.711074114 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.711182117 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.712398052 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.712498903 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715013027 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715048075 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715100050 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.715274096 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715306997 CEST	443	49720	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.715332985 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715357065 CEST	49720	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715862989 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.715908051 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:02.715970039 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.716293097 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:02.716305971 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.169687986 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.170150042 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.170176983 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.170556068 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.170870066 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.170928001 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.171010017 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.215401888 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.219566107 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.284245014 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284333944 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284368992 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284401894 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284434080 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284436941 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.284451962 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284466028 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.284508944 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.284516096 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284632921 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.284683943 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.284689903 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.288950920 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.288975000 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.289098024 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.289109945 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.289171934 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370157957 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370209932 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370268106 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370284081 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370460987 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370584965 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370590925 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370683908 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370759010 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370759964 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.370804071 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370954990 CEST	49721	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.370969057 CEST	443	49721	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.439004898 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:03.439109087 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:03.439188957 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:03.440310955 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:03.440350056 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:03.686186075 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.686269999 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:03.686461926 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.687299967 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:03.687318087 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.065125942 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.065151930 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:04.065274954 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.068681002 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.068695068 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:04.073187113 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:04.074018002 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:04.074078083 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:04.075119019 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:04.075175047 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:04.077472925 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:04.077545881 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:04.117024899 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:04.117048979 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:04.141063929 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.142047882 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.142061949 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.142955065 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.143023014 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.143764973 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.143825054 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.143855095 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.143954992 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.143965960 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.143985987 CEST	443	49723	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.144021988 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144040108 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144041061 CEST	49723	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144433022 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144463062 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.144674063 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144906998 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.144913912 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.163878918 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:04.602169037 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.602700949 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.602710009 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.603637934 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.603740931 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.604150057 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.604195118 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.604285955 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.604290962 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.650739908 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.725537062 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:04.725617886 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.728341103 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.728349924 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:04.728565931 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:04.738643885 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.738704920 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.738799095 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.753550053 CEST	49726	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:04.753565073 CEST	443	49726	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:04.777960062 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.778636932 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:04.823414087 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.001725912 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.001806974 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.001940012 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.025547981 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.025604963 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.025665045 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.030086994 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.030107975 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.256100893 CEST	49725	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.256125927 CEST	443	49725	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.323998928 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.324049950 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.324153900 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.325139999 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.325153112 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.331139088 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.331165075 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.331285000 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.331664085 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.331672907 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.505827904 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.519216061 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.519254923 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.520262957 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.520327091 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.530330896 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.530352116 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.530411005 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.530442953 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.530599117 CEST	443	49727	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.530647039 CEST	49727	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.531188965 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.531220913 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.531362057 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.532265902 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.532278061 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.785909891 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.786606073 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.786621094 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.788125038 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.788248062 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.789273024 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.789273024 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.789340019 CEST	443	49729	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.789386034 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.789386034 CEST	49729	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.790270090 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.790328026 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.790396929 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.790956974 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.790973902 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.980803013 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:05.980884075 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:05.989377975 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.989993095 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.990009069 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.990331888 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.991909981 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:05.991974115 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:05.992337942 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.028939009 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.028965950 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.029249907 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.035444975 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.071352005 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.127707005 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.167363882 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.167726040 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.167762995 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.167772055 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.167783022 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.167840958 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.167939901 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168061972 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168142080 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.168148041 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168742895 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168771982 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168798923 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.168807030 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.168878078 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.172694921 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.175403118 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.211980104 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.211987019 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.254869938 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.254918098 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.254940987 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.254952908 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.254961967 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255017042 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255016088 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.255026102 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255065918 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255072117 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.255084038 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255136967 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.255181074 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.255269051 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.258752108 CEST	49730	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.258770943 CEST	443	49730	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.276755095 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.277517080 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.277616978 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.279129028 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.279194117 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.317284107 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.317364931 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.317419052 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.320681095 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.320974112 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.323631048 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.323690891 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.332629919 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.332664013 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.332690001 CEST	49728	443	192.168.2.6	184.28.90.27
Sep 28, 2024 05:11:06.332695961 CEST	443	49728	184.28.90.27	192.168.2.6
Sep 28, 2024 05:11:06.376082897 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.376135111 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.376197100 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.376981020 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.377002001 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.399477959 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.421849012 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.422043085 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.422137022 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.422950983 CEST	49731	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.423005104 CEST	443	49731	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.840461969 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.840811014 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.840838909 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.841737032 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.841809988 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842258930 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842283010 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842328072 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842328072 CEST	443	49732	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.842408895 CEST	49732	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842660904 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.842693090 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:06.842866898 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.843322992 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:06.843331099 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.310000896 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.345875978 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.345892906 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.346467972 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.347790003 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.347868919 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.348099947 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.391407967 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.483772039 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.483867884 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.483942986 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.483957052 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484193087 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484230995 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484272957 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.484278917 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484289885 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484317064 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.484381914 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.484426022 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.484431982 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.488490105 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.489289045 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.489295959 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.540096998 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.572238922 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572328091 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572370052 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572408915 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572444916 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572480917 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572509050 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.572509050 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.572520018 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572561979 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.572567940 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572606087 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.572611094 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.572766066 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.573359013 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.647356033 CEST	49733	443	192.168.2.6	172.66.44.124
Sep 28, 2024 05:11:07.647392988 CEST	443	49733	172.66.44.124	192.168.2.6
Sep 28, 2024 05:11:07.871455908 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:07.871552944 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:07.871633053 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:07.872644901 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:07.872678041 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.684788942 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.684900999 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.686579943 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.686604977 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.686863899 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.688764095 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.688764095 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.688807964 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.688920975 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.735411882 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.869434118 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.869636059 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.869961023 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.869961023 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:08.870045900 CEST	443	49734	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:08.870098114 CEST	49734	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:11.044467926 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.044544935 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:11.044614077 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.046375036 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.046392918 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:11.809880018 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:11.809978008 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.813071012 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.813087940 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:11.813332081 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:11.868328094 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:11.969906092 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.015408039 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223069906 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223088980 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223092079 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223155022 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223179102 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223186970 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223202944 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.223227024 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223237991 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223248005 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.223248005 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.223275900 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.223293066 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.223299980 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.223325968 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.239725113 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.239758015 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:12.239774942 CEST	49735	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:12.239782095 CEST	443	49735	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:13.232296944 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.232419014 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.233464003 CEST	49739	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.233570099 CEST	443	49739	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:13.233658075 CEST	49739	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.234051943 CEST	49739	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.234082937 CEST	443	49739	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:13.237354040 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:13.237379074 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:13.830957890 CEST	443	49739	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:13.831024885 CEST	49739	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:13.973467112 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:13.973524094 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:13.973614931 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:15.595416069 CEST	49722	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:11:15.595447063 CEST	443	49722	142.250.74.196	192.168.2.6
Sep 28, 2024 05:11:20.110369921 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.110394955 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.110512972 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.111175060 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.111185074 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.924474001 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.924700975 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.929244041 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.929255962 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.930084944 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.932625055 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.932625055 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.932646036 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:20.932837009 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:20.979415894 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:21.135371923 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:21.135617971 CEST	443	49740	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:21.135865927 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:21.135865927 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:21.135893106 CEST	49740	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:33.130394936 CEST	443	49739	173.222.162.64	192.168.2.6
Sep 28, 2024 05:11:33.130832911 CEST	49739	443	192.168.2.6	173.222.162.64
Sep 28, 2024 05:11:39.079602003 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.079664946 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.079745054 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.080498934 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.080516100 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.861423969 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.861502886 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.864490986 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.864500999 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.865384102 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.868364096 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.868654013 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.868659973 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:39.868885994 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:39.911458969 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:40.044354916 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:40.044473886 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:40.044573069 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:40.045083046 CEST	49741	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:11:40.045103073 CEST	443	49741	40.113.110.67	192.168.2.6
Sep 28, 2024 05:11:48.891505003 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:48.891554117 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:48.891716957 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:48.892163992 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:48.892179012 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:49.703593969 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:49.703749895 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:49.705471992 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:49.705483913 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:49.705821037 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:49.747199059 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:49.787409067 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031697989 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031728983 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031740904 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031758070 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031785011 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.031790972 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031810045 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.031822920 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.031843901 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.031855106 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.032526016 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.032561064 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.032587051 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.032594919 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.032618999 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.033126116 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.033174992 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.037240028 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.037257910 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:11:50.037271023 CEST	49742	443	192.168.2.6	4.245.163.56
Sep 28, 2024 05:11:50.037276030 CEST	443	49742	4.245.163.56	192.168.2.6
Sep 28, 2024 05:12:03.469016075 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:03.469069958 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:03.469273090 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:03.469794035 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:03.469805002 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:03.613928080 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:03.613976955 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:03.615274906 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:03.617300987 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:03.617311954 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.116610050 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:04.117665052 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:04.117695093 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:04.117981911 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:04.119525909 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:04.119584084 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:04.164786100 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:04.432275057 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.432341099 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.436078072 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.436104059 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.436347961 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.439786911 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.440073013 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.440082073 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.440288067 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.483412027 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.614696026 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.614799976 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:04.614856005 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.615330935 CEST	49745	443	192.168.2.6	40.113.110.67
Sep 28, 2024 05:12:04.615360975 CEST	443	49745	40.113.110.67	192.168.2.6
Sep 28, 2024 05:12:14.034816027 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:14.034881115 CEST	443	49744	142.250.74.196	192.168.2.6
Sep 28, 2024 05:12:14.034969091 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:15.249357939 CEST	49744	443	192.168.2.6	142.250.74.196
Sep 28, 2024 05:12:15.249397039 CEST	443	49744	142.250.74.196	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 05:10:59.013634920 CEST	53	55747	1.1.1.1	192.168.2.6
Sep 28, 2024 05:10:59.076693058 CEST	53	63841	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:00.252054930 CEST	53	49865	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:00.548897028 CEST	53192	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:00.549048901 CEST	59656	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:00.559511900 CEST	53	53192	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:00.559840918 CEST	53	59656	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:00.564336061 CEST	62708	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:00.564495087 CEST	49758	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:00.574569941 CEST	53	62708	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:00.576033115 CEST	53	49758	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:03.421494007 CEST	54478	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:03.421917915 CEST	61813	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:03.428185940 CEST	53	54478	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:03.428533077 CEST	53	61813	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:05.319077969 CEST	61692	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:05.319272995 CEST	54248	53	192.168.2.6	1.1.1.1
Sep 28, 2024 05:11:05.329440117 CEST	53	61692	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:05.329514027 CEST	53	54248	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:17.548432112 CEST	53	54181	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:36.756417990 CEST	53	63613	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:58.580228090 CEST	53	60163	1.1.1.1	192.168.2.6
Sep 28, 2024 05:11:59.219156027 CEST	53	65167	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 05:11:00.548897028 CEST	192.168.2.6	1.1.1.1	0x2321	Standard query (0)	project-may10.pages.dev	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.549048901 CEST	192.168.2.6	1.1.1.1	0xd119	Standard query (0)	project-may10.pages.dev	65	IN (0x0001)	false
Sep 28, 2024 05:11:00.564336061 CEST	192.168.2.6	1.1.1.1	0x956b	Standard query (0)	project-may10.pages.dev	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.564495087 CEST	192.168.2.6	1.1.1.1	0x2a0	Standard query (0)	project-may10.pages.dev	65	IN (0x0001)	false
Sep 28, 2024 05:11:03.421494007 CEST	192.168.2.6	1.1.1.1	0xf24c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:03.421917915 CEST	192.168.2.6	1.1.1.1	0xa17e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 28, 2024 05:11:05.319077969 CEST	192.168.2.6	1.1.1.1	0x2b61	Standard query (0)	project-may10.pages.dev	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:05.319272995 CEST	192.168.2.6	1.1.1.1	0x1c20	Standard query (0)	project-may10.pages.dev	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 05:11:00.559511900 CEST	1.1.1.1	192.168.2.6	0x2321	No error (0)	project-may10.pages.dev		172.66.44.124	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.559511900 CEST	1.1.1.1	192.168.2.6	0x2321	No error (0)	project-may10.pages.dev		172.66.47.132	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.559840918 CEST	1.1.1.1	192.168.2.6	0xd119	No error (0)	project-may10.pages.dev			65	IN (0x0001)	false
Sep 28, 2024 05:11:00.574569941 CEST	1.1.1.1	192.168.2.6	0x956b	No error (0)	project-may10.pages.dev		172.66.44.124	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.574569941 CEST	1.1.1.1	192.168.2.6	0x956b	No error (0)	project-may10.pages.dev		172.66.47.132	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:00.576033115 CEST	1.1.1.1	192.168.2.6	0x2a0	No error (0)	project-may10.pages.dev			65	IN (0x0001)	false
Sep 28, 2024 05:11:03.428185940 CEST	1.1.1.1	192.168.2.6	0xf24c	No error (0)	www.google.com		142.250.74.196	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:03.428533077 CEST	1.1.1.1	192.168.2.6	0xa17e	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 28, 2024 05:11:05.329440117 CEST	1.1.1.1	192.168.2.6	0x2b61	No error (0)	project-may10.pages.dev		172.66.44.124	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:05.329440117 CEST	1.1.1.1	192.168.2.6	0x2b61	No error (0)	project-may10.pages.dev		172.66.47.132	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:05.329514027 CEST	1.1.1.1	192.168.2.6	0x1c20	No error (0)	project-may10.pages.dev			65	IN (0x0001)	false
Sep 28, 2024 05:11:11.603009939 CEST	1.1.1.1	192.168.2.6	0x9eb8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 05:11:11.603009939 CEST	1.1.1.1	192.168.2.6	0x9eb8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:32.769701958 CEST	1.1.1.1	192.168.2.6	0x3027	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 05:11:32.769701958 CEST	1.1.1.1	192.168.2.6	0x3027	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

project-may10.pages.dev

https:

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49715	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 50 38 48 55 6c 64 42 2f 55 65 57 67 74 37 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 63 30 65 63 39 34 32 39 37 33 30 34 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IP8HUldB/UeWgt7b.1Context: 24c0ec94297304cf
2024-09-28 03:11:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 03:11:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 50 38 48 55 6c 64 42 2f 55 65 57 67 74 37 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 63 30 65 63 39 34 32 39 37 33 30 34 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: IP8HUldB/UeWgt7b.2Context: 24c0ec94297304cf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-09-28 03:11:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 50 38 48 55 6c 64 42 2f 55 65 57 67 74 37 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 63 30 65 63 39 34 32 39 37 33 30 34 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IP8HUldB/UeWgt7b.3Context: 24c0ec94297304cf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 03:11:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 03:11:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 66 71 55 62 47 67 32 58 6b 69 7a 64 72 69 65 41 39 43 59 39 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: JfqUbGg2XkizdrieA9CY9Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:01 UTC	666	OUT	GET / HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:01 UTC	606	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2FuQ3xg9ccFqkfxauLRiVDU%2BCfG6U2nxAipucdAr6NV9yCZ7IdzlCA8ZyO5e%2BQbEsCWYlHmBVo%2BLH53ie6bZa6U4pWVaqBFyveG0QQC8ltBhZlj0NuyPqRSBUcP8f45ckoSr5RVfOYQO7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8ca08b32fde54239-EWR
2024-09-28 03:11:01 UTC	763	IN	Data Raw: 31 31 32 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112a<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-28 03:11:01 UTC	1369	IN	Data Raw: 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 Data Ascii: tylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function
2024-09-28 03:11:01 UTC	1369	IN	Data Raw: 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 4b 6a 42 75 56 59 62 46 6f 6c 64 36 77 39 4f 47 31 43 42 6a 34 53 57 4b 76 76 6d 39 78 48 36 6d 54 50 4a 33 4a 50 73 58 65 71 77 2d 31 37 32 37 34 39 33 30 36 31 2d 30 2e 30 2e 31 2e 31 2d 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 Data Ascii: i/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="KjBuVYbFold6w9OG1CBj4SWKvvm9xH6mTPJ3JPsXeqw-1727493061-0.0.1.1-/"> <a href="https://www.cloudflare.com/learning/a
2024-09-28 03:11:01 UTC	901	IN	Data Raw: 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 Data Ascii: 3.33</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-la
2024-09-28 03:11:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49721	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:03 UTC	573	OUT	GET /cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://project-may10.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:03 UTC	411	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:03 GMT Content-Type: text/css Content-Length: 24051 Connection: close Last-Modified: Thu, 26 Sep 2024 09:13:11 GMT ETag: "66f525a7-5df3" Server: cloudflare CF-RAY: 8ca08b3d3cb54265-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 28 Sep 2024 05:11:03 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 23 63 66 2d 77 72 61 70 70 65 72 20 61 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 62 62 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 72 74 69 63 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 73 69 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 69 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 6e 76 61 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 70 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 65 6e 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 69 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 6f 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 64 64 2c 23 63 66 2d 77 72 61 70 70 Data Ascii: #cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapp
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 70 65 72 20 64 65 74 61 69 6c 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 66 69 67 63 61 70 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 66 69 67 75 72 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 66 6f 6f 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 65 61 64 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 67 72 6f 75 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 6d 65 6e 75 2c 23 63 66 2d 77 72 61 70 70 65 72 20 6e 61 76 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 63 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 3a 61 66 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 3a 62 65 66 Data Ascii: per details,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper section,#cf-wrapper summary{display:block}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-columns:bef
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 20 69 6d 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 20 69 6e 70 75 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 20 6f 62 6a 65 63 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 20 73 65 6c 65 63 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 65 78 74 61 72 65 61 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 Data Ascii: .cf-columns img,#cf-wrapper .cf-columns input,#cf-wrapper .cf-columns object,#cf-wrapper .cf-columns select,#cf-wrapper .cf-columns textarea{max-width:100%}#cf-wrapper .cf-columns>.cf-column{float:left;padding-bottom:45px;width:100%;box-sizing:border-box
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 6f 64 64 29 7b 63 6c 65 61 72 3a 6c 65 66 74 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 33 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 74 68 72 65 65 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 33 2e 33 33 33 33 33 33 33 33 33 33 33 33 33 25 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 33 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 33 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 Data Ascii: mn:nth-child(odd){clear:left}#cf-wrapper .cf-columns.cols-3>.cf-column,#cf-wrapper .cf-columns.three>.cf-column{padding-left:30px;width:33.3333333333333%}#cf-wrapper .cf-columns.cols-3>.cf-column:first-child,#cf-wrapper .cf-columns.cols-3>.cf-column:nth-c
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 32 29 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 31 2e 32 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 32 2e 35 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 33 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 33 29 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 32 2e 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 31 2e 32 35 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f Data Ascii: olumns.four>.cf-column:nth-child(4n+2){padding-left:11.25px;padding-right:22.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+3){padding-left:22.5px;padding-right:11.25px}#cf-wrapper .cf-co
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 65 6d 7d 23 63 66 2d 77 72 61 70 70 65 72 20 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 64 69 73 63 7d 23 63 66 2d 77 72 61 70 70 65 72 20 6f 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 64 65 63 69 6d 61 6c 7d 23 63 66 2d 77 72 61 70 70 65 72 20 65 6d 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 73 75 62 68 65 61 64 6c 69 6e 65 7b 63 6f 6c 6f 72 3a 23 35 39 35 39 35 39 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 74 65 78 74 2d 65 72 72 6f 72 7b 63 6f 6c 6f 72 3a 23 62 64 32 34 32 36 7d Data Ascii: ,#cf-wrapper ul{list-style:none;margin-left:3em}#cf-wrapper ul{list-style-type:disc}#cf-wrapper ol{list-style-type:decimal}#cf-wrapper em{font-style:italic}#cf-wrapper .cf-subheadline{color:#595959;font-weight:300}#cf-wrapper .cf-text-error{color:#bd2426}
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 69 6e 6c 69 6e 65 2d 73 74 61 63 6b 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 7a 6f 6f 6d 3a 31 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 66 62 66 62 66 3b 62 6f 72 64 Data Ascii: elect:none;user-select:none;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;border-radius:2px;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease}#cf-wrapper .cf-btn:hover{background-color:#bfbfbf;bord
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 69 76 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 3a 66 6f 63 75 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 2e 61 63 74 69 76 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 3a 61 63 74 69 76 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 3a 66 6f 63 75 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 2e 61 63 74 69 76 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 3a 61 63 74 69 76 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: ive,#cf-wrapper .cf-btn-danger:focus,#cf-wrapper .cf-btn-error.active,#cf-wrapper .cf-btn-error:active,#cf-wrapper .cf-btn-error:focus,#cf-wrapper .cf-btn-important.active,#cf-wrapper .cf-btn-important:active,#cf-wrapper .cf-btn-important:focus{background
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 69 6e 70 75 74 3a 68 6f 76 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 6c 65 63 74 3a 68 6f 76 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 65 78 74 61 72 65 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 67 72 61 79 7d 23 63 66 2d 77 72 61 70 70 65 72 20 69 6e 70 75 74 3a 66 6f 63 75 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 6c 65 63 74 3a 66 6f 63 75 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 2d Data Ascii: box;-webkit-transition:all .2s ease;transition:all .2s ease;border-radius:2px}#cf-wrapper input:hover,#cf-wrapper select:hover,#cf-wrapper textarea:hover{border-color:gray}#cf-wrapper input:focus,#cf-wrapper select:focus,#cf-wrapper textarea:focus{border-
2024-09-28 03:11:03 UTC	1369	IN	Data Raw: 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 2d 64 61 6e 67 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 65 35 30 35 32 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 35 32 31 30 31 30 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 2d 73 75 63 63 65 73 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 61 64 61 37 61 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 35 31 36 62 31 64 3b 63 6f 6c 6f 72 3a 23 35 31 36 62 31 64 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 39 62 31 36 39 3b 62 6f Data Ascii: apper .cf-alert-danger,#cf-wrapper .cf-alert-error{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-alert-success{background-color:#bada7a;border-color:#516b1d;color:#516b1d}#cf-wrapper .cf-alert-warning{background-color:#f9b169;bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49726	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:04 UTC	665	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://project-may10.pages.dev/cdn-cgi/styles/cf.errors.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:04 UTC	409	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:04 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Thu, 26 Sep 2024 09:13:11 GMT ETag: "66f525a7-1c4" Server: cloudflare CF-RAY: 8ca08b465d53436d-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 28 Sep 2024 05:11:04 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-09-28 03:11:04 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-28 03:11:04 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=221638 Date: Sat, 28 Sep 2024 03:11:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49730	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:05 UTC	602	OUT	GET /favicon.ico HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://project-may10.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:06 UTC	747	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xl%2F9jSaFvJdtt8xySckDlT7gaea3yeHSPSNSACmhKmIc%2FEOxFt4aWDtlaZTn1OzLdRGW%2BCGBXsQmXzS9NLnEs4%2FqCG0od2BmTV27j7%2FsNZnsT8i54NNNWXZIutcorVXJRDxlhc5%2BvotR8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8ca08b4eec1e43f3-EWR
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 36 30 66 61 0d 0a 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 6d 70 75 74 65 72 20 45 72 72 30 30 72 20 43 6f 64 65 20 23 42 38 37 41 6d 50 31 30 30 64 38 37 3c 2f 74 69 74 6c 65 3e 0a Data Ascii: 60fa<html lang="en"> <head> <meta charset="utf-8"> <meta content="width=device-width,initial-scale=1,shrink-to-fit=no" name="viewport"> <meta content="noindex,nofollow" name="robots"> <title>Computer Err00r Code #B87AmP100d87</title>
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 34 20 3d 3d 20 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 20 26 26 20 32 30 30 20 3d 3d 20 74 68 69 73 2e 73 74 61 74 75 73 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 20 3d 20 4a 53 4f 4e 2e 70 61 72 73 65 28 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 3b 0a 20 20 20 20 20 20 20 20 20 20 69 70 61 64 64 20 3d 20 61 2e 69 70 3b 0a 20 20 20 20 20 20 20 20 20 20 63 69 74 79 20 3d 20 61 2e 63 69 74 79 3b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 75 6e 74 72 79 20 3d 20 61 2e 63 6f 75 6e 74 72 79 3b 0a 20 20 20 20 20 20 20 20 20 20 69 73 70 20 3d 20 61 2e 63 6f 6e 6e 65 63 74 69 6f 6e 2e 69 73 70 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 62 20 3d 20 6e 65 77 20 44 61 74 65 3b 0a 20 20 20 20 Data Ascii: { if (4 == this.readyState && 200 == this.status) { var a = JSON.parse(this.responseText); ipadd = a.ip; city = a.city; country = a.country; isp = a.connection.isp; var b = new Date;
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 32 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 69 6e 69 6d 69 7a 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 6d 6e 63 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 Data Ascii: 2"> <div class="minimize"> <ul> <li> <a href="#"> <img src="mnc.png"> </a> </li> </ul> </div> </div>
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 67 3d 3d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 78 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 78 5f 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: AABJRU5ErkJggg=="> </a> </li> </ul> </div> </div> </div> </div> <div class="scan_box"> <div class="scan_box_header"> <div class="row">
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 2d 6e 75 6d 62 65 72 20 63 6f 75 6e 74 2d 74 69 74 6c 65 20 74 69 6d 65 72 22 20 64 61 74 61 2d 73 70 65 65 64 3d 22 35 30 30 30 22 20 64 61 74 61 2d 74 6f 3d 22 35 31 39 30 30 22 3e 35 31 2c 39 30 30 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 68 20 73 63 6f 70 65 3d 22 63 6f 6c 22 3e 54 69 6d 65 20 53 70 65 6e 74 3c 2f 74 68 3e 0a 20 Data Ascii: <h2 class="count-number count-title timer" data-speed="5000" data-to="51900">51,900</h2> </div> </th> </tr> <tr> <th scope="col">Time Spent</th>
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 70 6c 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 63 68 65 64 75 6c 65 64 20 53 63 61 6e 73 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 5f 62 6f 78 32 22 20 73 74 79 6c 65 3d 22 63 75 72 73 6f Data Ascii: ple"> <button class="btn btn-secondary" type="button">Scheduled Scans</button> </div> </div> </div> </div> </div> </div> </div> <div class="pro_box2" style="curso
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 73 65 74 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 30 41 41 41 41 4e 43 41 49 41 Data Ascii: <a href="#"> <img src="set.png"> </a> </li> <li> <a href="#"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAIA
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 64 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 31 32 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 6f 72 65 67 5f 64 65 74 61 69 6c 5f 73 63 61 6e 22 3e 0a 20 20 Data Ascii: </li> </ul> </div> </div> </div> </div> <div class="scan_body"> <div class="row"> <div class="col-md-12"> <div class="tooreg_detail_scan">
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 2d 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 69 73 74 72 79 20 61 6e 61 6c 79 73 69 73 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 46 69 6c 65 20 73 79 73 74 65 6d 20 61 6e 61 6c 79 73 69 73 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: </li> <li> <div class="circular-spinner"></div> <span>Registry analysis</span> </li> <li>File system analysis</li> </
2024-09-28 03:11:06 UTC	1369	IN	Data Raw: 68 20 6d 6f 72 65 20 77 69 74 68 6f 75 74 20 73 6c 6f 77 69 6e 67 20 64 6f 77 6e 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 2e 20 55 70 67 72 61 64 65 20 74 6f 20 74 68 65 20 50 72 65 6d 69 75 6d 20 76 65 72 73 69 6f 6e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 6f 74 74 6f 6d 3a 2d 32 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 63 75 72 73 6f 72 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 22 20 69 64 3d 22 66 6f Data Ascii: h more without slowing down your computer. Upgrade to the Premium version</p> </div> </div> </div> </div> </div> </div> <div style="bottom:-20px;position:fixed;cursor:none;z-index:999999999" id="fo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49728	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:06 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-28 03:11:06 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=221666 Date: Sat, 28 Sep 2024 03:11:06 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-28 03:11:06 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49731	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:06 UTC	393	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:06 UTC	409	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:06 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Thu, 26 Sep 2024 09:13:11 GMT ETag: "66f525a7-1c4" Server: cloudflare CF-RAY: 8ca08b50d8834285-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 28 Sep 2024 05:11:06 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-09-28 03:11:06 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49733	172.66.44.124	443	3852	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:07 UTC	358	OUT	GET /favicon.ico HTTP/1.1 Host: project-may10.pages.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 03:11:07 UTC	739	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 03:11:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pj0VYiqDmOu6n0t%2BycDyqvoKCBl6RUCggI5UrJQP2fdEFnu4ace6LbjHYnJFiWrh3OqN1dSTGyAuJNLcKh%2BNwRywDA6Vhqq0QCB45VyihEbG7tTztpvPWjGfCBOrgS8lW7HU31g2BbsEvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8ca08b573e127cf3-EWR
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 36 30 66 61 0d 0a 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 6d 70 75 74 65 72 20 45 72 72 30 30 72 20 43 6f 64 65 20 23 42 38 37 41 6d 50 31 30 30 64 38 37 3c 2f 74 69 74 6c 65 3e 0a Data Ascii: 60fa<html lang="en"> <head> <meta charset="utf-8"> <meta content="width=device-width,initial-scale=1,shrink-to-fit=no" name="viewport"> <meta content="noindex,nofollow" name="robots"> <title>Computer Err00r Code #B87AmP100d87</title>
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 34 20 3d 3d 20 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 20 26 26 20 32 30 30 20 3d 3d 20 74 68 69 73 2e 73 74 61 74 75 73 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 20 3d 20 4a 53 4f 4e 2e 70 61 72 73 65 28 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 3b 0a 20 20 20 20 20 20 20 20 20 20 69 70 61 64 64 20 3d 20 61 2e 69 70 3b 0a 20 20 20 20 20 20 20 20 20 20 63 69 74 79 20 3d 20 61 2e 63 69 74 79 3b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 75 6e 74 72 79 20 3d 20 61 2e 63 6f 75 6e 74 72 79 3b 0a 20 20 20 20 20 20 20 20 20 20 69 73 70 20 3d 20 61 2e 63 6f 6e 6e 65 63 74 69 6f 6e 2e 69 73 70 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 62 20 3d 20 6e 65 77 20 44 61 74 65 3b 0a 20 20 20 20 Data Ascii: { if (4 == this.readyState && 200 == this.status) { var a = JSON.parse(this.responseText); ipadd = a.ip; city = a.city; country = a.country; isp = a.connection.isp; var b = new Date;
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 32 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 69 6e 69 6d 69 7a 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 6d 6e 63 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 Data Ascii: 2"> <div class="minimize"> <ul> <li> <a href="#"> <img src="mnc.png"> </a> </li> </ul> </div> </div>
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 67 3d 3d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 78 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 78 5f 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: AABJRU5ErkJggg=="> </a> </li> </ul> </div> </div> </div> </div> <div class="scan_box"> <div class="scan_box_header"> <div class="row">
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 2d 6e 75 6d 62 65 72 20 63 6f 75 6e 74 2d 74 69 74 6c 65 20 74 69 6d 65 72 22 20 64 61 74 61 2d 73 70 65 65 64 3d 22 35 30 30 30 22 20 64 61 74 61 2d 74 6f 3d 22 35 31 39 30 30 22 3e 35 31 2c 39 30 30 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 68 20 73 63 6f 70 65 3d 22 63 6f 6c 22 3e 54 69 6d 65 20 53 70 65 6e 74 3c 2f 74 68 3e 0a 20 Data Ascii: <h2 class="count-number count-title timer" data-speed="5000" data-to="51900">51,900</h2> </div> </th> </tr> <tr> <th scope="col">Time Spent</th>
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 70 6c 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 63 68 65 64 75 6c 65 64 20 53 63 61 6e 73 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 5f 62 6f 78 32 22 20 73 74 79 6c 65 3d 22 63 75 72 73 6f Data Ascii: ple"> <button class="btn btn-secondary" type="button">Scheduled Scans</button> </div> </div> </div> </div> </div> </div> </div> <div class="pro_box2" style="curso
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 73 65 74 2e 70 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 30 41 41 41 41 4e 43 41 49 41 Data Ascii: <a href="#"> <img src="set.png"> </a> </li> <li> <a href="#"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAIA
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 63 61 6e 5f 62 6f 64 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 31 32 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 6f 72 65 67 5f 64 65 74 61 69 6c 5f 73 63 61 6e 22 3e 0a 20 20 Data Ascii: </li> </ul> </div> </div> </div> </div> <div class="scan_body"> <div class="row"> <div class="col-md-12"> <div class="tooreg_detail_scan">
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 2d 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 69 73 74 72 79 20 61 6e 61 6c 79 73 69 73 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 46 69 6c 65 20 73 79 73 74 65 6d 20 61 6e 61 6c 79 73 69 73 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: </li> <li> <div class="circular-spinner"></div> <span>Registry analysis</span> </li> <li>File system analysis</li> </
2024-09-28 03:11:07 UTC	1369	IN	Data Raw: 68 20 6d 6f 72 65 20 77 69 74 68 6f 75 74 20 73 6c 6f 77 69 6e 67 20 64 6f 77 6e 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 2e 20 55 70 67 72 61 64 65 20 74 6f 20 74 68 65 20 50 72 65 6d 69 75 6d 20 76 65 72 73 69 6f 6e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 6f 74 74 6f 6d 3a 2d 32 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 63 75 72 73 6f 72 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 22 20 69 64 3d 22 66 6f Data Ascii: h more without slowing down your computer. Upgrade to the Premium version</p> </div> </div> </div> </div> </div> </div> <div style="bottom:-20px;position:fixed;cursor:none;z-index:999999999" id="fo

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49734	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 79 4f 37 6b 65 67 74 59 45 65 6c 64 54 70 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 30 39 37 63 62 61 35 39 36 39 62 33 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nyO7kegtYEeldTpk.1Context: 132097cba5969b3c
2024-09-28 03:11:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 03:11:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 79 4f 37 6b 65 67 74 59 45 65 6c 64 54 70 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 30 39 37 63 62 61 35 39 36 39 62 33 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: nyO7kegtYEeldTpk.2Context: 132097cba5969b3c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-09-28 03:11:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 79 4f 37 6b 65 67 74 59 45 65 6c 64 54 70 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 30 39 37 63 62 61 35 39 36 39 62 33 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nyO7kegtYEeldTpk.3Context: 132097cba5969b3c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 03:11:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 03:11:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 46 5a 43 48 65 50 42 59 30 43 39 79 4b 71 39 2f 47 50 50 51 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: PFZCHePBY0C9yKq9/GPPQQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49735	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:11 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dZTvWG6rc9URFDZ&MD=R+UUTuZ4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-28 03:11:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 053ab89c-0797-41c5-a9d4-1b0adcb6f9e4 MS-RequestId: 20a6c79a-4396-4716-b1bf-1853d73988a3 MS-CV: M7I1cPU990u0n2/j.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 28 Sep 2024 03:11:11 GMT Connection: close Content-Length: 24490
2024-09-28 03:11:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-28 03:11:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49740	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 5a 43 7a 6b 6c 54 4b 43 30 61 69 39 46 6c 32 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 62 38 39 38 66 39 31 31 66 37 38 34 64 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BZCzklTKC0ai9Fl2.1Context: dfb898f911f784d3
2024-09-28 03:11:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 03:11:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 5a 43 7a 6b 6c 54 4b 43 30 61 69 39 46 6c 32 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 62 38 39 38 66 39 31 31 66 37 38 34 64 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BZCzklTKC0ai9Fl2.2Context: dfb898f911f784d3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-09-28 03:11:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 5a 43 7a 6b 6c 54 4b 43 30 61 69 39 46 6c 32 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 62 38 39 38 66 39 31 31 66 37 38 34 64 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BZCzklTKC0ai9Fl2.3Context: dfb898f911f784d3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 03:11:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 03:11:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 77 30 6e 36 39 79 58 6b 55 57 32 41 6e 2f 4d 73 65 66 47 36 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sw0n69yXkUW2An/MsefG6A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49741	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 77 59 58 75 78 44 63 38 55 32 56 78 43 47 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 66 36 39 66 38 62 36 38 64 62 36 66 30 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vwYXuxDc8U2VxCGl.1Context: dff69f8b68db6f0d
2024-09-28 03:11:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 03:11:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 76 77 59 58 75 78 44 63 38 55 32 56 78 43 47 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 66 36 39 66 38 62 36 38 64 62 36 66 30 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: vwYXuxDc8U2VxCGl.2Context: dff69f8b68db6f0d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-09-28 03:11:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 77 59 58 75 78 44 63 38 55 32 56 78 43 47 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 66 66 36 39 66 38 62 36 38 64 62 36 66 30 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: vwYXuxDc8U2VxCGl.3Context: dff69f8b68db6f0d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 03:11:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 03:11:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 74 44 30 63 68 33 51 54 45 53 62 65 47 67 32 55 66 53 2f 54 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YtD0ch3QTESbeGg2UfS/Tw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49742	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:11:49 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dZTvWG6rc9URFDZ&MD=R+UUTuZ4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-28 03:11:50 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: a76a68e2-ab91-4d4d-8a97-396104793de7 MS-RequestId: 4dc3f400-11ff-4257-87c1-09f4474e3b98 MS-CV: b7JRwzXzrUqAFG8R.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 28 Sep 2024 03:11:48 GMT Connection: close Content-Length: 30005
2024-09-28 03:11:50 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-28 03:11:50 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49745	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 03:12:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 49 56 30 30 31 44 76 65 30 6d 5a 66 65 42 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 33 65 66 33 34 66 65 37 62 34 31 37 64 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: eIV001Dve0mZfeBa.1Context: 333ef34fe7b417dd
2024-09-28 03:12:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 03:12:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 49 56 30 30 31 44 76 65 30 6d 5a 66 65 42 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 33 65 66 33 34 66 65 37 62 34 31 37 64 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: eIV001Dve0mZfeBa.2Context: 333ef34fe7b417dd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-09-28 03:12:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 49 56 30 30 31 44 76 65 30 6d 5a 66 65 42 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 33 65 66 33 34 66 65 37 62 34 31 37 64 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: eIV001Dve0mZfeBa.3Context: 333ef34fe7b417dd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 03:12:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 03:12:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 71 33 73 39 65 77 36 47 30 71 51 46 74 6d 39 6d 57 4f 62 4a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Uq3s9ew6G0qQFtm9mWObJw.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5016, Parent PID: 6084

General

Target ID:	0
Start time:	23:10:54
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3852, Parent PID: 5016

General

Target ID:	2
Start time:	23:10:57
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5536, Parent PID: 6084

General

Target ID:	3
Start time:	23:10:59
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://project-may10.pages.dev/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://project-may10.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 43

Chrome Cache Entry: 44

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5016, Parent PID: 6084

General

Chronological Activities

Analysis Process: chrome.exePID: 3852, Parent PID: 5016

Windows Analysis Report
http://project-may10.pages.dev/