Edit tour

Windows Analysis Report
http://addicted.live

Overview

General Information

Sample URL:	http://addicted.live
Analysis ID:	1528471
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1976,i,11710375692768624198,1828441770441939256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://addicted.live" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: addicted.liveConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?u=y098rk1&o=2n0kmbq HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://flirtfantasy.one/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /util/flag-icon/css/flag-icon.css HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/css/style.css HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/css/style_shagslags.css HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /cookie/js.cookie.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /util/utils.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/js/jquery-3.1.1.min.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/js/main_casual.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/bb.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/exit-new/exit1.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /util/utils.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /cookie/js.cookie.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/js/main_casual.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/exit-new/exit1.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/bb.js HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: bigdatajsext.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://flirtfantasy.oneSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://flirtfantasy.one/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: bigdatajsext.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /util/flag-icon/flags/4x3/us.svg HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://flirtfantasy.one/util/flag-icon/css/flag-icon.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /util/flag-icon/flags/4x3/us.svg HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/images/casual_2/1.jpg HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://flirtfantasy.one/media/dating/striptease2/css/style_shagslags.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vsl6d7rgkFzyLwn&MD=stGBhGMU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /media/dating/striptease2/images/casual_2/1.jpg HTTP/1.1Host: flirtfantasy.oneConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: flirtfantasy.oneConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAde7GwOL8Egr0r5UswbJ5wRdmT7SgLMdQndTk4qXfrEdhwfTcwHLdHFU8z2svTOE%2Brn6Al36I/MWudCkBN8W4F/41tW72QaonHoN0/q8wLIGgkVzTJgUj6DZ/idrftXenWFI/tzDehu5hIToGokBltXTbeD56uUl5MFxivtNp5rQy3VMBb8YNmGwF5zMdCbDa3PY5V2iJWPO0B2VcMU036cyylVMCxVYSfJHEuxnvedx57Yzj/ZnA4nErzm7EUNiKnvr7DberM7Kx%2BExzMJIfh0mUm0r6sljKt89FHWSrUFjytmT/U9I1vLnYjgu8LE4uzNiZH/sRD4JMhJhpD2Cj2EQZgAAEN02P8cD8lbpFvPVOwF3I%2BywAVeENeSeHknI520OCoYeim7PGL/lYDvFBFJ5xjEKjjc2mYznqVcNhRty5waTnjJKR2M1xeuCB8/0JwH9wY5LlOAXP2kbwj2X9auZfWNKplHBQ0ozJhuPEri3TgXcOpVAmcju99iSmS6T6pRB7AssH1XNxb4QUVCHMlW1By089IeqyXCSefrn%2BEFZNQPCAvpa7eI0JvslciVGMhpdS3oDPQtfg8BbFcAfwx3OA92zv2Mws9y8nXxoctEd7cw/xYwGsSIqB20xOi/x0LKmgM6q170i9k06Tupq0fUdK9dag2SlzlUN5FVuR/cZCwiFDT3J27OlFHOfjevVTw7%2Bzgyo5ilOOzPxL%2B7MQXToi0%2BRi/kd/ynxy4xtFff2WytDF0iG%2BsnERvwKoWWfYC%2Bkz4Qahdlu4EKxG1/4sum9cYywIaQGm5mZfsQf9JndC5arsyH2G4vkffaSaztG8nxjsfMH%2Bk3Ubmnfpdn%2BkOgv4wuPu3H0of2R4ad6O1tYuvDOMwqRrY2Lpv5XhdL3QXgjNVnvjuHyOuicrx3p5TK8bOTV0K9pBe5Tb/zvhHQWgy19fTdDntcB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1728336660User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 179D7B1C6CC64DDBBC9118DC08018856X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vsl6d7rgkFzyLwn&MD=stGBhGMU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: addicted.live
Source: global traffic	DNS traffic detected: DNS query: flirtfantasy.one
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bigdatajsext.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4808Host: login.live.com

Source: chromecache_89.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_89.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_92.1.dr, chromecache_84.1.dr, chromecache_90.1.dr, chromecache_88.1.dr	String found in binary or memory: https://bigdatajsext.com/ExtService.svc/getextparams
Source: chromecache_82.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0-ExdGM.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0aExdGM.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0yExdGM.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OOtLQ0Z.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCCwR26eg.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCIwR26eg.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCLwR26eg.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiBW_3QRQ.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiFW_0.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiIW_3QRQ.woff2)
Source: chromecache_83.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiLW_3QRQ.woff2)
Source: chromecache_78.1.dr, chromecache_97.1.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_87.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_87.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_82.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Source: chromecache_87.1.dr	String found in binary or memory: https://sizzlejs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.17:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.179:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49758 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/48@16/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1976,i,11710375692768624198,1828441770441939256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://addicted.live"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1976,i,11710375692768624198,1828441770441939256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://fontawesome.io	0%	URL Reputation	safe
https://jquery.org/license	0%	URL Reputation	safe
https://jquery.com/	0%	URL Reputation	safe
https://sizzlejs.com/	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
addicted.live	15.197.225.128	true	false	unknown
flirtfantasy.one	185.155.186.18	true	false	unknown
bigdatajsext.com	136.243.216.252	true	false	unknown
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://flirtfantasy.one/util/flag-icon/flags/4x3/us.svg	false	unknown
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css	false	unknown
https://flirtfantasy.one/favicon.ico	false	unknown
https://flirtfantasy.one/media/dating/striptease2/css/style_shagslags.css	false	unknown
https://flirtfantasy.one/media/dating/striptease2/js/main_casual.js	false	unknown
https://bigdatajsext.com/ExtService.svc/getextparams	false	unknown
https://flirtfantasy.one/cookie/js.cookie.js	false	unknown
https://flirtfantasy.one/media/dating/striptease2/images/casual_2/1.jpg	false	unknown
https://addicted.live/	false	unknown
https://flirtfantasy.one/util/flag-icon/css/flag-icon.css	false	unknown
https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq	false	unknown
https://flirtfantasy.one/media/exit-new/exit1.js	false	unknown
https://flirtfantasy.one/media/bb.js	false	unknown
https://flirtfantasy.one/media/dating/striptease2/css/style.css	false	unknown
https://flirtfantasy.one/util/utils.js	false	unknown
https://flirtfantasy.one/media/dating/striptease2/js/jquery-3.1.1.min.js	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_89.1.dr	false	URL Reputation: safe	unknown
https://jquery.org/license	chromecache_87.1.dr	false	URL Reputation: safe	unknown
https://jquery.com/	chromecache_87.1.dr	false	URL Reputation: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_78.1.dr, chromecache_97.1.dr	false		unknown
https://sizzlejs.com/	chromecache_87.1.dr	false	URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_89.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
15.197.225.128	addicted.live	United States	7430	TANDEMUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
136.243.216.252	bigdatajsext.com	Germany	24940	HETZNER-ASDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
185.155.186.18	flirtfantasy.one	Switzerland	6898	INTERNETONE_CH	false

Private

IP
192.168.2.17
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528471
Start date and time:	2024-10-07 23:29:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://addicted.live
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/48@16/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.186.46, 74.125.71.84, 34.104.35.123, 142.250.185.74, 142.250.185.67, 192.229.221.95, 142.250.186.35, 142.250.185.174
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://addicted.live

Input	Output
URL: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Confidential dating in New York? Single women are waiting for you!", "has_visible_qrcode":false}

URL: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Confidential dating in New York? Single women are waiting for you!", "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 20:30:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.994446699253411
Encrypted:	false
SSDEEP:	48:8Zmd+TH78lHridAKZdA1JehwiZUklqehQy+3:8Zn0P/y
MD5:	99A055A0A2131325C5FFC551BE0744A1
SHA1:	63B6520775F76DC6974B8EA3F83C2325E2D1B666
SHA-256:	65EDBCD5579D2F8C4E330E01E90C8C07092C7968B14592023A081C4A7D227D72
SHA-512:	C9B8ECB9728C6A636AB51DB1AE64CE6C76F6AF152084271BD26602406D657B98F258DF2B6BB5A16C0F55A5E96BB2093461607F9507F431D677B79A70E0E64261
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,................y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VGY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 20:30:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.008669812808252
Encrypted:	false
SSDEEP:	48:8Gmd+TH78lHridAKZdA10eh/iZUkAQkqehvy+2:8Gn0l9QWy
MD5:	F2761DA551E0AB806C8890664BD26E28
SHA1:	5C4AEC8BF11B7DB76EB7D73255A89E9D9D7E3D6C
SHA-256:	BC2865F2014C4214073DB223B35D7CC32E219E513A9283F5BCEAF1FE39B8B4DA
SHA-512:	7C53FF0A76CE0174EE1AD8B5920F6E1224402B9291D89C18B5DED6B10A17E65460FF8A30E60D1B78B577CFB92F6725645FD829AD16357331D53987A59C8F9EAA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....!...........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VGY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01923287458195
Encrypted:	false
SSDEEP:	48:8emd+TH78jHridAKZdA14tIeh7sFiZUkmgqeh7sdy+BX:8en0nnLy
MD5:	CBDC03EA30C2DAF6BCA8B4F0A60B48E6
SHA1:	6ED73FBE129DF4F6F2AA9250EF79900AC6D6AB78
SHA-256:	FFB48C6AAD60C42AFEC00206C58A0EE797489001CA6DF6E64B0BDF678F59C9BC
SHA-512:	EB1DF19F68F89109AA5C234E0D6C1D0256E93F4E5FA136F2E3391B33AD8058D6724DB63C21222D0657A9587487DAAA189B1980A933356E4FC1ECF89DF7B0C6E1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 20:30:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003997442814934
Encrypted:	false
SSDEEP:	48:86md+TH78lHridAKZdA1behDiZUkwqehjy+R:86n0WVy
MD5:	84BB201105D47EADD2829CF3393B0174
SHA1:	68B7A4B633ED63CC3D79EC839DCAD9E0E4494D3C
SHA-256:	DEE3552EB1007E691C62E1B9F5AA3ADCD98CF91BB0B1F7AF76FFCF4DE140A056
SHA-512:	D37F4060494A34A1F9400EF81856DBECA155CBD832CF847F92768119CC3F3E86A835BEF816F73D7F7DD1974860ACD315E75EECA3448971D641568C1CC2126728
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....f...........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VGY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 20:30:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9957508743441243
Encrypted:	false
SSDEEP:	48:8mmd+TH78lHridAKZdA1VehBiZUk1W1qehJy+C:8mn0W9py
MD5:	DBBA141C44D22DACF883423A8F9E587C
SHA1:	1F363223544088421A2187F4D4DB372982CF8848
SHA-256:	9B792475405026FB2BF23AA969EBD73DE10ED1B8F42EE91E8FDFD6B9E45B9744
SHA-512:	232643773D0E2FF158238CBB6FB458A6CE51ACC170932FAF085F80BA4AD11CFEFD253AD56D8EDE81F2662F37F0A084DBC27CA8635091DA0C22FD5A41C30B56D9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....QK..........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VGY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 20:30:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.004824588123623
Encrypted:	false
SSDEEP:	48:8pkmd+TH78lHridAKZdA1duT6ehOuTbbiZUk5OjqehOuTbLy+yT+:8un0ETTTbxWOvTbLy7T
MD5:	DE8518210355941A4264E137C5931B6D
SHA1:	6481827DF094D8711AF29E928DCEB0D6740D65CA
SHA-256:	054F47F65C71A01B90EA6EF726FD32F39EA5F524CF15DA24156AF15728A0A995
SHA-512:	1841C979A9DDEEC289993AF00556AA9ED5AB37E98B2D66220359B6C1C7CB3F4900329170FFFF413570768BB8E3B7C975938534E403D1E57D88B51FFDDB0B7F4B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....0...........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IGY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VGY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VGY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VGY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............);......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (639), with no line terminators
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.227785536434361
Encrypted:	false
SSDEEP:	12:IEndQLkOLNek0yODwMyGfYEx7E0ia8TATBYJlQDESJNnMJS0EelEpF:HdhOLNrGDwMyLEx7E0haJlEEPk0ESEP
MD5:	0D553E4BAC91C74BFEE2DBABBA61E99E
SHA1:	5AF71E2377C9C012A7826A695F2724901941B19B
SHA-256:	1BE1304C675449B1BAD38EA8C3DA6C1DA0763ED2FAD339EE1AA461C7BF4E2A68
SHA-512:	105E5B23733E7BB443BA2080D606C2814B0ACD2AAF228467D2CE532FF2F2EC0B292F8EB5189A24CD9F79B69A7E983B176DBD29E2D539DAE7CA443821084F2894
Malicious:	false
Reputation:	low
Preview:	var PreventBb=![];getUrlParameter('b')==='0'?PreventBb=!![]:PreventBb=![];!function(){if(!PreventBb){var a;try{for(a=0x0;0xa>a;++a)history['pushState']({},'','');onpopstate=function(b){b['state']&&location['replace'](getUrlWithParam('x=1'));};}catch(b){}}}();function getUrlParameter(a){a=a['replace'](/[\[]/,'\x5c[')['replace'](/[\]]/,'\x5c]');var b=new RegExp('[\x5c?&]'+a+'=([^&#]*)'),c=b['exec'](location['search']);return c===null?'':decodeURIComponent(c[0x1]['replace'](/\+/g,'\x20'));}function getUrlWithParam(a){var b=window['location']['href'];if(b['includes']('x=')){b=b['replace'](/(x=)[0-9]{1,2}/,a);}else{b=b+'&'+a;}return b;}

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (639), with no line terminators
Category:	downloaded
Size (bytes):	639
Entropy (8bit):	5.227785536434361
Encrypted:	false
SSDEEP:	12:IEndQLkOLNek0yODwMyGfYEx7E0ia8TATBYJlQDESJNnMJS0EelEpF:HdhOLNrGDwMyLEx7E0haJlEEPk0ESEP
MD5:	0D553E4BAC91C74BFEE2DBABBA61E99E
SHA1:	5AF71E2377C9C012A7826A695F2724901941B19B
SHA-256:	1BE1304C675449B1BAD38EA8C3DA6C1DA0763ED2FAD339EE1AA461C7BF4E2A68
SHA-512:	105E5B23733E7BB443BA2080D606C2814B0ACD2AAF228467D2CE532FF2F2EC0B292F8EB5189A24CD9F79B69A7E983B176DBD29E2D539DAE7CA443821084F2894
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/bb.js
Preview:	var PreventBb=![];getUrlParameter('b')==='0'?PreventBb=!![]:PreventBb=![];!function(){if(!PreventBb){var a;try{for(a=0x0;0xa>a;++a)history['pushState']({},'','');onpopstate=function(b){b['state']&&location['replace'](getUrlWithParam('x=1'));};}catch(b){}}}();function getUrlParameter(a){a=a['replace'](/[\[]/,'\x5c[')['replace'](/[\]]/,'\x5c]');var b=new RegExp('[\x5c?&]'+a+'=([^&#]*)'),c=b['exec'](location['search']);return c===null?'':decodeURIComponent(c[0x1]['replace'](/\+/g,'\x20'));}function getUrlWithParam(a){var b=window['location']['href'];if(b['includes']('x=')){b=b['replace'](/(x=)[0-9]{1,2}/,a);}else{b=b+'&'+a;}return b;}

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 47048, version 1.0
Category:	downloaded
Size (bytes):	47048
Entropy (8bit):	7.995855342082746
Encrypted:	true
SSDEEP:	768:Czwpv8MufPLEja54/un6n/rlUtUHTKgsdiEyvaFJWTVwkE0MsPGCYqEYny3TPCwB:8gvSfPLH5a/YUHJsdidvareax0MsPGCC
MD5:	87A1556B696AE2CB1A726BD8C4584A2F
SHA1:	1BE0F6F39E0CF316F9827F945EEEAEF8294CC37B
SHA-256:	141F0C53E457585D4AC7426EB3D757666D250EE6FBF0E9C0878128E4C627F0B1
SHA-512:	AD9EE74772783ECF885C9D828D0D54FD4B65F66BA316BA0A5B241B910F4ECED6DFA3ECFA4F2CDBEED4EB0AD9929EBC207F9CA3099348498F7E1ACF7192FDE98D
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Preview:	wOF2...............$...d..........................^..H.`..D.,........`.....V...H.6.$..(. .........[Rzq...........k.q..`.tG.9..V.c..v .h.....??...i.m)...\.o...T....."...)+..n0Y.`.@.&k.E [..fI..M..y..$1.....A....#....@..O..._.NP.k6..T......C&:#.3...S..H....O...k.=.^.P.2.!\|..!NZ..>.......1.+.&........r...0.`)0z..3...g8H.....imEm7..rd.r'{..22..>.dPm.F..Bb$6.~.7.Ik..~x...5ED...(..k..wAy.1E`..D...?3.V2{cg...2...#b..>_..........r.......%.P.LF.f....l..Vl,Y....6`..1.G.@...b..f`..b..8o._..t..}I....m.v.q.2m....A..p.)...p...(.0M5p8..m~..LI!!.A.%xh}DW....}.}.6{...$.M.%o.<.vO;.$._..$....[.J...T.I..9..I%T6!5. I...Ae.l...Tb[.Jl..........p$..rl3h..I..A.(I.!....,bE..D.........K ....$.H.d...f..BM...j../.P_...2.-..s.SS.i.....d..].hDA....Kzu.<U..~._.!....(....^....mU... ..H..e..#k~.......kk..H._..[...j.Kx.v....-Ss....X.=...3.r.t..e^.....C.................$..ji...,u.^V..Y.1 F.._iO...o/..d9I;..........L2.o.nw...'B....j........."..4...p....u...V..1..1..poMy

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1709), with CRLF line terminators
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.365773121802454
Encrypted:	false
SSDEEP:	48:MnCmrorDzy9AVYnVReoHEmFZqLghLVQiAdHy9QShp8dLocCTRTvg84Re6YzMtpyX:iCyojFOJEiXA1hyvt4T7tpyD2bm
MD5:	A7E9883924072F15259DE6888D5EF515
SHA1:	7F4F6E5938E68F55AEF81E0CD0145F008CD28382
SHA-256:	985659942AB60A92B3C0A7F876D9EF60E8F048FF655A622A172FA4B44F901B6C
SHA-512:	F6F2859B644B249CEBE21B0AF49C0EFA046EEDC95814AD4CAC400B25D6FDDBB7A155DB420359CCFC8570EB18899CDC369DCBF5C137F4CB21F24B27F8F297BE48
Malicious:	false
Reputation:	low
Preview:	/!.. JavaScript Cookie v2.1.3.. * https://github.com/js-cookie/js-cookie.. .. Copyright 2006, 2015 Klaus Hartl & Fagner Brack.. * Released under the MIT license.. /..!function(e){var n=!1;if("function"==typeof define&&define.amd&&(define(e),n=!0),"object"==typeof exports&&(module.exports=e(),n=!0),!n){var t=window.Cookies,o=window.Cookies=e();o.noConflict=function(){return window.Cookies=t,o}}}(function(){function e(){for(var e=0,n={};e<arguments.length;e++){var t=arguments[e];for(var o in t)n[o]=t[o]}return n}function n(t){function o(n,r,i){var c;if("undefined"!=typeof document){if(arguments.length>1){if(i=e({path:"/"},o.defaults,i),"number"==typeof i.expires){var a=new Date;a.setMilliseconds(a.getMilliseconds()+864e5i.expires),i.expires=a}try{c=JSON.stringify(r),/^[\{\[]/.test(c)&&(r=c)}catch(s){}return r=t.write?t.write(r,n):encodeURIComponent(String(r)).replace(/%(23\|24\|26\|2B\|3A\|3C\|3E\|3D\|2F\|3F\|40\|5B\|5D\|5E\|60\|7B\|7D\|7C)/g,decodeURIComponent),n=encodeURIComponent(String(n)),n=

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 45300, version 1.0
Category:	downloaded
Size (bytes):	45300
Entropy (8bit):	7.99526293185803
Encrypted:	true
SSDEEP:	768:XNcHdvw7wbeW4t3x3dcjsflPt8YCRzGzgI/gBPaKkqnMMUQAbc6VBhXGGVJM/:XNmdvw73NAIlPtZCRzGzg+QPaKkqnMMv
MD5:	5FE660C3A23B871807B0E1D3EE973D23
SHA1:	62A9DD423B30B6EE3AB3DD40D573545D579AF10A
SHA-256:	E13FFA988BE59CBF299D7FF68F019F902B60848203AC4990819EB7E4624EE52D
SHA-512:	9EB08055BEFC2B70CC8BBA34496F14414EA32F5B97F185D357F100EA7D74BFDC12AFD815A53E629D02A53DC7F3E37096DF8BBBD36AB44A011C1A4288B42780CD
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2
Preview:	wOF2..............}...............................>..H.`..D.6........ ..8..R...\.6.$.. . .....\|..[.lqE.6C...&..^.....n...qM~..\|.8f.<...{>F......d.u.y..J!.......d.[N.9........;..i.[..+.I.Y....+\|\|!.rU7...G..2..+k..n&..L.`.g.....c4{..U.........F...DS.f.PY..........S..vY..Wl..BzME.D.~.M......t.y..@.1.....DD.....5.\.^...dy...'.,......0....~..c~.#".=.].}A..mA...>.V......,Lu.....]s..p.T{..%0....QS,.O.>......Av.+lE~....L!..B..[E...S..L9.'^..K.g.....O..6A...r..#W....."rT..{]-+{.v[vgO.iO..>k..s.N5e..M........U3@..i.(.w....[pu\|.....($.)..-..lA.....dW.hz.P.v,..15....1.....@..@.q.t.'E..bI........$..P.$NQv...s..e..= C3..!......6...M$:..G...{..hX.AfM..$.w....A.r....o?.......Y...s.C.r......w.j...]RSh.iR..}%5%5%u.r.Em[..b%Vsz.....J..;%.]..!..O........D.....?.D)d.......\|.\|.P.X....{..K...2.9..q:..U..n.......$.R...l.tLi..^.f-%..O.6..iJ.).&.;....T3..~o" -t;.....:.)....q.[`. .......Fk...Z.Ty....w.e'...t\... .><...9.U0\./....4.IS.h:x..t...m.;..$t.m`e..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 1921x1081, components 3
Category:	dropped
Size (bytes):	69020
Entropy (8bit):	7.20096771336261
Encrypted:	false
SSDEEP:	1536:6zJHjjjjjjjjjjjjjjjR9fjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjsjjjjjjjjjq:mJjjjjjjjjjjjjjjjR9fjjjjjjjjjjjm
MD5:	29D4B3A7272689E578C5F6DD5ECC8ACE
SHA1:	B97EA601DB5403A51AD2009506BAF2DAAAA8E5F5
SHA-256:	EC3DDDF004FB11A4AFF2D9944A11018FAD96869A55672A3C04CC6EC66F9F9D0B
SHA-512:	9E07013831A29CF174BA64F522D34987B6306AAE8634F88913314245F69C3748D53300C65F2AC49D57470FA7920C93F1BE5836F0DB7451F0A87CC53405C5434A
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......9...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......z..oo........4.....:7....M......?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	6215
Entropy (8bit):	4.1844959720420025
Encrypted:	false
SSDEEP:	24:t4obKtc4KM7e9KKKKK+5aKKKK+oG/tEBkmAqkmEkevNknkm6nkjA+voLiFXVhxVM:624vhy
MD5:	2B327BDA75CCB4C9C3CD7EA61C4FED82
SHA1:	4C3D575D257B08BC7C12B5C1A6F7E6B76A0E1AC9
SHA-256:	7DB44305E217E7A44845B47FE090B5F077A1CECF820899C7A6977B26549CDC08
SHA-512:	8514024D4FB05C81F8C81768EC3B47E7026E04CED02B6EA3AFA0E22B49611E8FAFE334CAF9A2FCB628E028C257349A224CAD16468CD29263346FCD5828895B97
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/util/flag-icon/flags/4x3/us.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480">.. <g fill-rule="evenodd" transform="scale(.9375)">.. <g stroke-width="1pt">.. <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#bd3d44"/>.. <path d="M0 39.385h972.81V78.77H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#fff"/>.. </g>.. <path fill="#192f5d" d="M0 0h389.12v275.69H0z"/>.. <g fill="#fff">.. <path d="M32.427 11.8l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735h11.457zm64.853 0l3.541 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4282
Entropy (8bit):	5.14710392281896
Encrypted:	false
SSDEEP:	48:oIfiDjgyCahN7CsY5FWzij1KzfYJSg/CCzCXzrD0/CCzCuzjfn/CCzChzbmlMh06:K3gYj7UXSgdkPPQc9d3v2U
MD5:	68FC9D61252BE7A1B4C98749F8F7CFB9
SHA1:	54C903A5855FB33E8652A14FA7449043375C30B7
SHA-256:	3AE0F07DEB3BE919FC8A25506932B877988B46D13BB4DCDF7F517D216E7188D5
SHA-512:	0D3C699630A1B4D75E7D655AFD2D6460A5717D1BA3C1335C2A6A5D56D269178C7263B54EB72A43B4471AE1ABEFB2DCFDF25E2E43C24E78E0E43E74DFBC25486C
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq
Preview:	..<!DOCTYPE html>..<html lang="en">....<head><script>function requestLink(){return {sessionId:['sid','t1~h3kot5fviqggcvkjcizogbcq']};}</script>...<meta charset="UTF-8">...<title id="title">Confidential dating in your area?</title>...<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=0" />.....<link href="https://fonts.googleapis.com/css?family=PT+Sans+Narrow:400,700\|PT+Sans:400,700&display=swap" rel="stylesheet">...<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css">...<link href="/util/flag-icon/css/flag-icon.css" rel="stylesheet" type="text/css"/>...<link rel="stylesheet" type="text/css" href="/media/dating/striptease2/css/style.css">...<link rel="stylesheet" type="text/css" href="/media/dating/striptease2/css/style_shagslags.css">.....<script type="text/javascript" src="/cookie/js.cookie.js"></script>...<script type="text/javascript" src="/util/utils.js"></script>..</head>....<body class="big-but

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5746
Entropy (8bit):	5.487892021181506
Encrypted:	false
SSDEEP:	96:ROEaohOEa9FZOOEayVc+ucOEaGNROpa6hOpaBFZOOpasVc+ucOpa5gNAOEa+oQOs:eou3ooA6LGWB5g+ofWIpJCLCNKQg
MD5:	963EF795CB8219DDB5B89EB806342DBD
SHA1:	2FA46201DF5FDA255FB2DF84A4C5E9641996794A
SHA-256:	AF180615A68E9C9BB8B3DB386B7679545D931A4CC493B5F3F383C48B04B1272F
SHA-512:	55D0CBAC09CD022BBEB9E24C0CD6390EBD421C7C8C80571E85665B4D29BC1946EF15924DE6FA356F154A1B032205EE38FB68A8C84C702AE846067A65F2BF5A5C
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=PT+Sans+Narrow:400,700\|PT+Sans:400,700&display=swap"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'PT Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0-ExdGM.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'PT Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0aExdGM.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ latin-ext /.@font-face {. font-family: 'PT Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0yExdGM.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. f

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	downloaded
Size (bytes):	7514
Entropy (8bit):	5.36978614782565
Encrypted:	false
SSDEEP:	192:nv6UDdoxY4iYiXKF3nwx16qI9S7+6uRIpauZy4hpjgRxtSY8xd:nv6wixY4iYi+3nwx16q97D3Zy47jgRxE
MD5:	85A42B1D6C8769FCE99FB44AEFB041B0
SHA1:	2C6BA9C724CEEC8AB80658429A031F2991EB930B
SHA-256:	A487D76BB55539F230C127EF33550D5C455AC0B67CA2B78B87452345BB0DC718
SHA-512:	7EEBCBD1A5452F24928918D459C99644A61122343F2B6167C29A8C13295550535935AB6764CC75D036AE4FBFCDFF7CA91CA9388A3A91428E8DA665F2EF540FC5
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/util/utils.js
Preview:	/** docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. /..!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.length;t++)o[t].fn.call(window,o[t].ctx);o=[]}}function d(){"complete"===document.readyState&&n()}t=t\|\|"docReady",e=e\|\|window;var o=[],a=!1,c=!1;e[t]=function(t,e){return a?void setTimeout(function(){t(e)},1):(o.push({fn:t,ctx:e}),void("complete"===document.readyState\|\|!document.attachEvent&&"interactive"===document.readyState?setTimeout(n,1):c\|\|(document.addEventListener?(document.addEventListener("DOMContentLoaded",n,!1),window.addEventListener("load",n,!1)):(document.attachEvent("onreadystatechange",d),window.attachEvent("onload",n)),c=!0)))}}("docReady",window);....function getParameterByName(name) {...name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");...var regex = new RegExp("[\\?&]" + name + "=([^&#])"),....results = r

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	35646
Entropy (8bit):	5.207254939270255
Encrypted:	false
SSDEEP:	384:K2ULvf5A8UQ4fjfUcICiUJ2UTHonslcnqOWc2SoKi:K2UmZB2UTHonslcnqOWc2SoV
MD5:	81AF0F0103508AB2699A60003FE4E8A5
SHA1:	C779D1DF44F4625A5437DF08B94609919F69ED33
SHA-256:	B03A446721B9E06EE555354E52FE1CB358A47CE3BFD7F42CF3AC2C03674FAFCF
SHA-512:	2C373E7EADA4A7992D992F4FB18DC618FC08EBAA47C481EB62E8F7E3A0ACAB364F5DDB71D1A55FADE79ECD2DEF2A76A62BF070E018C03256FC3159E9CF42FBE0
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/dating/striptease2/css/style.css
Preview:	@font-face {.. font-family: HelveticaNeue;.. src: url('../fonts/HelveticaNeue.eot');.. src: url('../fonts/HelveticaNeue.eot#iefix') format('embedded-opentype'), url('../fonts/HelveticaNeue.woff2') format('woff2'), url('../fonts/HelveticaNeue.woff') format('woff'), url('../fonts/HelveticaNeue.ttf') format('truetype'), url('../fonts/HelveticaNeue.svg#HelveticaNeue') format('svg');.. font-weight: 400;..}..@font-face {.. font-family: AvenirNext;.. font-style: normal;.. font-weight: 400;.. src: url("../fonts/avenir-next-regular.woff") format("woff");..}..@font-face {.. font-family: AvenirNext;.. font-style: normal;.. font-weight: 500;.. src: url("../fonts/avenir-next-medium.woff") format("woff");..}..@font-face {.. font-family: AvenirNext;.. font-style: normal;.. font-weight: 700;.. src: url("../fonts/avenir-next-demi.woff") format("woff");..}...slide {.. display: none;..}...slidebuttons {.. margin: 15px 0;..}...slide_next,...slide_previous {.. position: relative;..}...sl

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.2728620670692266
Encrypted:	false
SSDEEP:	12:YGGHrpH1c0aNmi7W4ZL3JReiISUuNmyr5YQYCtSUuNmcvr5YkxwX4m7DMjN11EsE:YhFHwNhC4ZLJfUTyr5nYxUTcvr53i4mL
MD5:	49A268FABC8B3BE3E9940D61CF29B594
SHA1:	A401C1438EEBCDCC97A23A0C200C4FC1E64E58C4
SHA-256:	69A81096355E07413138DEBB06E50C2DEAB32ABF0B46BAFB0E9F1D6AD0799F5A
SHA-512:	C59C3A14AD5711543171CA0A67DBE18B71A00B4AEA833C7E7D546D558FF631F05EF91A6C2F9EF5CCEAF786A38D74B49AF85D15E94095AA712226C62E448E6D4A
Malicious:	false
Reputation:	low
Preview:	{"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":".tats Unis","ja":"....","pt-BR":"EUA","ru":"...","zh-CN":".."},"city":{"de":"New York City","en":"New York","es":"Nueva York","fr":"New York","ja":"......","pt-BR":"Nova Iorque","ru":"...-....","zh-CN":""},"subdiv":[{"de":"New York","en":"New York","es":"Nueva York","fr":"New York","ja":".......","pt-BR":"Nova Iorque","ru":"...-....","zh-CN":"..."}],"pc":"10118","ip":"8.46.123.33","brand":"","model":"Windows Desktop","browser":"Chrome","isp":"CenturyLink","lat":40.7123,"long":-74.0068}

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65266)
Category:	downloaded
Size (bytes):	72854
Entropy (8bit):	5.250494014426796
Encrypted:	false
SSDEEP:	1536:G/bfaGDD6Jfi2SR6bZUniaodx9uFwhQD8AWKhtUV5Y7hk30gyzVya4j2Cl:ECGEFKO5X4YjZl
MD5:	6B833BE81CB60FE4835D0783D2234EB4
SHA1:	92BE741D647DCD122ED274D9684B5CA55792DFEF
SHA-256:	33D17919FB2AA98672164C1FE98574E69C2169D0C73D0408EE2C97B7A64D5CC5
SHA-512:	C8D49A683F6EE467B31DD6ADC6078D63898347FC3080200C3306647A53642991E5CC05AFFAD313A406A1152637B81C8E00DA645EDF43AD54D8AA558598E58E97
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/dating/striptease2/js/jquery-3.1.1.min.js
Preview:	/!. jQuery JavaScript Library v3.1.1. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2016-09-22T22:30Z. */.(function(n,t){"use strict";typeof module=="object"&&typeof module.exports=="object"?module.exports=n.document?t(n,!0):function(n){if(!n.document)throw new Error("jQuery requires a window with a document");return t(n)}:t(n)})(typeof window!="undefined"?window:this,function(n,t){"use strict";function gi(n,t){t=t\|\|u;var i=t.createElement("script");i.text=n;t.head.appendChild(i).parentNode.removeChild(i)}function ui(n){var t=!!n&&"length"in n&&n.length,r=i.type(n);return r==="function"\|\|i.isWindow(n)?!1:r==="array"\|\|t===0\|\|typeof t=="number"&&t>0&&t-1 in n}function fi(n,t,r){return i.isFunction(t)?i.grep(n,function(n,i){return!!t.call(n,i,n)!==r}):t.nodeType?i.grep(n,function(n){return n===t!==r}):typeof t!="string"?i.grep(n,

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	7742
Entropy (8bit):	5.162639964882372
Encrypted:	false
SSDEEP:	96:ROMbMN2axQjQ8hGrzH+bfSKgL2DzAvv5Mxzx08xXi/aLCt6Q/2ptVUQ210ZJu7eI:UMYNJ8I+KQr4
MD5:	8C162E9DC38A2E41524268290545D238
SHA1:	D913570A6D12E940840586DA952E38E8803B7631
SHA-256:	9AB1C535888C058D5FF5318020FE6D6C92B2EA79207930C6BC6DC6DD623F763F
SHA-512:	7EC2EDFC87A411826965E29275DEE0C238B4161326284C659167AC367A0020384EE2422D50D9EFF054D5A39C21BBA1027A7F0863FDD9F30DDBD046993BF0887D
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/dating/striptease2/js/main_casual.js
Preview:	.var striptease = {};....// If site is not multilang..if(!$('body').hasClass('multilang')) {...function changeCity(data) {....if (data.city.ru && $('#title-ru').length) {.....$('#title-ru').text('...... .......... . .. ' + data.city.ru + '?');....}....else if (data.city.en && $('#title').length) {.....$('#title').text('Confidential dating in ' + data.city.en + '?');....}...}.....setTimeout(function() {....if (geoRefData) {.....changeCity(geoRefData);....} else {.....var request = new XMLHttpRequest();.....request.open('GET', 'https://bigdatajsext.com/ExtService.svc/getextparams', true);.......request.onload = function() {......if (request.status >= 200 && request.status < 400) {.......var data = JSON.parse(request.responseText);.......changeCity(data);......} else {.......console.log('Server returned an error');......}.....};.......request.onerror = function() {......console.log('Error: ' + request.status);.....};.....request.send();....}...}, 700);..}....jQuery(doc

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27303)
Category:	downloaded
Size (bytes):	27466
Entropy (8bit):	4.752060795123139
Encrypted:	false
SSDEEP:	384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T
MD5:	4FBD15CB6047AF93373F4F895639C8BF
SHA1:	12D6861075DE8E293265FF6FF03B1F3ADCB44C76
SHA-256:	DDD92F10AD162C7449EFF0ACAF40598C05B1111739587EDB75E5326B6697C5D5
SHA-512:	F8BE32CBA15170319B5C9F663C6F0C4FFDD4083CF047D80F7B214D302B489ECA25FBEE66DDB9366D758A7598EFC9B9A886B02C9F751AE71F207CB9DB1356243A
Malicious:	false
Reputation:	low
URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Preview:	/!. Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.5.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.5.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7742
Entropy (8bit):	5.162639964882372
Encrypted:	false
SSDEEP:	96:ROMbMN2axQjQ8hGrzH+bfSKgL2DzAvv5Mxzx08xXi/aLCt6Q/2ptVUQ210ZJu7eI:UMYNJ8I+KQr4
MD5:	8C162E9DC38A2E41524268290545D238
SHA1:	D913570A6D12E940840586DA952E38E8803B7631
SHA-256:	9AB1C535888C058D5FF5318020FE6D6C92B2EA79207930C6BC6DC6DD623F763F
SHA-512:	7EC2EDFC87A411826965E29275DEE0C238B4161326284C659167AC367A0020384EE2422D50D9EFF054D5A39C21BBA1027A7F0863FDD9F30DDBD046993BF0887D
Malicious:	false
Reputation:	low
Preview:	.var striptease = {};....// If site is not multilang..if(!$('body').hasClass('multilang')) {...function changeCity(data) {....if (data.city.ru && $('#title-ru').length) {.....$('#title-ru').text('...... .......... . .. ' + data.city.ru + '?');....}....else if (data.city.en && $('#title').length) {.....$('#title').text('Confidential dating in ' + data.city.en + '?');....}...}.....setTimeout(function() {....if (geoRefData) {.....changeCity(geoRefData);....} else {.....var request = new XMLHttpRequest();.....request.open('GET', 'https://bigdatajsext.com/ExtService.svc/getextparams', true);.......request.onload = function() {......if (request.status >= 200 && request.status < 400) {.......var data = JSON.parse(request.responseText);.......changeCity(data);......} else {.......console.log('Server returned an error');......}.....};.......request.onerror = function() {......console.log('Error: ' + request.status);.....};.....request.send();....}...}, 700);..}....jQuery(doc

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6215
Entropy (8bit):	4.1844959720420025
Encrypted:	false
SSDEEP:	24:t4obKtc4KM7e9KKKKK+5aKKKK+oG/tEBkmAqkmEkevNknkm6nkjA+voLiFXVhxVM:624vhy
MD5:	2B327BDA75CCB4C9C3CD7EA61C4FED82
SHA1:	4C3D575D257B08BC7C12B5C1A6F7E6B76A0E1AC9
SHA-256:	7DB44305E217E7A44845B47FE090B5F077A1CECF820899C7A6977B26549CDC08
SHA-512:	8514024D4FB05C81F8C81768EC3B47E7026E04CED02B6EA3AFA0E22B49611E8FAFE334CAF9A2FCB628E028C257349A224CAD16468CD29263346FCD5828895B97
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480">.. <g fill-rule="evenodd" transform="scale(.9375)">.. <g stroke-width="1pt">.. <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#bd3d44"/>.. <path d="M0 39.385h972.81V78.77H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z" fill="#fff"/>.. </g>.. <path fill="#192f5d" d="M0 0h389.12v275.69H0z"/>.. <g fill="#fff">.. <path d="M32.427 11.8l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735h11.457zm64.853 0l3.541 10.896h11.458l-9.27 6.735 3.541 10.896-9.27-6.734-9.268 6.734 3.54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	dropped
Size (bytes):	7514
Entropy (8bit):	5.36978614782565
Encrypted:	false
SSDEEP:	192:nv6UDdoxY4iYiXKF3nwx16qI9S7+6uRIpauZy4hpjgRxtSY8xd:nv6wixY4iYi+3nwx16q97D3Zy47jgRxE
MD5:	85A42B1D6C8769FCE99FB44AEFB041B0
SHA1:	2C6BA9C724CEEC8AB80658429A031F2991EB930B
SHA-256:	A487D76BB55539F230C127EF33550D5C455AC0B67CA2B78B87452345BB0DC718
SHA-512:	7EEBCBD1A5452F24928918D459C99644A61122343F2B6167C29A8C13295550535935AB6764CC75D036AE4FBFCDFF7CA91CA9388A3A91428E8DA665F2EF540FC5
Malicious:	false
Reputation:	low
Preview:	/** docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. /..!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.length;t++)o[t].fn.call(window,o[t].ctx);o=[]}}function d(){"complete"===document.readyState&&n()}t=t\|\|"docReady",e=e\|\|window;var o=[],a=!1,c=!1;e[t]=function(t,e){return a?void setTimeout(function(){t(e)},1):(o.push({fn:t,ctx:e}),void("complete"===document.readyState\|\|!document.attachEvent&&"interactive"===document.readyState?setTimeout(n,1):c\|\|(document.addEventListener?(document.addEventListener("DOMContentLoaded",n,!1),window.addEventListener("load",n,!1)):(document.attachEvent("onreadystatechange",d),window.attachEvent("onload",n)),c=!0)))}}("docReady",window);....function getParameterByName(name) {...name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");...var regex = new RegExp("[\\?&]" + name + "=([^&#])"),....results = r

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	40627
Entropy (8bit):	4.902743250090843
Encrypted:	false
SSDEEP:	384:94fWpOSJ/TqlgSxMUj6/GlQ1EzvxqFbyqVD:94+pvJTqlgSxMUj6/GlQY4yqR
MD5:	0A47B937981E7389E3EBE63E4A503066
SHA1:	01B395AD016A1D9D15016D765F7D2C51A6E2809B
SHA-256:	D6AFD8D9ABC2967F29AD396854CD05B1A12DCF9B7084F944C136CA6F540C5A39
SHA-512:	BCA846A7EBD76ADB4CCF01805CDA0BFC53673570B58289057B2F595AC5700E83A80B574EE5E005C9FFBB003AA7872E45A9D35FB728BD35701B040435B2425E24
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/util/flag-icon/css/flag-icon.css
Preview:	/* geo location css /..#userLocation,..#userLocationFlag,...userLocation{.. display: inline;.. position: relative;.. line-height: 1em;..}..#userLocation .flag-icon,..#userLocationFlag .flag-icon,...userLocation .flag-icon{.. display: inline-block;.. position: relative;.. top: -0.05em;.. margin-right: 0.3em;..}..#userLocation.circled .flag-icon-squared,..#userLocationFlag.circled .flag-icon-squared,...userLocation.circled .flag-icon-squared{.. border-radius: 50%;..}...userLocation.flag-fixed {.. position: absolute;.. z-index: 1000;.. font-size: 30px;..}..#userLocation.flag-fixed .flag-icon,..#userLocationFlag.flag-fixed .flag-icon,...userLocation.flag-fixed .flag-icon {.. top: 0;.. margin-right: 0;..}...userLocation.flag-fixed.tr {.. top: 5px;.. right: 5px;..}...userLocation.flag-fixed.tl {.. top: 5px;.. left: 5px;..}../ flag-icon css */...flag-icon-background {.. background-size: contain;.. background-position: 50%;.. background-repeat: no-repeat;..}...flag-icon

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	downloaded
Size (bytes):	3473
Entropy (8bit):	5.295540835340235
Encrypted:	false
SSDEEP:	96:4hyv7ENoieixqbCfQEJE3OeVJ/Q+GFi82LMw:9vYNE3OfdE3fI+R82Lv
MD5:	625E5E2950612F771E246BEB33C9EA61
SHA1:	E4FC251C6C000496C285F8DC3FA097040B031681
SHA-256:	618F345A156A0EDA55177A1BF0E8A414104F9B6C6FF5CDBE71966F081CCB8A46
SHA-512:	655F0B373C605D0A464BEDCA4DF204FB3AA12442C5B0AA3B8BF13E0604FD1E89480356E9C6CC9A432F81305BF1151CAF4AC4AD9D8EB24EB78CBD11318E5B9657
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/exit-new/exit1.js
Preview:	/* docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */..!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.length;t++)o[t].fn.call(window,o[t].ctx);o=[]}}function d(){"complete"===document.readyState&&n()}t=t\|\|"docReady",e=e\|\|window;var o=[],a=!1,c=!1;e[t]=function(t,e){return a?void setTimeout(function(){t(e)},1):(o.push({fn:t,ctx:e}),void("complete"===document.readyState\|\|!document.attachEvent&&"interactive"===document.readyState?setTimeout(n,1):c\|\|(document.addEventListener?(document.addEventListener("DOMContentLoaded",n,!1),window.addEventListener("load",n,!1)):(document.attachEvent("onreadystatechange",d),window.attachEvent("onload",n)),c=!0)))}}("docReady",window);....var PreventExitSplash = true;....function getUrlParameter(name) {...name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");...var regex = new RegExp("[\\?&]" + name +

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 1921x1081, components 3
Category:	downloaded
Size (bytes):	69020
Entropy (8bit):	7.20096771336261
Encrypted:	false
SSDEEP:	1536:6zJHjjjjjjjjjjjjjjjR9fjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjsjjjjjjjjjq:mJjjjjjjjjjjjjjjjR9fjjjjjjjjjjjm
MD5:	29D4B3A7272689E578C5F6DD5ECC8ACE
SHA1:	B97EA601DB5403A51AD2009506BAF2DAAAA8E5F5
SHA-256:	EC3DDDF004FB11A4AFF2D9944A11018FAD96869A55672A3C04CC6EC66F9F9D0B
SHA-512:	9E07013831A29CF174BA64F522D34987B6306AAE8634F88913314245F69C3748D53300C65F2AC49D57470FA7920C93F1BE5836F0DB7451F0A87CC53405C5434A
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/dating/striptease2/images/casual_2/1.jpg
Preview:	......JFIF.....,.,.....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......9...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......z..oo........4.....:7....M......?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.......@....?.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	633
Entropy (8bit):	5.2728620670692266
Encrypted:	false
SSDEEP:	12:YGGHrpH1c0aNmi7W4ZL3JReiISUuNmyr5YQYCtSUuNmcvr5YkxwX4m7DMjN11EsE:YhFHwNhC4ZLJfUTyr5nYxUTcvr53i4mL
MD5:	49A268FABC8B3BE3E9940D61CF29B594
SHA1:	A401C1438EEBCDCC97A23A0C200C4FC1E64E58C4
SHA-256:	69A81096355E07413138DEBB06E50C2DEAB32ABF0B46BAFB0E9F1D6AD0799F5A
SHA-512:	C59C3A14AD5711543171CA0A67DBE18B71A00B4AEA833C7E7D546D558FF631F05EF91A6C2F9EF5CCEAF786A38D74B49AF85D15E94095AA712226C62E448E6D4A
Malicious:	false
Reputation:	low
URL:	https://bigdatajsext.com/ExtService.svc/getextparams
Preview:	{"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":".tats Unis","ja":"....","pt-BR":"EUA","ru":"...","zh-CN":".."},"city":{"de":"New York City","en":"New York","es":"Nueva York","fr":"New York","ja":"......","pt-BR":"Nova Iorque","ru":"...-....","zh-CN":""},"subdiv":[{"de":"New York","en":"New York","es":"Nueva York","fr":"New York","ja":".......","pt-BR":"Nova Iorque","ru":"...-....","zh-CN":"..."}],"pc":"10118","ip":"8.46.123.33","brand":"","model":"Windows Desktop","browser":"Chrome","isp":"CenturyLink","lat":40.7123,"long":-74.0068}

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1709), with CRLF line terminators
Category:	downloaded
Size (bytes):	4264
Entropy (8bit):	5.365773121802454
Encrypted:	false
SSDEEP:	48:MnCmrorDzy9AVYnVReoHEmFZqLghLVQiAdHy9QShp8dLocCTRTvg84Re6YzMtpyX:iCyojFOJEiXA1hyvt4T7tpyD2bm
MD5:	A7E9883924072F15259DE6888D5EF515
SHA1:	7F4F6E5938E68F55AEF81E0CD0145F008CD28382
SHA-256:	985659942AB60A92B3C0A7F876D9EF60E8F048FF655A622A172FA4B44F901B6C
SHA-512:	F6F2859B644B249CEBE21B0AF49C0EFA046EEDC95814AD4CAC400B25D6FDDBB7A155DB420359CCFC8570EB18899CDC369DCBF5C137F4CB21F24B27F8F297BE48
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/cookie/js.cookie.js
Preview:	/!.. JavaScript Cookie v2.1.3.. * https://github.com/js-cookie/js-cookie.. .. Copyright 2006, 2015 Klaus Hartl & Fagner Brack.. * Released under the MIT license.. /..!function(e){var n=!1;if("function"==typeof define&&define.amd&&(define(e),n=!0),"object"==typeof exports&&(module.exports=e(),n=!0),!n){var t=window.Cookies,o=window.Cookies=e();o.noConflict=function(){return window.Cookies=t,o}}}(function(){function e(){for(var e=0,n={};e<arguments.length;e++){var t=arguments[e];for(var o in t)n[o]=t[o]}return n}function n(t){function o(n,r,i){var c;if("undefined"!=typeof document){if(arguments.length>1){if(i=e({path:"/"},o.defaults,i),"number"==typeof i.expires){var a=new Date;a.setMilliseconds(a.getMilliseconds()+864e5i.expires),i.expires=a}try{c=JSON.stringify(r),/^[\{\[]/.test(c)&&(r=c)}catch(s){}return r=t.write?t.write(r,n):encodeURIComponent(String(r)).replace(/%(23\|24\|26\|2B\|3A\|3C\|3E\|3D\|2F\|3F\|40\|5B\|5D\|5E\|60\|7B\|7D\|7C)/g,decodeURIComponent),n=encodeURIComponent(String(n)),n=

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	dropped
Size (bytes):	3473
Entropy (8bit):	5.295540835340235
Encrypted:	false
SSDEEP:	96:4hyv7ENoieixqbCfQEJE3OeVJ/Q+GFi82LMw:9vYNE3OfdE3fI+R82Lv
MD5:	625E5E2950612F771E246BEB33C9EA61
SHA1:	E4FC251C6C000496C285F8DC3FA097040B031681
SHA-256:	618F345A156A0EDA55177A1BF0E8A414104F9B6C6FF5CDBE71966F081CCB8A46
SHA-512:	655F0B373C605D0A464BEDCA4DF204FB3AA12442C5B0AA3B8BF13E0604FD1E89480356E9C6CC9A432F81305BF1151CAF4AC4AD9D8EB24EB78CBD11318E5B9657
Malicious:	false
Reputation:	low
Preview:	/* docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */..!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.length;t++)o[t].fn.call(window,o[t].ctx);o=[]}}function d(){"complete"===document.readyState&&n()}t=t\|\|"docReady",e=e\|\|window;var o=[],a=!1,c=!1;e[t]=function(t,e){return a?void setTimeout(function(){t(e)},1):(o.push({fn:t,ctx:e}),void("complete"===document.readyState\|\|!document.attachEvent&&"interactive"===document.readyState?setTimeout(n,1):c\|\|(document.addEventListener?(document.addEventListener("DOMContentLoaded",n,!1),window.addEventListener("load",n,!1)):(document.attachEvent("onreadystatechange",d),window.attachEvent("onload",n)),c=!0)))}}("docReady",window);....var PreventExitSplash = true;....function getUrlParameter(name) {...name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");...var regex = new RegExp("[\\?&]" + name +

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2651
Entropy (8bit):	5.212101612420597
Encrypted:	false
SSDEEP:	48:0Po3L47oO5kZNOAhpT6T5pw5pbu5pQ5pb5pW5pAH5pzq5p6Z5pNz5pnA:0Po3M7aOSo0Kcb+aZZogjHNtA
MD5:	3B951FF51A1E5F75DAC02C6F3A170AFC
SHA1:	9900C6A7194618953398BEBA6284028714D924C1
SHA-256:	E67373563F4508CD2C11E18CAAA33E42FB5F61AAD7E21CC9B2F9BDA05EE865FD
SHA-512:	B2EA65040542C0C06C1937520B91E49C5B4781ED041D0A11AF688B66FE761209E5DFADDEE1325CC45FC357DE6EE1B2847B94F32B2D6A83A9D6D97D42C2CD4457
Malicious:	false
Reputation:	low
URL:	https://flirtfantasy.one/media/dating/striptease2/css/style_shagslags.css
Preview:	/* Style Shagslags */....body {.. font: 400 16px / normal "PT Sans", serif;..}..main {.. background: rgba(255, 255, 255, .94);..}..header {.. background: rgba(150, 122, 220, .8);..}..header h1 {.. color: #fff;..}..header .userLocation .flag-icon {.. top: auto !important;.. margin: 0 !important;..}..h2 {.. font-family: pt sans narrow, sans-serif;.. font-weight: 700;..}...percentage_wrapper {.. background: #cabde9;..}...percentage_done {.. background: #30cfc0;..}...clock-container,...clock {.. color: #fff;..}...btns-wrap,...btn-wrap {.. -webkit-box-align: center;.. -ms-flex-align: center;.. align-items: center;.. max-width: 400px;.. width: 100%;.. margin: 10px auto 0;..}...btn-wrap {.. max-width: 300px;..}...slide_next {.. font-size: 20px;.. color: #fff;.. text-transform: uppercase;.. background: #45a333;.. background-image: linear-gradient(#60c851, #3c8b30);.. width: 47%;.. margin:0 5px auto;.. padding: 15px 3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 23:30:19.096837044 CEST	49676	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:30:19.096843004 CEST	49678	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:30:19.096843004 CEST	49677	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:30:20.585743904 CEST	49714	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.585923910 CEST	49715	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.590621948 CEST	80	49714	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:20.590687037 CEST	49714	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.590706110 CEST	80	49715	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:20.590764999 CEST	49715	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.759696007 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.759733915 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:20.759825945 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.759985924 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:20.760001898 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.082561016 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.082837105 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.082858086 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.083913088 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.083978891 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.084970951 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.085047960 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.085136890 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.127404928 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.135585070 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.135607958 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.183629990 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.238612890 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.238686085 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.239236116 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.239236116 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.239274025 CEST	443	49716	15.197.225.128	192.168.2.17
Oct 7, 2024 23:30:22.239336967 CEST	49716	443	192.168.2.17	15.197.225.128
Oct 7, 2024 23:30:22.254966021 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:22.255017042 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:22.255250931 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:22.255403042 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:22.255414963 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.190526009 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.190781116 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.190788984 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.191832066 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.191912889 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.192827940 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.192890882 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.193065882 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.193072081 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.237905025 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.394931078 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.394995928 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.395165920 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.395183086 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.395232916 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.395616055 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.395842075 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.395896912 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.396125078 CEST	49718	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.396138906 CEST	443	49718	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.415971041 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.416008949 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.416090012 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.416161060 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.416186094 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.416241884 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.416563988 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.416601896 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.416665077 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.417279959 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.417292118 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.417347908 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.417678118 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.417695999 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.417984962 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.417998075 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.418323040 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.418335915 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.418397903 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.418525934 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.418541908 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.418785095 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.418821096 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.418883085 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.419018030 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.419034004 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.419425011 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.419435978 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.419554949 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:23.419570923 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:23.423306942 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.423317909 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.423404932 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.423592091 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.423609972 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.872303009 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.872677088 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.872694016 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.874111891 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.874190092 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.875015020 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.875097990 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.875171900 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.875180960 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.924557924 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.986710072 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.986835003 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.986917019 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.986987114 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.986996889 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987025976 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987052917 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.987159014 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987207890 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.987219095 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987293959 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987341881 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.987350941 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987457037 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:23.987504959 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:23.987514019 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.036581993 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.036600113 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.052798033 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.053328037 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.053364992 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.054488897 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.054565907 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.054816961 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.054913998 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.054941893 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.062319040 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.062344074 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.062505007 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.062517881 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.062623024 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.062634945 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.062939882 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.063204050 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.063251019 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.063302994 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.063514948 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.063577890 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.063838959 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.063900948 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.063926935 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.069134951 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069242954 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069255114 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.069272995 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069319963 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.069334984 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069497108 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069545984 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.069555044 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069850922 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.069911957 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.069921017 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.070002079 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.070048094 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.070046902 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.070059061 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.070209980 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.070246935 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.070261002 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.070269108 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.070305109 CEST	49726	443	192.168.2.17	104.18.10.207
Oct 7, 2024 23:30:24.070317984 CEST	443	49726	104.18.10.207	192.168.2.17
Oct 7, 2024 23:30:24.070422888 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.070630074 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.070638895 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.071135998 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.071197033 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.071455002 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.071513891 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.071583033 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.071593046 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.071758032 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.071810961 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.072042942 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.072067022 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.072117090 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.072118044 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.072253942 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.072268963 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.073370934 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.073673964 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.073793888 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.073801041 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.073843956 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.095447063 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.099672079 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.099704981 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.107413054 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.111404896 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.115439892 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.115663052 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.115670919 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.115670919 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.115673065 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.115679979 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.115685940 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:24.147811890 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.163703918 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:24.163705111 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259501934 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259536028 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259584904 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259593964 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259593964 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259644985 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259650946 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259665966 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259682894 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259686947 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259687901 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259744883 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259744883 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259749889 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259748936 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259752989 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259764910 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259809971 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259824991 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259844065 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259855986 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259857893 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259872913 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259905100 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259911060 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259927988 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259946108 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259948969 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259968042 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.259969950 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.259982109 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260014057 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260020018 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260039091 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260062933 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260083914 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260092974 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260112047 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260137081 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260154009 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260169029 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260169983 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260211945 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260216951 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260219097 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260230064 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260288954 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260293007 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260293961 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260318995 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260319948 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260334969 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260370016 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260411024 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260458946 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.260466099 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.260514021 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.262403011 CEST	49721	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.262418985 CEST	443	49721	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.262783051 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.262840033 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.262919903 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.263468981 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.263498068 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.263616085 CEST	49723	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.263624907 CEST	443	49723	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.263999939 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264015913 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264019012 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.264028072 CEST	443	49722	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.264035940 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264076948 CEST	49722	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264132023 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264271021 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264287949 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.264337063 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264872074 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264883995 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.264925957 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.264940977 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.265047073 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.265114069 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.265193939 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.265320063 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.265883923 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.265954018 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.265969038 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.266117096 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.266129017 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.266151905 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.266174078 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.266227961 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.266280890 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.266863108 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.266892910 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.266927004 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.266953945 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267102003 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.267163992 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.267235994 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.267369032 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.267456055 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267487049 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.267568111 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267656088 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.267687082 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.267709017 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267725945 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.267759085 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267784119 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.267860889 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.267895937 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.269229889 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.269252062 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.269309998 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.269340038 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.269399881 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.269426107 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.269480944 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.269624949 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.270101070 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.270164967 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.270205021 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.270207882 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.270272017 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.270282984 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.270309925 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.270309925 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.270329952 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.270350933 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.271262884 CEST	49720	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.271274090 CEST	443	49720	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.271579981 CEST	49724	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.271600962 CEST	443	49724	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.273679972 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.273741961 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.274204969 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.274265051 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.274435043 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.274497986 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.277029037 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.277108908 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.277131081 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.277188063 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.277218103 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.277271986 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.278589010 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.278666973 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.278906107 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.278971910 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.279652119 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.279723883 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.280289888 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.280359983 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.280370951 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.280416012 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.280477047 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.280505896 CEST	443	49719	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.280564070 CEST	49719	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.303853035 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.303920031 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.303986073 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.304048061 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.304085970 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.304131031 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.304600000 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.304611921 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.304765940 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.304779053 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.897584915 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.897933006 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.898000956 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.899096966 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.899184942 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.900110960 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.900188923 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.911576986 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.911767960 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.911777973 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.911837101 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.912024975 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.912051916 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.912820101 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.912888050 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.913124084 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.913147926 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.913218975 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.913407087 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.913486958 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.913496017 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.913572073 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.913584948 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.921092987 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.921308994 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.921324968 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.921642065 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.921927929 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.921986103 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.922066927 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.948600054 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:25.948663950 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:25.957967043 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.958174944 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.958184004 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.959060907 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.959121943 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.959377050 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.959405899 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.959441900 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.959507942 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.963408947 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.964576006 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.964591980 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.964822054 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.966149092 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.966327906 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.966363907 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.967381954 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.967463970 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.967708111 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.967767000 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:25.967784882 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:25.996588945 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:26.007404089 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.011445999 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.012597084 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.012598991 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.012605906 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.012630939 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.060602903 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.061220884 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.259903908 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.259927988 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.259979963 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.259990931 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.260042906 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.262044907 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.262109041 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.262116909 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.262150049 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.262161970 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.262227058 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.262440920 CEST	49729	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.262453079 CEST	443	49729	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.264878035 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.264976978 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.265111923 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.265336990 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.265372038 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305176973 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305200100 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305228949 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305236101 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305274963 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.305293083 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305324078 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.305367947 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.305367947 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.306005001 CEST	49733	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.306015015 CEST	443	49733	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.307604074 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.307629108 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.307714939 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.307749033 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.307787895 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316370010 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316450119 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316576004 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316611052 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316628933 CEST	443	49732	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316641092 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316664934 CEST	49732	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316746950 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316761017 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316783905 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316817045 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316827059 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316870928 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.316880941 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316888094 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.316927910 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.319933891 CEST	49728	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.319951057 CEST	443	49728	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.321053982 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.321186066 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.321405888 CEST	49727	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.321423054 CEST	443	49727	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.323126078 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.323168039 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.324801922 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.325114965 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.325131893 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.334924936 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.334983110 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.335067034 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.335510015 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.335536003 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.344393969 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:26.344419956 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:26.344661951 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:26.344661951 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:26.344691992 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:26.960273981 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.960673094 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.960709095 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.961055040 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.961349010 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:26.961416960 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:26.961472034 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.003426075 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.034642935 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.035155058 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.035187960 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.036320925 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.036690950 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.036830902 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.036876917 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.040081978 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.040287018 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.040326118 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.041439056 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.041512012 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.041768074 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.041835070 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.041919947 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.041930914 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.083708048 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.083719015 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.213639975 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.213661909 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.213852882 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.213891983 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.213943005 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.214426994 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.214483976 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.214528084 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.214571953 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.214581013 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.214607000 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.214658976 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.214911938 CEST	49735	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.214931965 CEST	443	49735	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.230163097 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.230448961 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.230464935 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.231535912 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.231921911 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.232683897 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.232747078 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.232861042 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.232868910 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.235044956 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.235070944 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.235129118 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.235145092 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.235167980 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.235200882 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.235229969 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.235675097 CEST	49736	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.235688925 CEST	443	49736	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.275666952 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.389925003 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.390131950 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.390218973 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.390790939 CEST	49737	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.390822887 CEST	443	49737	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.417679071 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.417762995 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.417927027 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.419404030 CEST	49738	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.419431925 CEST	443	49738	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.422744989 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.422779083 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.422872066 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.423089981 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:27.423100948 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:27.430372000 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.430381060 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:27.430458069 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.430655956 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:27.430665970 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.049485922 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.049828053 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.049856901 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.053417921 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.053509951 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.053843975 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.053982973 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.054009914 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.102650881 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.102678061 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.111079931 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.111409903 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.111421108 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.112535954 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.112930059 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.113102913 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.113107920 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.150621891 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.159445047 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.166681051 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.363466978 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.363564968 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.363653898 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.364622116 CEST	49740	443	192.168.2.17	136.243.216.252
Oct 7, 2024 23:30:28.364646912 CEST	443	49740	136.243.216.252	192.168.2.17
Oct 7, 2024 23:30:28.505626917 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.505686998 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.505763054 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.505793095 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.505961895 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.506011009 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.506072998 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.506079912 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.506128073 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.506134033 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.506181955 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.506818056 CEST	49739	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.506834030 CEST	443	49739	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.510555029 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.510593891 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.511065960 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.511065960 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.511125088 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.554579020 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.554622889 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:28.554876089 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.555167913 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:28.555182934 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.204891920 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.205178022 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.205200911 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.206346035 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.206923008 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.207067013 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.207110882 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.207128048 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.207519054 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.207537889 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.207933903 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.208302021 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.208439112 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.208444118 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.208458900 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.251614094 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.251614094 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.309400082 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.309433937 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:29.309509993 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.311562061 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.311577082 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:29.543958902 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544013977 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544075012 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.544084072 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544120073 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.544133902 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544193983 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.544198990 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544239998 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.544290066 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.544336081 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.545016050 CEST	49741	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.545034885 CEST	443	49741	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.604227066 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.604269981 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.604409933 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.604422092 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.604463100 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.605246067 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.605319977 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.621104956 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.621179104 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.722306013 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.722440004 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.722462893 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.722492933 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.722512960 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.722543001 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.722595930 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.722647905 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.723242998 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.723297119 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.725177050 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.725241899 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.725320101 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.725373030 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.751466990 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.751538038 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.809027910 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.809135914 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.809447050 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.809501886 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.809840918 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.809896946 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.812576056 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.812644958 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.813083887 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.813116074 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.813138962 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.813149929 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.813162088 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.813189030 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.815933943 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.816003084 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.816009045 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.816050053 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.816076040 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.816101074 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.816178083 CEST	49742	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.816194057 CEST	443	49742	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.818819046 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.818866968 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.818942070 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.819139004 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:29.819149017 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:29.910435915 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:29.910533905 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.913482904 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.913491964 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:29.913891077 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:29.955606937 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:29.985692978 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.031395912 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181025028 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181057930 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181067944 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181085110 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181119919 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181158066 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.181171894 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181216955 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.181771994 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181834936 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.181843996 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181858063 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.181886911 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.191957951 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.191977024 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.191989899 CEST	49744	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:30:30.191996098 CEST	443	49744	20.12.23.50	192.168.2.17
Oct 7, 2024 23:30:30.471118927 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.471525908 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.471560001 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.472656012 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.473131895 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.473330975 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.473345995 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.514626980 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.514645100 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.813642979 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.813682079 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.813790083 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.813836098 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.813931942 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.816497087 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.816572905 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.816601038 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.816657066 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.916877031 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.916963100 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.917013884 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.917083025 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.917373896 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.917426109 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.920294046 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.920353889 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.920663118 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.920725107 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.921535015 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.921605110 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:30.948154926 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:30.948234081 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.017489910 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.017570019 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.020514011 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.020581961 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.020615101 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.020663023 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.020880938 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.020932913 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.023756981 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.023824930 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.023849010 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.023900986 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.028656960 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.028714895 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.028758049 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.028800964 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.028810024 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.028914928 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.028960943 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.029023886 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.029046059 CEST	443	49745	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:31.029057026 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:31.029088020 CEST	49745	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:35.793077946 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:35.793159962 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:35.793234110 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:35.889467955 CEST	49730	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:30:35.889527082 CEST	443	49730	142.250.181.228	192.168.2.17
Oct 7, 2024 23:30:37.199064016 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:37.502818108 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:38.110681057 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:39.323673010 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:39.358330965 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:39.358367920 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:39.358457088 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:39.359344006 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:39.359359026 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:39.981271982 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:39.981353998 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:39.983205080 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:39.983215094 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:39.983635902 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.026565075 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.071396112 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.231046915 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.231179953 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.231242895 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.231242895 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.231285095 CEST	49752	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.231304884 CEST	443	49752	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.270296097 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.270394087 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.270478010 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.270776987 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.270812035 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.892515898 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.892616987 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.893704891 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.893734932 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.893980026 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:40.895029068 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:40.939414978 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:41.350076914 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:41.378014088 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:41.378098011 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:41.378820896 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:41.378906965 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:41.378906965 CEST	49753	443	192.168.2.17	184.28.90.27
Oct 7, 2024 23:30:41.378952026 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:41.378966093 CEST	443	49753	184.28.90.27	192.168.2.17
Oct 7, 2024 23:30:41.652693987 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:41.732788086 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:42.259713888 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:43.474737883 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:45.890397072 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:46.542879105 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:49.801033974 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:30:50.103773117 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:30:50.692856073 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:30:50.708834887 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:30:51.921863079 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:30:54.335874081 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:30:55.318101883 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.318190098 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.318300009 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.318506956 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.318545103 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.991580963 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.992003918 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.992043018 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.992546082 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.993371964 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.993419886 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:55.993432045 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:55.993478060 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:56.044923067 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:56.155967951 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 7, 2024 23:30:56.528275013 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:56.528470039 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:56.528533936 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:56.528887033 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:56.528919935 CEST	443	49754	185.155.186.18	192.168.2.17
Oct 7, 2024 23:30:56.528944016 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:56.528969049 CEST	49754	443	192.168.2.17	185.155.186.18
Oct 7, 2024 23:30:59.143840075 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:31:00.295294046 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 7, 2024 23:31:00.339298010 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.344105959 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.429670095 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.429790020 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.432409048 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.432478905 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.432673931 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.432722092 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.437367916 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.437376976 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.437819004 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.438009024 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.438020945 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.520351887 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.520456076 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.520548105 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:00.525409937 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.608483076 CEST	443	49697	204.79.197.200	192.168.2.17
Oct 7, 2024 23:31:00.608614922 CEST	49697	443	192.168.2.17	204.79.197.200
Oct 7, 2024 23:31:01.064888954 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:01.064934969 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:01.065020084 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:01.065305948 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:01.065325975 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:01.199008942 CEST	49696	80	192.168.2.17	199.232.210.172
Oct 7, 2024 23:31:01.199084997 CEST	49699	80	192.168.2.17	199.232.210.172
Oct 7, 2024 23:31:01.204212904 CEST	80	49696	199.232.210.172	192.168.2.17
Oct 7, 2024 23:31:01.204277039 CEST	49696	80	192.168.2.17	199.232.210.172
Oct 7, 2024 23:31:01.205130100 CEST	80	49699	199.232.210.172	192.168.2.17
Oct 7, 2024 23:31:01.205180883 CEST	49699	80	192.168.2.17	199.232.210.172
Oct 7, 2024 23:31:02.069371939 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.069458008 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.080079079 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.080110073 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.080665112 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.081269979 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.081336021 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.081410885 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.115839005 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.115884066 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:02.116034031 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.257443905 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.257472038 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:02.427356005 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427396059 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427428007 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427459002 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.427489042 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427522898 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.427575111 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427634001 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.427830935 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.427830935 CEST	49755	443	192.168.2.17	40.126.32.68
Oct 7, 2024 23:31:02.427850962 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.427870989 CEST	443	49755	40.126.32.68	192.168.2.17
Oct 7, 2024 23:31:02.476994038 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:02.477032900 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:02.477114916 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:02.478939056 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:02.478955984 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:02.800466061 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:02.800551891 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.803246021 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.803256989 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:02.803533077 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:02.853815079 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.884591103 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:02.927405119 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:03.848644972 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:03.848731995 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:03.893992901 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:03.894018888 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:03.895016909 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:03.895107985 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:03.899077892 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:03.899131060 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:03.929600000 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:03.929788113 CEST	443	49756	13.107.5.88	192.168.2.17
Oct 7, 2024 23:31:03.929863930 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:03.933177948 CEST	49756	443	192.168.2.17	13.107.5.88
Oct 7, 2024 23:31:04.143548965 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.143660069 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.143678904 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.143692970 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.143711090 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.143739939 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.144005060 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.144088030 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.144104004 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.144220114 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.145909071 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.145927906 CEST	443	49757	2.23.209.179	192.168.2.17
Oct 7, 2024 23:31:04.145940065 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:04.145987988 CEST	49757	443	192.168.2.17	2.23.209.179
Oct 7, 2024 23:31:05.603818893 CEST	49714	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:05.603842020 CEST	49715	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:05.608844995 CEST	80	49714	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:05.608865023 CEST	80	49715	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:06.670073032 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:06.670109034 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:06.670209885 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:06.670499086 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:06.670511007 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.248183966 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.249856949 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.249856949 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.249882936 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.250368118 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.251539946 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.299407005 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.444854021 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.444883108 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.444932938 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.445071936 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.445072889 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.445097923 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.445152044 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.445606947 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.445660114 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.445684910 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.445691109 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.445719004 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.446258068 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.446307898 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.447729111 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.447741985 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:07.447751999 CEST	49758	443	192.168.2.17	20.12.23.50
Oct 7, 2024 23:31:07.447757006 CEST	443	49758	20.12.23.50	192.168.2.17
Oct 7, 2024 23:31:08.745898008 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 7, 2024 23:31:21.011818886 CEST	80	49714	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:21.011934042 CEST	49714	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:21.029045105 CEST	80	49715	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:21.029118061 CEST	49715	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:21.894623041 CEST	49714	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:21.894668102 CEST	49715	80	192.168.2.17	15.197.225.128
Oct 7, 2024 23:31:21.899617910 CEST	80	49714	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:21.899635077 CEST	80	49715	15.197.225.128	192.168.2.17
Oct 7, 2024 23:31:24.525152922 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:24.525196075 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:24.525293112 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:24.525520086 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:24.525536060 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:25.169540882 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:25.169995070 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:25.170025110 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:25.170689106 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:25.171083927 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:25.171180010 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:25.223984957 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:35.074333906 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:35.074404955 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:31:35.074557066 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:35.891707897 CEST	49760	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:31:35.891737938 CEST	443	49760	142.250.181.228	192.168.2.17
Oct 7, 2024 23:32:24.584510088 CEST	49762	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:32:24.584556103 CEST	443	49762	142.250.181.228	192.168.2.17
Oct 7, 2024 23:32:24.584800959 CEST	49762	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:32:24.585037947 CEST	49762	443	192.168.2.17	142.250.181.228
Oct 7, 2024 23:32:24.585067034 CEST	443	49762	142.250.181.228	192.168.2.17
Oct 7, 2024 23:32:25.183670044 CEST	443	49762	142.250.181.228	192.168.2.17
Oct 7, 2024 23:32:25.238346100 CEST	49762	443	192.168.2.17	142.250.181.228

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 23:30:19.680632114 CEST	53	59124	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:19.729393005 CEST	53	60939	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:20.573714972 CEST	52183	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:20.573847055 CEST	56339	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:20.580879927 CEST	60549	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:20.581037045 CEST	52486	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:20.584086895 CEST	53	56339	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:20.585030079 CEST	53	52183	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:20.657991886 CEST	53	55180	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:20.738208055 CEST	53	60549	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:20.759254932 CEST	53	52486	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:22.241810083 CEST	50297	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:22.241975069 CEST	54095	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:22.253350973 CEST	53	50297	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:22.254590988 CEST	53	54095	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:23.415570974 CEST	62375	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:23.415714025 CEST	62609	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:23.421101093 CEST	53	57600	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:23.422561884 CEST	53	62375	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:23.422909021 CEST	53	62609	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:24.468832016 CEST	56224	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:24.469003916 CEST	55586	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:25.265944004 CEST	53	55586	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:25.265974045 CEST	53	56224	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:25.288511992 CEST	63695	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:25.288511992 CEST	61409	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:25.301170111 CEST	53	63695	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:25.303128004 CEST	53	61409	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:26.335983992 CEST	63357	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:26.336155891 CEST	49446	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:26.343188047 CEST	53	63357	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:26.343401909 CEST	53	49446	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:27.422312975 CEST	62880	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:27.422463894 CEST	50511	53	192.168.2.17	1.1.1.1
Oct 7, 2024 23:30:27.429533005 CEST	53	62880	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:27.429966927 CEST	53	50511	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:37.622317076 CEST	53	51855	1.1.1.1	192.168.2.17
Oct 7, 2024 23:30:56.529665947 CEST	53	65287	1.1.1.1	192.168.2.17
Oct 7, 2024 23:31:19.122896910 CEST	53	53608	1.1.1.1	192.168.2.17
Oct 7, 2024 23:31:19.602660894 CEST	53	62294	1.1.1.1	192.168.2.17
Oct 7, 2024 23:31:38.579369068 CEST	138	138	192.168.2.17	192.168.2.255
Oct 7, 2024 23:31:48.146428108 CEST	53	52703	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 23:30:20.573714972 CEST	192.168.2.17	1.1.1.1	0x7958	Standard query (0)	addicted.live	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:20.573847055 CEST	192.168.2.17	1.1.1.1	0x205e	Standard query (0)	addicted.live	65	IN (0x0001)	false
Oct 7, 2024 23:30:20.580879927 CEST	192.168.2.17	1.1.1.1	0x1efa	Standard query (0)	addicted.live	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:20.581037045 CEST	192.168.2.17	1.1.1.1	0x2d29	Standard query (0)	addicted.live	65	IN (0x0001)	false
Oct 7, 2024 23:30:22.241810083 CEST	192.168.2.17	1.1.1.1	0xcd05	Standard query (0)	flirtfantasy.one	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:22.241975069 CEST	192.168.2.17	1.1.1.1	0xadcc	Standard query (0)	flirtfantasy.one	65	IN (0x0001)	false
Oct 7, 2024 23:30:23.415570974 CEST	192.168.2.17	1.1.1.1	0xb8dd	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:23.415714025 CEST	192.168.2.17	1.1.1.1	0x4a0f	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Oct 7, 2024 23:30:24.468832016 CEST	192.168.2.17	1.1.1.1	0x911e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:24.469003916 CEST	192.168.2.17	1.1.1.1	0xe34c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 23:30:25.288511992 CEST	192.168.2.17	1.1.1.1	0x99a1	Standard query (0)	flirtfantasy.one	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:25.288511992 CEST	192.168.2.17	1.1.1.1	0x27ee	Standard query (0)	flirtfantasy.one	65	IN (0x0001)	false
Oct 7, 2024 23:30:26.335983992 CEST	192.168.2.17	1.1.1.1	0xd9bc	Standard query (0)	bigdatajsext.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:26.336155891 CEST	192.168.2.17	1.1.1.1	0xdfa5	Standard query (0)	bigdatajsext.com	65	IN (0x0001)	false
Oct 7, 2024 23:30:27.422312975 CEST	192.168.2.17	1.1.1.1	0xfa28	Standard query (0)	bigdatajsext.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:27.422463894 CEST	192.168.2.17	1.1.1.1	0x5f5f	Standard query (0)	bigdatajsext.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 23:30:20.585030079 CEST	1.1.1.1	192.168.2.17	0x7958	No error (0)	addicted.live	15.197.225.128	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:20.585030079 CEST	1.1.1.1	192.168.2.17	0x7958	No error (0)	addicted.live	3.33.251.168	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:20.738208055 CEST	1.1.1.1	192.168.2.17	0x1efa	No error (0)	addicted.live	15.197.225.128	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:20.738208055 CEST	1.1.1.1	192.168.2.17	0x1efa	No error (0)	addicted.live	3.33.251.168	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:22.253350973 CEST	1.1.1.1	192.168.2.17	0xcd05	No error (0)	flirtfantasy.one	185.155.186.18	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:23.422561884 CEST	1.1.1.1	192.168.2.17	0xb8dd	No error (0)	maxcdn.bootstrapcdn.com	104.18.10.207	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:23.422561884 CEST	1.1.1.1	192.168.2.17	0xb8dd	No error (0)	maxcdn.bootstrapcdn.com	104.18.11.207	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:23.422909021 CEST	1.1.1.1	192.168.2.17	0x4a0f	No error (0)	maxcdn.bootstrapcdn.com		65	IN (0x0001)	false
Oct 7, 2024 23:30:25.265944004 CEST	1.1.1.1	192.168.2.17	0xe34c	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 7, 2024 23:30:25.265974045 CEST	1.1.1.1	192.168.2.17	0x911e	No error (0)	www.google.com	142.250.181.228	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:25.301170111 CEST	1.1.1.1	192.168.2.17	0x99a1	No error (0)	flirtfantasy.one	185.155.186.18	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:26.343188047 CEST	1.1.1.1	192.168.2.17	0xd9bc	No error (0)	bigdatajsext.com	136.243.216.252	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:27.429533005 CEST	1.1.1.1	192.168.2.17	0xfa28	No error (0)	bigdatajsext.com	136.243.216.252	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

addicted.live

flirtfantasy.one

https:

maxcdn.bootstrapcdn.com

bigdatajsext.com

slscr.update.microsoft.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49714	15.197.225.128	80	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 23:31:05.603818893 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49715	15.197.225.128	80	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 23:31:05.603842020 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49716	15.197.225.128	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:22 UTC	656	OUT	GET / HTTP/1.1 Host: addicted.live Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 21:30:22 UTC	321	IN	HTTP/1.1 301 Moved Permanently Content-Length: 84 Content-Type: text/html; charset=utf-8 Date: Mon, 07 Oct 2024 21:30:22 GMT Location: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Server: ip-10-123-124-28.ec2.internal Vary: Accept-Encoding X-Request-Id: ad8bb1f0-7b65-4de2-a5f1-1dea4781c82e Connection: close
2024-10-07 21:30:22 UTC	84	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6c 69 72 74 66 61 6e 74 61 73 79 2e 6f 6e 65 2f 3f 75 3d 79 30 39 38 72 6b 31 26 61 6d 70 3b 6f 3d 32 6e 30 6b 6d 62 71 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq">Moved Permanently</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49718	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:23 UTC	679	OUT	GET /?u=y098rk1&o=2n0kmbq HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 21:30:23 UTC	247	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:23 GMT Content-Type: text/html Content-Length: 4282 Connection: close cache-control: private set-cookie: sid=t1~h3kot5fviqggcvkjcizogbcq; path=/ Cache-Control: no-transform
2024-10-07 21:30:23 UTC	3849	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 72 65 71 75 65 73 74 4c 69 6e 6b 28 29 7b 72 65 74 75 72 6e 20 7b 73 65 73 73 69 6f 6e 49 64 3a 5b 27 73 69 64 27 2c 27 74 31 7e 68 33 6b 6f 74 35 66 76 69 71 67 67 63 76 6b 6a 63 69 7a 6f 67 62 63 71 27 5d 7d 3b 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 3c 74 69 74 6c 65 20 69 64 3d 22 74 69 74 6c 65 22 3e 43 6f 6e 66 69 64 65 6e 74 69 61 6c 20 64 61 74 69 6e 67 20 69 6e 20 79 6f 75 72 20 61 72 65 61 3f 3c 2f 74 69 74 6c 65 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 Data Ascii: <!DOCTYPE html><html lang="en"><head><script>function requestLink(){return {sessionId:['sid','t1~h3kot5fviqggcvkjcizogbcq']};}</script><meta charset="UTF-8"><title id="title">Confidential dating in your area?</title><meta name="viewport"
2024-10-07 21:30:23 UTC	48	IN	Data Raw: 61 73 73 3d 22 63 6c 6f 63 6b 22 3e 30 31 3a 30 30 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 0d Data Ascii: ass="clock">01:00</div></div></footer>
2024-10-07 21:30:23 UTC	385	IN	Data Raw: 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 63 65 6e 74 61 67 65 5f 77 72 61 70 70 65 72 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 63 65 6e 74 61 67 65 5f 64 6f 6e 65 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 63 65 6e 74 61 67 65 5f 74 65 78 74 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 64 61 74 69 6e 67 2f 73 74 72 69 70 74 65 61 73 65 32 2f 6a 73 2f 6a 71 75 65 72 79 2d 33 2e 31 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 64 61 74 69 6e 67 2f 73 74 72 69 70 74 65 61 73 65 32 2f 6a 73 2f 6d 61 69 6e 5f 63 61 Data Ascii: <div class="percentage_wrapper"><div class="percentage_done"><div class="percentage_text"></div></div></div><script src="/media/dating/striptease2/js/jquery-3.1.1.min.js"></script><script src="/media/dating/striptease2/js/main_ca

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49726	104.18.10.207	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:23 UTC	580	OUT	GET /font-awesome/4.5.0/css/font-awesome.min.css HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://flirtfantasy.one/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 21:30:23 UTC	925	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 21:30:23 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"4fbd15cb6047af93373f4f895639c8bf" Last-Modified: Mon, 25 Jan 2021 22:04:54 GMT CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 03/18/2024 12:10:08 CDN-EdgeStorageId: 1029 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 08e05320f24d8e808a4ef38c6a818369 CDN-Cache: HIT CF-Cache-Status: HIT Age: 304868 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8cf0fdfb8fd84310-EWR
2024-10-07 21:30:23 UTC	444	IN	Data Raw: 36 62 34 61 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 35 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 65 6f 74 3f 76 3d 34 2e 35 Data Ascii: 6b4a/! Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 35 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 35 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 35 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 74 28 27 73 76 67 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 66 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 3a 6e 6f 72 6d 61 6c 20 Data Ascii: nt.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 73 70 69 6e 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 39 30 7b 66 69 6c 74 65 72 3a 70 Data Ascii: 0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{filter:p
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 66 61 2d 73 74 61 63 6b 2d 31 78 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 2e 66 61 2d 73 74 61 63 6b 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 69 6e 76 65 72 73 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 66 61 2d 67 6c 61 73 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 30 22 7d 2e 66 61 2d 6d 75 73 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 31 22 7d 2e 66 61 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 32 22 7d 2e 66 61 2d 65 6e 76 65 6c 6f 70 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 33 22 7d 2e 66 61 2d 68 65 61 72 74 3a 62 65 66 6f 72 65 Data Ascii: text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\f003"}.fa-heart:before
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 65 61 64 70 68 6f 6e 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 35 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 36 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 37 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 38 22 7d 2e 66 61 2d 71 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 39 22 7d 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 61 22 7d 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 62 22 7d 2e 66 61 2d 74 61 67 73 Data Ascii: eadphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{content:"\f02b"}.fa-tags
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 30 34 39 22 7d 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 61 22 7d 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 62 22 7d 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 63 22 7d 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 64 22 7d 2e 66 61 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 65 22 7d 2e 66 61 2d 66 61 73 74 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 35 30 22 7d 2e 66 61 2d 73 74 65 70 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 35 31 22 7d 2e 66 Data Ascii: 049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:before{content:"\f051"}.f
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 31 22 7d 2e 66 61 2d 70 6c 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 32 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 33 22 7d 2e 66 61 2d 72 61 6e 64 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 34 22 7d 2e 66 61 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 35 22 7d 2e 66 61 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 36 22 7d 2e 66 61 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 Data Ascii: .fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-up:before{content:"\f07
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 3a 22 5c 66 30 39 36 22 7d 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 37 22 7d 2e 66 61 2d 70 68 6f 6e 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 38 22 7d 2e 66 61 2d 74 77 69 74 74 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 39 22 7d 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 2d 66 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 61 22 7d 2e 66 61 2d 67 69 74 68 75 62 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 62 22 7d 2e 66 61 2d 75 6e 6c 6f 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 63 22 7d 2e 66 61 2d 63 72 65 Data Ascii: :"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{content:"\f09c"}.fa-cre
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 63 37 22 7d 2e 66 61 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 38 22 7d 2e 66 61 2d 6e 61 76 69 63 6f 6e 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 72 65 6f 72 64 65 72 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 62 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 39 22 7d 2e 66 61 2d 6c 69 73 74 2d 75 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 61 22 7d 2e 66 61 2d 6c 69 73 74 2d 6f 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 62 22 7d 2e 66 61 2d 73 74 72 69 6b 65 74 68 72 6f 75 67 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 63 22 7d 2e 66 61 2d 75 6e 64 65 72 6c 69 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 64 22 Data Ascii: c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:before{content:"\f0cd"
2024-10-07 21:30:23 UTC	1369	IN	Data Raw: 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 61 22 7d 2e 66 61 2d 6c 69 67 68 74 62 75 6c 62 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 62 22 7d 2e 66 61 2d 65 78 63 68 61 6e 67 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 63 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 64 6f 77 6e 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 64 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 75 70 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 65 22 7d 2e 66 61 2d 75 73 65 72 2d 6d 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 30 22 7d 2e 66 61 2d 73 74 65 74 68 6f 73 63 6f 70 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 31 22 7d 2e 66 61 Data Ascii: fore{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:before{content:"\f0f1"}.fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49724	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	624	OUT	GET /util/flag-icon/css/flag-icon.css HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	866	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:24 GMT Content-Type: text/css Content-Length: 40627 Connection: close ETag: "0a47b937981e7389e3ebe63e4a503066" Last-Modified: Wed, 20 Sep 2023 15:26:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC4900AB51F755 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1693134513#296037122/gid:0/gname:root/mode:33188/mtime:1655386274#684017000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-06-16T13:31:14.684017Z Expires: Tue, 07 Oct 2025 21:30:24 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	3230	IN	Data Raw: 2f 2a 20 67 65 6f 20 6c 6f 63 61 74 69 6f 6e 20 63 73 73 20 2a 2f 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 2c 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 46 6c 61 67 2c 0d 0a 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 65 6d 3b 0d 0a 7d 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 20 2e 66 6c 61 67 2d 69 63 6f 6e 2c 0d 0a 23 75 73 65 72 4c 6f 63 61 74 69 6f 6e 46 6c 61 67 20 2e 66 6c 61 67 2d 69 63 6f 6e 2c 0d 0a 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 20 2e 66 6c 61 67 2d 69 63 6f 6e 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 20 Data Ascii: /* geo location css */#userLocation,#userLocationFlag,.userLocation{ display: inline; position: relative; line-height: 1em;}#userLocation .flag-icon,#userLocationFlag .flag-icon,.userLocation .flag-icon{ display: inline-block;
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 61 75 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 61 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 61 77 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 61 77 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 61 77 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 61 78 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 61 78 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 Data Ascii: : url(../flags/1x1/au.svg);}.flag-icon-aw { background-image: url(../flags/4x3/aw.svg);}.flag-icon-aw.flag-icon-squared { background-image: url(../flags/1x1/aw.svg);}.flag-icon-ax { background-image: url(../flags/4x3/ax.svg);}.fla
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 63 64 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 66 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 63 66 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 66 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 63 66 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 63 67 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 63 67 2e 73 76 67 29 3b 0d Data Ascii: nd-image: url(../flags/1x1/cd.svg);}.flag-icon-cf { background-image: url(../flags/4x3/cf.svg);}.flag-icon-cf.flag-icon-squared { background-image: url(../flags/1x1/cf.svg);}.flag-icon-cg { background-image: url(../flags/4x3/cg.svg);
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 61 67 2d 69 63 6f 6e 2d 65 72 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 65 72 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 65 72 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 65 72 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 65 73 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 65 73 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 65 73 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 Data Ascii: ag-icon-er { background-image: url(../flags/4x3/er.svg);}.flag-icon-er.flag-icon-squared { background-image: url(../flags/1x1/er.svg);}.flag-icon-es { background-image: url(../flags/4x3/es.svg);}.flag-icon-es.flag-icon-squared { ba
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 67 73 2f 34 78 33 2f 67 75 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 67 75 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 67 75 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 67 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 67 77 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 67 77 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 67 77 2e 73 76 67 29 3b 0d 0a 7d Data Ascii: gs/4x3/gu.svg);}.flag-icon-gu.flag-icon-squared { background-image: url(../flags/1x1/gu.svg);}.flag-icon-gw { background-image: url(../flags/4x3/gw.svg);}.flag-icon-gw.flag-icon-squared { background-image: url(../flags/1x1/gw.svg);}
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6b 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6b 6d 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 6b 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6b 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6b 6e 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6b 6e 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 6b 6e 2e Data Ascii: l(../flags/4x3/km.svg);}.flag-icon-km.flag-icon-squared { background-image: url(../flags/1x1/km.svg);}.flag-icon-kn { background-image: url(../flags/4x3/kn.svg);}.flag-icon-kn.flag-icon-squared { background-image: url(../flags/1x1/kn.
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6d 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 6d 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 6d 6d 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 6e 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 6d 6e 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 6d 6e 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 Data Ascii: mage: url(../flags/4x3/mm.svg);}.flag-icon-mm.flag-icon-squared { background-image: url(../flags/1x1/mm.svg);}.flag-icon-mn { background-image: url(../flags/4x3/mn.svg);}.flag-icon-mn.flag-icon-squared { background-image: url(../flags
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 70 61 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 61 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 70 61 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 65 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 70 65 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 70 65 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 Data Ascii: ground-image: url(../flags/4x3/pa.svg);}.flag-icon-pa.flag-icon-squared { background-image: url(../flags/1x1/pa.svg);}.flag-icon-pe { background-image: url(../flags/4x3/pe.svg);}.flag-icon-pe.flag-icon-squared { background-image: url(
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 73 69 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 69 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 73 69 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 6a 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 73 6a 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 6a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 Data Ascii: background-image: url(../flags/4x3/si.svg);}.flag-icon-si.flag-icon-squared { background-image: url(../flags/1x1/si.svg);}.flag-icon-sj { background-image: url(../flags/4x3/sj.svg);}.flag-icon-sj.flag-icon-squared { background-ima
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 63 6f 6e 2d 74 76 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 74 76 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 74 76 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 31 78 31 2f 74 76 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 74 77 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 2e 2e 2f 66 6c 61 67 73 2f 34 78 33 2f 74 77 2e 73 76 67 29 3b 0d 0a 7d 0d 0a 2e 66 6c 61 67 2d 69 63 6f 6e 2d 74 77 2e 66 6c 61 67 2d 69 63 6f 6e 2d 73 71 75 61 72 65 64 20 7b 0d 0a 20 20 62 61 63 6b 67 72 Data Ascii: con-tv { background-image: url(../flags/4x3/tv.svg);}.flag-icon-tv.flag-icon-squared { background-image: url(../flags/1x1/tv.svg);}.flag-icon-tw { background-image: url(../flags/4x3/tw.svg);}.flag-icon-tw.flag-icon-squared { backgr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49720	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	630	OUT	GET /media/dating/striptease2/css/style.css HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	867	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:25 GMT Content-Type: text/css Content-Length: 35646 Connection: close ETag: "81af0f0103508ab2699a60003fe4e8a5" Last-Modified: Thu, 01 Aug 2024 07:19:46 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 354f9eb41c4f44111da43ee93430d467ccc8f740dac6a89f93d2690a13b4c5b4 X-Amz-Request-Id: 17FC4900B27131D2 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 365 X-Ratelimit-Remaining: 365 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014410#308176934/gid:0/gname:root/mode:33279/mtime:1702499569#684339647/uid:0/uname:root x-amz-meta-mm-source-mtime: 2023-12-13T20:32:49.684339647Z Expires: Tue, 07 Oct 2025 21:30:25 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	3229	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 4e 65 75 65 3b 0d 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2e 65 6f 74 27 29 3b 0d 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2e 65 6f 74 23 69 65 66 69 78 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2e 77 6f 66 66 27 29 20 66 6f 72 Data Ascii: @font-face { font-family: HelveticaNeue; src: url('../fonts/HelveticaNeue.eot'); src: url('../fonts/HelveticaNeue.eot#iefix') format('embedded-opentype'), url('../fonts/HelveticaNeue.woff2') format('woff2'), url('../fonts/HelveticaNeue.woff') for
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 74 3a 20 30 3b 0d 0a 7d 0d 0a 68 31 2c 0d 0a 68 32 2c 0d 0a 68 33 2c 0d 0a 68 34 2c 0d 0a 68 35 2c 0d 0a 68 36 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 2e 37 35 65 6d 3b 0d 0a 7d 0d 0a 68 31 20 7b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 38 76 77 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0d 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0d 0a 7d 0d 0a 68 32 20 7b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 37 35 65 6d 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 7d 0d 0a 68 33 20 7b 0d 0a 20 20 Data Ascii: t: 0;}h1,h2,h3,h4,h5,h6 { margin-bottom: .75em;}h1 { font-size: 2.8vw; line-height: 1.1em; margin-bottom: 0; margin: auto;}h2 { font-size: 1.75em; line-height: 1; margin: 5px; font-weight: 400;}h3 {
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 20 6d 61 78 2d 77 69 64 74 68 3a 20 35 32 30 70 78 3b 0d 0a 20 20 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 7d 0d 0a 2e 62 75 62 62 6c 65 2e 73 6d 61 6c 6c 20 7b 0d 0a 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 33 32 35 70 78 3b 0d 0a 20 20 6c 65 66 74 3a 20 35 30 70 78 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 20 30 20 30 3b 0d 0a 20 20 74 6f 70 3a 20 2d 31 30 70 78 3b 0d 0a 7d 0d 0a 2e 62 75 62 62 6c 65 2e 6c 65 66 74 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0d 0a 7d 0d 0a 2e 62 75 62 62 6c 65 2e 72 69 67 68 74 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 7d 0d 0a 2e 62 75 62 62 6c 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 Data Ascii: max-width: 520px; width: auto;}.bubble.small { max-width: 325px; left: 50px; margin: 5px 0 0; top: -10px;}.bubble.left { margin-left: 0;}.bubble.right { margin-right: 0;}.bubble:before { content: ""; position: a
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 33 31 33 65 6d 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 7d 0d 0a 2e 70 72 65 66 65 72 65 64 67 65 6e 64 65 72 20 3e 20 64 69 76 2c 0d 0a 2e 69 73 67 65 6e 64 65 72 20 3e 20 64 69 76 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 7d 0d 0a 2e 70 72 65 66 65 72 65 64 67 65 6e 64 65 72 20 3e 20 64 69 76 20 3e 20 64 69 76 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 20 7b 0d 0a 20 20 6f 72 64 65 72 3a 20 31 3b 0d 0a 7d 0d 0a 2e 69 73 67 65 6e 64 65 72 20 3e 20 64 69 76 20 3e 20 64 69 76 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 20 7b 0d 0a 20 20 6f 72 64 65 72 3a 20 31 3b 0d 0a 7d 0d 0a 2e 66 61 2c 0d 0a 2e 66 61 62 2c 0d 0a Data Ascii: font-size: 1.313em; background-color: transparent;}.preferedgender > div,.isgender > div { display: flex;}.preferedgender > div > div:first-of-type { order: 1;}.isgender > div > div:first-of-type { order: 1;}.fa,.fab,
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 61 74 65 59 28 32 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 0d 0a 20 20 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 0d 0a 20 20 7d 0d 0a 7d 0d 0a 2e 66 61 64 65 49 6e 55 70 20 7b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 55 70 3b 0d 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 55 70 3b 0d 0a 7d 0d 0a 2f 2a 20 53 77 61 70 20 2a 2f 0d 0a 2e 73 77 Data Ascii: ateY(20px); } 100% { opacity: 1; -webkit-transform: translateY(0); -ms-transform: translateY(0); transform: translateY(0); }}.fadeInUp { -webkit-animation-name: fadeInUp; animation-name: fadeInUp;}/* Swap */.sw
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 2f 69 6d 61 67 65 73 2f 32 30 31 38 5f 31 35 5f 31 30 35 5f 62 61 63 6b 67 72 6f 75 6e 64 6d 6f 62 69 6c 65 36 2e 6a 70 67 22 29 3b 0d 0a 20 20 7d 0d 0a 20 20 2e 70 65 72 63 65 6e 74 61 67 65 5f 77 72 61 70 70 65 72 20 7b 0d 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 2d 35 70 78 20 33 35 70 78 20 2d 35 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 36 34 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 62 6f 64 79 2e 63 61 73 75 61 6c 5f 32 20 2e 62 67 31 20 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 2e 2e 2f 69 6d 61 67 65 73 2f 63 61 73 75 61 6c 5f 32 2f 6d 31 2e 6a 70 67 22 29 3b 0d 0a 09 7d 0d 0a 09 62 6f 64 79 2e 63 61 73 75 61 6c 5f 32 20 2e 62 67 32 20 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e Data Ascii: /images/2018_15_105_backgroundmobile6.jpg"); } .percentage_wrapper { box-shadow: 0 -5px 35px -5px rgba(0, 0, 0, 0.64); } body.casual_2 .bg1 {background-image: url("../images/casual_2/m1.jpg");}body.casual_2 .bg2 {backgroun
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 69 6e 74 65 72 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 20 33 30 70 78 3b 0d 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 30 70 78 20 31 30 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 35 34 70 78 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 35 32 70 78 3b 0d 0a 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 30 70 78 3b 0d 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 34 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 36 29 3b 0d 0a 20 20 74 72 61 6e 73 69 74 Data Ascii: inter; color: #fff; font-weight: 400; padding: 0 30px; text-decoration: none; margin: 0 10px 10px; font-size: 24px; height: 54px; line-height: 52px; min-width: 120px; box-shadow: 0 0 0 4px rgba(255, 255, 255, 0.6); transit
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 7b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 7d 0d 0a 2e 73 74 79 6c 65 2d 79 65 6c 6c 6f 77 2e 66 6f 6e 74 32 20 7b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 41 76 65 6e 69 72 4e 65 78 74 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 7d 0d 0a 2e 73 74 79 6c 65 2d 79 65 6c 6c 6f 77 2e 62 75 74 74 6f 6e 73 2d 68 6f 76 65 72 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 39 39 33 36 66 66 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 39 39 33 36 66 66 3b 0d 0a 7d 0d 0a 2e 73 74 79 6c 65 2d 79 65 6c 6c 6f 77 2e 62 75 74 74 6f 6e 73 2d 68 6f 76 65 72 20 2e 62 74 6e 2d 73 65 63 6f Data Ascii: { border-color: #fff transparent;}.style-yellow.font2 { font-family: 'AvenirNext', sans-serif;}.style-yellow.buttons-hover .btn-primary:hover { background-color: #9936ff; border-color: #9936ff;}.style-yellow.buttons-hover .btn-seco
2024-10-07 21:30:25 UTC	3745	IN	Data Raw: 6c 65 2d 6e 65 78 74 64 6f 6f 72 32 20 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 2c 0d 0a 2e 73 74 79 6c 65 2d 6e 65 78 74 64 6f 6f 72 32 20 2e 70 72 65 66 65 72 65 64 67 65 6e 64 65 72 20 3e 20 64 69 76 20 3e 20 64 69 76 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 32 29 2c 0d 0a 2e 73 74 79 6c 65 2d 6e 65 78 74 64 6f 6f 72 32 20 2e 69 73 67 65 6e 64 65 72 20 3e 20 64 69 76 20 3e 20 64 69 76 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 32 29 20 7b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 38 30 2c 20 31 38 30 2c 20 31 38 30 2c 20 30 2e 36 34 29 3b 0d 0a 7d 0d 0a 2e 73 74 79 6c 65 2d 6e 65 78 74 64 6f 6f 72 32 20 2e 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 0d 0a 2e 73 74 79 6c 65 2d 6e 65 78 74 64 6f 6f 72 32 20 2e 73 6c 69 64 Data Ascii: le-nextdoor2 .btn-secondary,.style-nextdoor2 .preferedgender > div > div:nth-of-type(2),.style-nextdoor2 .isgender > div > div:nth-of-type(2) { background-color: rgba(180, 180, 180, 0.64);}.style-nextdoor2 .button:hover,.style-nextdoor2 .slid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49721	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	640	OUT	GET /media/dating/striptease2/css/style_shagslags.css HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	861	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:24 GMT Content-Type: text/css Content-Length: 2651 Connection: close ETag: "3b951ff51a1e5f75dac02c6f3a170afc" Last-Modified: Wed, 13 Dec 2023 20:32:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC4900AB93AB69 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1700569799#705568906/gid:0/gname:root/mode:33279/mtime:1702499571#52342444/uid:0/uname:root x-amz-meta-mm-source-mtime: 2023-12-13T20:32:51.283Z Expires: Tue, 07 Oct 2025 21:30:24 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	2651	IN	Data Raw: 2f 2a 20 53 74 79 6c 65 20 53 68 61 67 73 6c 61 67 73 20 2a 2f 0d 0a 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 20 34 30 30 20 31 36 70 78 20 2f 20 6e 6f 72 6d 61 6c 20 22 50 54 20 53 61 6e 73 22 2c 20 73 65 72 69 66 3b 0d 0a 7d 0d 0a 6d 61 69 6e 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 2e 39 34 29 3b 0d 0a 7d 0d 0a 68 65 61 64 65 72 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 31 35 30 2c 20 31 32 32 2c 20 32 32 30 2c 20 2e 38 29 3b 0d 0a 7d 0d 0a 68 65 61 64 65 72 20 68 31 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 7d 0d 0a 68 65 61 64 65 72 20 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 20 2e 66 6c 61 67 2d 69 63 Data Ascii: /* Style Shagslags */body { font: 400 16px / normal "PT Sans", serif;}main { background: rgba(255, 255, 255, .94);}header { background: rgba(150, 122, 220, .8);}header h1 { color: #fff;}header .userLocation .flag-ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49722	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	597	OUT	GET /cookie/js.cookie.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	879	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:24 GMT Content-Type: application/javascript Content-Length: 4264 Connection: close ETag: "a7e9883924072f15259de6888d5ef515" Last-Modified: Wed, 20 Sep 2023 15:19:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC4900AC396A0F X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1693134513#248036972/gid:0/gname:root/mode:33188/mtime:1658397637#354375000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-07-21T10:00:37.354375Z Expires: Tue, 07 Oct 2025 21:30:24 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	3217	IN	Data Raw: 2f 2a 21 0d 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 43 6f 6f 6b 69 65 20 76 32 2e 31 2e 33 0d 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 73 2d 63 6f 6f 6b 69 65 2f 6a 73 2d 63 6f 6f 6b 69 65 0d 0a 20 2a 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 35 20 4b 6c 61 75 73 20 48 61 72 74 6c 20 26 20 46 61 67 6e 65 72 20 42 72 61 63 6b 0d 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0d 0a 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 21 31 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 26 26 28 64 65 66 69 6e 65 28 65 29 2c 6e 3d 21 30 29 2c 22 Data Ascii: /! JavaScript Cookie v2.1.3 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */!function(e){var n=!1;if("function"==typeof define&&define.amd&&(define(e),n=!0),"
2024-10-07 21:30:25 UTC	1047	IN	Data Raw: 65 6d 6f 76 65 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 22 29 3b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 73 65 74 28 27 49 73 4e 6f 74 55 6e 69 71 75 65 32 27 2c 20 27 74 72 75 65 27 2c 20 7b 20 65 78 70 69 72 65 73 3a 20 65 78 44 61 79 73 20 7d 29 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 65 6c 73 65 20 69 66 20 28 43 6f 6f 6b 69 65 73 2e 67 65 74 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 32 22 29 29 7b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 72 65 6d 6f 76 65 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 32 22 29 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 65 6c 73 65 20 7b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 73 65 74 28 27 49 73 4e 6f 74 55 6e 69 71 75 65 27 2c 20 27 74 72 75 65 27 2c 20 7b 20 65 78 70 69 72 65 73 3a 20 65 78 44 61 79 73 20 7d 29 3b 0d 0a 09 09 09 7d Data Ascii: emove("IsNotUnique");Cookies.set('IsNotUnique2', 'true', { expires: exDays });}else if (Cookies.get("IsNotUnique2")){Cookies.remove("IsNotUnique2");}else {Cookies.set('IsNotUnique', 'true', { expires: exDays });}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49723	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	591	OUT	GET /util/utils.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	873	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:25 GMT Content-Type: text/javascript Content-Length: 7514 Connection: close ETag: "85a42b1d6c8769fce99fb44aefb041b0" Last-Modified: Thu, 01 Aug 2024 07:23:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c X-Amz-Request-Id: 17FC4900B307103B X-Content-Type-Options: nosniff X-Ratelimit-Limit: 374 X-Ratelimit-Remaining: 374 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720010547#640143858/gid:0/gname:root/mode:33188/mtime:1719824938#357078843/uid:0/uname:root x-amz-meta-mm-source-mtime: 2024-07-01T09:08:58.357078843Z Expires: Tue, 07 Oct 2025 21:30:25 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	3223	IN	Data Raw: 2f 2a 2a 20 64 6f 63 52 65 61 64 79 20 69 73 20 61 20 73 69 6e 67 6c 65 20 70 6c 61 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 20 74 68 61 74 20 70 72 6f 76 69 64 65 73 20 61 20 6d 65 74 68 6f 64 20 6f 66 20 73 63 68 65 64 75 6c 69 6e 67 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 73 20 74 6f 20 72 75 6e 20 61 74 20 73 6f 6d 65 20 6c 61 74 65 72 20 70 6f 69 6e 74 20 77 68 65 6e 20 74 68 65 20 44 4f 4d 20 68 61 73 20 66 69 6e 69 73 68 65 64 20 6c 6f 61 64 69 6e 67 2e 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6f Data Ascii: /** docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 20 2b 3d 20 27 3c 69 20 63 6c 61 73 73 3d 22 66 6c 61 67 2d 69 63 6f 6e 20 66 6c 61 67 2d 69 63 6f 6e 2d 27 20 2b 20 64 61 74 61 2e 63 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 2b 20 27 22 3e 3c 2f 69 3e 27 20 2b 20 73 74 72 32 3b 0d 0a 09 09 7d 0d 0a 09 7d 20 65 6c 73 65 20 7b 0d 0a 09 09 73 74 72 20 3d 20 73 74 72 32 3b 0d 0a 09 7d 0d 0a 0d 0a 09 6e 6f 64 65 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 73 74 72 3b 0d 0a 7d 0d 0a 0d 0a 76 61 72 20 67 65 6f 52 65 66 44 61 74 61 20 3d 20 74 79 70 65 6f 66 20 67 65 6f 44 61 74 61 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 3f 20 67 65 6f 44 61 74 61 20 3a 20 6e 75 6c 6c 3b 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 4c 6f 63 61 74 69 6f 6e 28 63 6f 6e 74 61 69 6e 65 72 49 64 29 20 7b 0d 0a 09 Data Ascii: += '<i class="flag-icon flag-icon-' + data.cc.toLowerCase() + '"></i>' + str2;}} else {str = str2;}node.innerHTML = str;}var geoRefData = typeof geoData !== "undefined" ? geoData : null;function showLocation(containerId) {
2024-10-07 21:30:25 UTC	195	IN	Data Raw: 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 75 6e 73 75 62 73 63 72 69 62 65 22 29 5b 30 5d 29 20 7b 0d 0a 09 09 68 69 64 65 55 6e 73 75 62 28 29 3b 0d 0a 09 7d 0d 0a 09 61 64 64 53 65 73 73 69 6f 6e 49 64 28 29 3b 0d 0a 09 73 68 6f 77 4c 6f 63 61 74 69 6f 6e 28 22 75 73 65 72 4c 6f 63 61 74 69 6f 6e 22 29 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 2f 2a 20 0d 0a 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 73 65 74 54 69 6d 65 6f 75 74 28 61 70 70 65 6e 64 50 69 78 65 6c 73 2c 20 32 30 30 30 29 3b 0d 0a 20 7d 3b 2a 2f Data Ascii: tElementsByClassName("unsubscribe")[0]) {hideUnsub();}addSessionId();showLocation("userLocation");});/* window.onload = function() { setTimeout(appendPixels, 2000); };*/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49719	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:24 UTC	625	OUT	GET /media/dating/striptease2/js/jquery-3.1.1.min.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:25 UTC	874	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:25 GMT Content-Type: text/javascript Content-Length: 87411 Connection: close ETag: "e21a794753fcdecf1e4b036860343c3c" Last-Modified: Thu, 01 Aug 2024 07:19:47 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: af968cfc53e5d4d46c2a7314ea3774fe010d1d1a8defca6495a09901b4f201c0 X-Amz-Request-Id: 17FC4900B2AF0E8A X-Content-Type-Options: nosniff X-Ratelimit-Limit: 336 X-Ratelimit-Remaining: 336 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014410#312176943/gid:0/gname:root/mode:33279/mtime:1719827312#366092907/uid:0/uname:root x-amz-meta-mm-source-mtime: 2024-07-01T09:48:32.366092907Z Expires: Tue, 07 Oct 2025 21:30:25 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:25 UTC	3222	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 33 2e 31 2e 31 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 39 2d 32 Data Ascii: /! jQuery JavaScript Library v3.1.1 * https://jquery.com/ * * Includes Sizzle.js * https://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * https://jquery.org/license * * Date: 2016-09-2
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 72 28 6e 2c 74 2c 72 2c 75 2c 66 29 7b 66 6f 72 28 76 61 72 20 65 2c 73 2c 70 2c 61 2c 77 2c 76 2c 68 3d 74 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 28 29 2c 79 3d 5b 5d 2c 6c 3d 30 2c 62 3d 6e 2e 6c 65 6e 67 74 68 3b 6c 3c 62 3b 6c 2b 2b 29 69 66 28 65 3d 6e 5b 6c 5d 2c 65 7c 7c 65 3d 3d 3d 30 29 69 66 28 69 2e 74 79 70 65 28 65 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 29 69 2e 6d 65 72 67 65 28 79 2c 65 2e 6e 6f 64 65 54 79 70 65 3f 5b 65 5d 3a 65 29 3b 65 6c 73 65 20 69 66 28 64 72 2e 74 65 73 74 28 65 29 29 7b 66 6f 72 28 73 3d 73 7c 7c 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 70 3d 28 62 72 2e 65 78 65 63 28 65 29 7c 7c 5b 22 22 2c 22 22 5d 29 5b 31 5d 2e Data Ascii: r(n,t,r,u,f){for(var e,s,p,a,w,v,h=t.createDocumentFragment(),y=[],l=0,b=n.length;l<b;l++)if(e=n[l],e\|\|e===0)if(i.type(e)==="object")i.merge(y,e.nodeType?[e]:e);else if(dr.test(e)){for(s=s\|\|h.appendChild(t.createElement("div")),p=(br.exec(e)\|\|["",""])[1].
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 74 75 72 6e 20 75 2b 61 75 28 6e 2c 74 2c 72 7c 7c 28 73 3f 22 62 6f 72 64 65 72 22 3a 22 63 6f 6e 74 65 6e 74 22 29 2c 6f 2c 65 29 2b 22 70 78 22 7d 66 75 6e 63 74 69 6f 6e 20 73 28 6e 2c 74 2c 69 2c 72 2c 75 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 73 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 28 6e 2c 74 2c 69 2c 72 2c 75 29 7d 66 75 6e 63 74 69 6f 6e 20 77 75 28 29 7b 75 74 26 26 28 6e 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 77 75 29 2c 69 2e 66 78 2e 74 69 63 6b 28 29 29 7d 66 75 6e 63 74 69 6f 6e 20 62 75 28 29 7b 72 65 74 75 72 6e 20 6e 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 74 3d 75 6e 64 65 66 69 6e 65 64 7d 29 2c 72 74 3d 69 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 74 69 28 6e Data Ascii: turn u+au(n,t,r\|\|(s?"border":"content"),o,e)+"px"}function s(n,t,i,r,u){return new s.prototype.init(n,t,i,r,u)}function wu(){ut&&(n.requestAnimationFrame(wu),i.fx.tick())}function bu(){return n.setTimeout(function(){rt=undefined}),rt=i.now()}function ti(n
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 6c 73 65 20 72 65 74 75 72 6e 20 74 2e 64 61 74 61 54 79 70 65 73 2e 75 6e 73 68 69 66 74 28 73 29 2c 65 28 73 29 2c 21 31 7d 29 2c 68 7d 76 61 72 20 66 3d 7b 7d 2c 6f 3d 6e 3d 3d 3d 76 69 3b 72 65 74 75 72 6e 20 65 28 74 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 7c 7c 21 66 5b 22 2a 22 5d 26 26 65 28 22 2a 22 29 7d 66 75 6e 63 74 69 6f 6e 20 70 69 28 6e 2c 74 29 7b 76 61 72 20 72 2c 75 2c 66 3d 69 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 66 6c 61 74 4f 70 74 69 6f 6e 73 7c 7c 7b 7d 3b 66 6f 72 28 72 20 69 6e 20 74 29 74 5b 72 5d 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 28 28 66 5b 72 5d 3f 6e 3a 75 7c 7c 28 75 3d 7b 7d 29 29 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 75 26 26 69 2e 65 78 74 65 6e 64 28 21 30 2c 6e 2c 75 29 2c 6e 7d 66 75 6e 63 Data Ascii: lse return t.dataTypes.unshift(s),e(s),!1}),h}var f={},o=n===vi;return e(t.dataTypes[0])\|\|!f[""]&&e("")}function pi(n,t){var r,u,f=i.ajaxSettings.flatOptions\|\|{};for(r in t)t[r]!==undefined&&((f[r]?n:u\|\|(u={}))[r]=t[r]);return u&&i.extend(!0,n,u),n}func
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 29 7b 72 65 74 75 72 6e 20 74 3d 3d 6e 75 6c 6c 3f 2d 31 3a 6f 74 2e 63 61 6c 6c 28 74 2c 6e 2c 69 29 7d 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 75 3d 2b 74 2e 6c 65 6e 67 74 68 2c 69 3d 30 2c 72 3d 6e 2e 6c 65 6e 67 74 68 3b 69 3c 75 3b 69 2b 2b 29 6e 5b 72 2b 2b 5d 3d 74 5b 69 5d 3b 72 65 74 75 72 6e 20 6e 2e 6c 65 6e 67 74 68 3d 72 2c 6e 7d 2c 67 72 65 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 29 7b 66 6f 72 28 76 61 72 20 75 2c 66 3d 5b 5d 2c 72 3d 30 2c 65 3d 6e 2e 6c 65 6e 67 74 68 2c 6f 3d 21 69 3b 72 3c 65 3b 72 2b 2b 29 75 3d 21 74 28 6e 5b 72 5d 2c 72 29 2c 75 21 3d 3d 6f 26 26 66 2e 70 75 73 68 28 6e 5b 72 5d 29 3b 72 65 74 75 72 6e 20 66 7d 2c 6d Data Ascii: :function(n,t,i){return t==null?-1:ot.call(t,n,i)},merge:function(n,t){for(var u=+t.length,i=0,r=n.length;i<u;i++)n[r++]=t[i];return n.length=r,n},grep:function(n,t,i){for(var u,f=[],r=0,e=n.length,o=!i;r<e;r++)u=!t(n[r],r),u!==o&&f.push(n[r]);return f},m
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 2c 77 3d 65 2e 6c 65 6e 67 74 68 2c 62 3d 66 7c 7c 79 72 28 74 7c 7c 22 2a 22 2c 6f 2e 6e 6f 64 65 54 79 70 65 3f 5b 6f 5d 3a 6f 2c 5b 5d 29 2c 76 3d 6e 26 26 28 66 7c 7c 21 74 29 3f 77 74 28 62 2c 70 2c 6e 2c 6f 2c 73 29 3a 62 2c 68 3d 69 3f 75 7c 7c 28 66 3f 6e 3a 77 7c 7c 72 29 3f 5b 5d 3a 65 3a 76 3b 69 66 28 69 26 26 69 28 76 2c 68 2c 6f 2c 73 29 2c 72 29 66 6f 72 28 6c 3d 77 74 28 68 2c 79 29 2c 72 28 6c 2c 5b 5d 2c 6f 2c 73 29 2c 63 3d 6c 2e 6c 65 6e 67 74 68 3b 63 2d 2d 3b 29 28 61 3d 6c 5b 63 5d 29 26 26 28 68 5b 79 5b 63 5d 5d 3d 21 28 76 5b 79 5b 63 5d 5d 3d 61 29 29 3b 69 66 28 66 29 7b 69 66 28 75 7c 7c 6e 29 7b 69 66 28 75 29 7b 66 6f 72 28 6c 3d 5b 5d 2c 63 3d 68 2e 6c 65 6e 67 74 68 3b 63 2d 2d 3b 29 28 61 3d 68 5b 63 5d 29 26 26 6c 2e 70 Data Ascii: ,w=e.length,b=f\|\|yr(t\|\|"*",o.nodeType?[o]:o,[]),v=n&&(f\|\|!t)?wt(b,p,n,o,s):b,h=i?u\|\|(f?n:w\|\|r)?[]:e:v;if(i&&i(v,h,o,s),r)for(l=wt(h,y),r(l,[],o,s),c=l.length;c--;)(a=l[c])&&(h[y[c]]=!(v[y[c]]=a));if(f){if(u\|\|n){if(u){for(l=[],c=h.length;c--;)(a=h[c])&&l.p
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 72 65 74 75 72 6e 20 6c 3d 3d 3d 69 7c 7c 6c 2e 6e 6f 64 65 54 79 70 65 21 3d 3d 39 7c 7c 21 6c 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3f 69 3a 28 69 3d 6c 2c 73 3d 69 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 68 3d 21 6f 69 28 69 29 2c 63 21 3d 3d 69 26 26 28 75 3d 69 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 75 2e 74 6f 70 21 3d 3d 75 26 26 28 75 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 75 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 70 69 2c 21 31 29 3a 75 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 75 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 75 6e 6c 6f 61 64 22 2c 70 69 29 29 2c 65 2e 61 74 74 72 69 62 75 74 65 73 3d 61 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e Data Ascii: return l===i\|\|l.nodeType!==9\|\|!l.documentElement?i:(i=l,s=i.documentElement,h=!oi(i),c!==i&&(u=i.defaultView)&&u.top!==u&&(u.addEventListener?u.addEventListener("unload",pi,!1):u.attachEvent&&u.attachEvent("onunload",pi)),e.attributes=a(function(n){return
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 69 66 28 28 6e 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 6e 29 21 3d 3d 69 26 26 62 28 6e 29 2c 74 3d 74 2e 72 65 70 6c 61 63 65 28 66 72 2c 22 3d 27 24 31 27 5d 22 29 2c 65 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 26 26 68 26 26 21 6c 74 5b 74 2b 22 20 22 5d 26 26 28 21 64 7c 7c 21 64 2e 74 65 73 74 28 74 29 29 26 26 28 21 6f 7c 7c 21 6f 2e 74 65 73 74 28 74 29 29 29 74 72 79 7b 76 61 72 20 72 3d 63 74 2e 63 61 6c 6c 28 6e 2c 74 29 3b 69 66 28 72 7c 7c 65 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 7c 7c 6e 2e 64 6f 63 75 6d 65 6e 74 26 26 6e 2e 64 6f 63 75 6d 65 6e 74 2e 6e 6f 64 65 54 79 70 65 21 3d 3d 31 31 29 72 65 74 75 72 6e 20 72 7d 63 61 74 63 68 28 66 29 7b 7d 72 65 74 75 72 6e 20 75 28 74 2c 69 2c 6e 75 6c 6c 2c 5b 6e 5d Data Ascii: if((n.ownerDocument\|\|n)!==i&&b(n),t=t.replace(fr,"='$1']"),e.matchesSelector&&h&&!lt[t+" "]&&(!d\|\|!d.test(t))&&(!o\|\|!o.test(t)))try{var r=ct.call(n,t);if(r\|\|e.disconnectedMatch\|\|n.document&&n.document.nodeType!==11)return r}catch(f){}return u(t,i,null,[n]
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 3d 69 28 6e 2c 6e 75 6c 6c 2c 75 2c 5b 5d 29 2c 66 3d 6e 2e 6c 65 6e 67 74 68 3b 66 2d 2d 3b 29 28 65 3d 6f 5b 66 5d 29 26 26 28 6e 5b 66 5d 3d 21 28 74 5b 66 5d 3d 65 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 75 2c 66 29 7b 72 65 74 75 72 6e 20 74 5b 30 5d 3d 6e 2c 69 28 74 2c 6e 75 6c 6c 2c 66 2c 72 29 2c 74 5b 30 5d 3d 6e 75 6c 6c 2c 21 72 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 6c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 75 28 6e 2c 74 29 2e 6c 65 6e 67 74 68 3e 30 7d 7d 29 2c 63 6f 6e 74 61 69 6e 73 3a 6c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 3d 6e 2e 72 65 70 6c 61 63 65 28 79 2c 70 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e Data Ascii: =i(n,null,u,[]),f=n.length;f--;)(e=o[f])&&(n[f]=!(t[f]=e))}):function(n,u,f){return t[0]=n,i(t,null,f,r),t[0]=null,!r.pop()}}),has:l(function(n){return function(t){return u(n,t).length>0}}),contains:l(function(n){return n=n.replace(y,p),function(t){return
2024-10-07 21:30:25 UTC	4096	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 29 7b 76 61 72 20 72 3b 69 66 28 21 69 29 72 65 74 75 72 6e 20 6e 5b 74 5d 3d 3d 3d 21 30 3f 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3a 28 72 3d 6e 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 74 29 29 26 26 72 2e 73 70 65 63 69 66 69 65 64 3f 72 2e 76 61 6c 75 65 3a 6e 75 6c 6c 7d 29 2c 75 7d 28 6e 29 3b 69 2e 66 69 6e 64 3d 76 3b 69 2e 65 78 70 72 3d 76 2e 73 65 6c 65 63 74 6f 72 73 3b 69 2e 65 78 70 72 5b 22 3a 22 5d 3d 69 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 3b 69 2e 75 6e 69 71 75 65 53 6f 72 74 3d 69 2e 75 6e 69 71 75 65 3d 76 2e 75 6e 69 71 75 65 53 6f 72 74 3b 69 2e 74 65 78 74 3d 76 2e 67 65 74 54 65 78 74 3b 69 2e 69 73 58 4d 4c 44 6f 63 3d 76 2e 69 73 58 4d 4c 3b 69 2e 63 6f 6e 74 61 69 Data Ascii: function(n,t,i){var r;if(!i)return n[t]===!0?t.toLowerCase():(r=n.getAttributeNode(t))&&r.specified?r.value:null}),u}(n);i.find=v;i.expr=v.selectors;i.expr[":"]=i.expr.pseudos;i.uniqueSort=i.unique=v.uniqueSort;i.text=v.getText;i.isXMLDoc=v.isXML;i.contai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49729	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:25 UTC	620	OUT	GET /media/dating/striptease2/js/main_casual.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:26 UTC	869	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:26 GMT Content-Type: text/javascript Content-Length: 7742 Connection: close ETag: "8c162e9dc38a2e41524268290545d238" Last-Modified: Mon, 01 Jul 2024 09:48:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC490119A1246C X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1715611637#105343911/gid:0/gname:root/mode:33188/mtime:1719827312#262092674/uid:0/uname:root x-amz-meta-mm-source-mtime: 2024-07-01T09:48:32.319Z Expires: Tue, 07 Oct 2025 21:30:26 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:26 UTC	3227	IN	Data Raw: ef bb bf 76 61 72 20 73 74 72 69 70 74 65 61 73 65 20 3d 20 7b 7d 3b 0d 0a 0d 0a 2f 2f 20 49 66 20 73 69 74 65 20 69 73 20 6e 6f 74 20 6d 75 6c 74 69 6c 61 6e 67 0d 0a 69 66 28 21 24 28 27 62 6f 64 79 27 29 2e 68 61 73 43 6c 61 73 73 28 27 6d 75 6c 74 69 6c 61 6e 67 27 29 29 20 7b 0d 0a 09 66 75 6e 63 74 69 6f 6e 20 63 68 61 6e 67 65 43 69 74 79 28 64 61 74 61 29 20 7b 0d 0a 09 09 69 66 20 28 64 61 74 61 2e 63 69 74 79 2e 72 75 20 26 26 20 24 28 27 23 74 69 74 6c 65 2d 72 75 27 29 2e 6c 65 6e 67 74 68 29 20 7b 0d 0a 09 09 09 24 28 27 23 74 69 74 6c 65 2d 72 75 27 29 2e 74 65 78 74 28 27 d0 a2 d0 b0 d0 b9 d0 bd d1 8b d0 b5 20 d0 b7 d0 bd d0 b0 d0 ba d0 be d0 bc d1 81 d1 82 d0 b2 d0 b0 20 d0 b2 20 d0 b3 2e 20 27 20 2b 20 64 61 74 61 2e 63 69 74 79 2e 72 75 Data Ascii: var striptease = {};// If site is not multilangif(!$('body').hasClass('multilang')) {function changeCity(data) {if (data.city.ru && $('#title-ru').length) {$('#title-ru').text(' . ' + data.city.ru
2024-10-07 21:30:26 UTC	4096	IN	Data Raw: 65 3b 0d 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 45 6e 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 73 68 6f 77 28 29 3b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 70 72 6f 70 28 27 64 69 73 61 62 6c 65 64 27 2c 20 66 61 6c 73 65 29 3b 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 44 69 73 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 70 72 6f 70 28 27 64 69 73 61 62 6c 65 64 27 2c 20 74 72 75 65 29 3b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 Data Ascii: e;return false;},EnableNextButton: function () {$(".slide_next").show();$(".slide_next").prop('disabled', false);},DisableNextButton: function () {$(".slide_next").prop('disabled', true);$(".slide_next
2024-10-07 21:30:26 UTC	419	IN	Data Raw: 65 2e 46 75 6e 63 74 69 6f 6e 73 2e 45 6e 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 28 29 3b 0d 0a 09 09 09 09 7d 0d 0a 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 2f 2f 53 6f 6d 65 20 71 75 65 73 74 69 6f 6e 73 20 63 6f 6e 73 69 73 74 20 6f 66 20 61 20 73 65 6c 65 63 74 20 62 6f 78 2e 20 57 68 65 6e 20 61 6e 20 61 6e 73 77 65 72 20 69 73 20 73 65 6c 65 63 74 65 64 20 69 6e 20 6f 6e 65 2c 0d 0a 09 09 09 2f 2f 74 68 69 73 20 6d 65 74 68 6f 64 20 69 73 20 74 72 69 67 67 65 72 65 64 2e 0d 0a 09 09 09 41 6e 73 77 65 72 43 68 61 6e 67 65 64 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 69 66 20 28 73 74 72 69 70 74 65 61 73 65 2e 46 75 6e 63 74 69 6f 6e 73 2e 4e 65 78 74 42 75 74 74 6f 6e 45 78 69 73 74 49 6e 43 75 72 72 65 6e 74 53 6c 69 64 65 Data Ascii: e.Functions.EnableNextButton();}},//Some questions consist of a select box. When an answer is selected in one,//this method is triggered.AnswerChanged: function () {if (striptease.Functions.NextButtonExistInCurrentSlide

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49727	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:25 UTC	589	OUT	GET /media/bb.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:26 UTC	876	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:26 GMT Content-Type: application/javascript Content-Length: 639 Connection: close ETag: "0d553e4bac91c74bfee2dbabba61e99e" Last-Modified: Mon, 20 Feb 2023 09:29:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 354f9eb41c4f44111da43ee93430d467ccc8f740dac6a89f93d2690a13b4c5b4 X-Amz-Request-Id: 17FC490120EF88A3 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 365 X-Ratelimit-Remaining: 365 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1676832256#258761277/gid:0/gname:root/mode:33188/mtime:1659030913#852764000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-07-28T17:55:13.852764Z Expires: Tue, 07 Oct 2025 21:30:26 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:26 UTC	639	IN	Data Raw: 76 61 72 20 50 72 65 76 65 6e 74 42 62 3d 21 5b 5d 3b 67 65 74 55 72 6c 50 61 72 61 6d 65 74 65 72 28 27 62 27 29 3d 3d 3d 27 30 27 3f 50 72 65 76 65 6e 74 42 62 3d 21 21 5b 5d 3a 50 72 65 76 65 6e 74 42 62 3d 21 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 50 72 65 76 65 6e 74 42 62 29 7b 76 61 72 20 61 3b 74 72 79 7b 66 6f 72 28 61 3d 30 78 30 3b 30 78 61 3e 61 3b 2b 2b 61 29 68 69 73 74 6f 72 79 5b 27 70 75 73 68 53 74 61 74 65 27 5d 28 7b 7d 2c 27 27 2c 27 27 29 3b 6f 6e 70 6f 70 73 74 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 5b 27 73 74 61 74 65 27 5d 26 26 6c 6f 63 61 74 69 6f 6e 5b 27 72 65 70 6c 61 63 65 27 5d 28 67 65 74 55 72 6c 57 69 74 68 50 61 72 61 6d 28 27 78 3d 31 27 29 29 3b 7d 3b 7d 63 61 74 63 68 28 62 29 7b 7d 7d Data Ascii: var PreventBb=![];getUrlParameter('b')==='0'?PreventBb=!![]:PreventBb=![];!function(){if(!PreventBb){var a;try{for(a=0x0;0xa>a;++a)history['pushState']({},'','');onpopstate=function(b){b['state']&&location['replace'](getUrlWithParam('x=1'));};}catch(b){}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49728	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:25 UTC	601	OUT	GET /media/exit-new/exit1.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:26 UTC	870	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:26 GMT Content-Type: text/javascript Content-Length: 3473 Connection: close ETag: "625e5e2950612f771e246beb33c9ea61" Last-Modified: Thu, 01 Aug 2024 07:20:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 42aa5a63a589b4374a9c1295fb1c20dcda18b77f2cb8e112e03c5ecdf9b92360 X-Amz-Request-Id: 17FC490120DF38E6 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 336 X-Ratelimit-Remaining: 336 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014412#200181126/gid:0/gname:root/mode:33279/mtime:1655385544#182688000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-06-16T13:19:04.182688Z Expires: Tue, 07 Oct 2025 21:30:26 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:26 UTC	3226	IN	Data Raw: 2f 2a 20 64 6f 63 52 65 61 64 79 20 69 73 20 61 20 73 69 6e 67 6c 65 20 70 6c 61 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 20 74 68 61 74 20 70 72 6f 76 69 64 65 73 20 61 20 6d 65 74 68 6f 64 20 6f 66 20 73 63 68 65 64 75 6c 69 6e 67 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 73 20 74 6f 20 72 75 6e 20 61 74 20 73 6f 6d 65 20 6c 61 74 65 72 20 70 6f 69 6e 74 20 77 68 65 6e 20 74 68 65 20 44 4f 4d 20 68 61 73 20 66 69 6e 69 73 68 65 64 20 6c 6f 61 64 69 6e 67 2e 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6f 2e Data Ascii: /* docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.
2024-10-07 21:30:26 UTC	247	IN	Data Raw: 6b 27 20 7c 7c 20 65 2e 74 61 72 67 65 74 2e 63 6c 6f 73 65 73 74 28 22 61 5b 68 72 65 66 5e 3d 27 2f 77 65 62 2f 27 22 29 20 7c 7c 20 65 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 3d 3d 3d 20 27 61 27 20 26 26 20 65 2e 74 61 72 67 65 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 29 20 3d 3d 3d 20 27 2f 75 6e 73 75 62 73 63 72 69 62 65 2e 61 73 70 78 27 29 3b 0d 0a 09 09 7d 0d 0a 09 09 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 62 65 66 6f 72 65 75 6e 6c 6f 61 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0d 0a 09 09 09 44 69 73 70 6c 61 79 45 78 69 74 53 70 6c 61 73 68 28 65 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 7d 0d 0a 7d 29 3b Data Ascii: k' \|\| e.target.closest("a[href^='/web/'") \|\| e.target.tagName.toLowerCase() === 'a' && e.target.getAttribute("href") === '/unsubscribe.aspx');}window.addEventListener('beforeunload', function (e) {DisplayExitSplash(e);});}});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49733	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:25 UTC	394	OUT	GET /util/utils.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:26 UTC	873	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:26 GMT Content-Type: text/javascript Content-Length: 7514 Connection: close ETag: "85a42b1d6c8769fce99fb44aefb041b0" Last-Modified: Thu, 01 Aug 2024 07:23:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c X-Amz-Request-Id: 17FC4900B307103B X-Content-Type-Options: nosniff X-Ratelimit-Limit: 374 X-Ratelimit-Remaining: 374 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720010547#640143858/gid:0/gname:root/mode:33188/mtime:1719824938#357078843/uid:0/uname:root x-amz-meta-mm-source-mtime: 2024-07-01T09:08:58.357078843Z Expires: Tue, 07 Oct 2025 21:30:26 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:26 UTC	3223	IN	Data Raw: 2f 2a 2a 20 64 6f 63 52 65 61 64 79 20 69 73 20 61 20 73 69 6e 67 6c 65 20 70 6c 61 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 20 74 68 61 74 20 70 72 6f 76 69 64 65 73 20 61 20 6d 65 74 68 6f 64 20 6f 66 20 73 63 68 65 64 75 6c 69 6e 67 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 73 20 74 6f 20 72 75 6e 20 61 74 20 73 6f 6d 65 20 6c 61 74 65 72 20 70 6f 69 6e 74 20 77 68 65 6e 20 74 68 65 20 44 4f 4d 20 68 61 73 20 66 69 6e 69 73 68 65 64 20 6c 6f 61 64 69 6e 67 2e 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6f Data Ascii: /** docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o
2024-10-07 21:30:26 UTC	4096	IN	Data Raw: 20 2b 3d 20 27 3c 69 20 63 6c 61 73 73 3d 22 66 6c 61 67 2d 69 63 6f 6e 20 66 6c 61 67 2d 69 63 6f 6e 2d 27 20 2b 20 64 61 74 61 2e 63 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 2b 20 27 22 3e 3c 2f 69 3e 27 20 2b 20 73 74 72 32 3b 0d 0a 09 09 7d 0d 0a 09 7d 20 65 6c 73 65 20 7b 0d 0a 09 09 73 74 72 20 3d 20 73 74 72 32 3b 0d 0a 09 7d 0d 0a 0d 0a 09 6e 6f 64 65 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 73 74 72 3b 0d 0a 7d 0d 0a 0d 0a 76 61 72 20 67 65 6f 52 65 66 44 61 74 61 20 3d 20 74 79 70 65 6f 66 20 67 65 6f 44 61 74 61 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 3f 20 67 65 6f 44 61 74 61 20 3a 20 6e 75 6c 6c 3b 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 4c 6f 63 61 74 69 6f 6e 28 63 6f 6e 74 61 69 6e 65 72 49 64 29 20 7b 0d 0a 09 Data Ascii: += '<i class="flag-icon flag-icon-' + data.cc.toLowerCase() + '"></i>' + str2;}} else {str = str2;}node.innerHTML = str;}var geoRefData = typeof geoData !== "undefined" ? geoData : null;function showLocation(containerId) {
2024-10-07 21:30:26 UTC	195	IN	Data Raw: 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 75 6e 73 75 62 73 63 72 69 62 65 22 29 5b 30 5d 29 20 7b 0d 0a 09 09 68 69 64 65 55 6e 73 75 62 28 29 3b 0d 0a 09 7d 0d 0a 09 61 64 64 53 65 73 73 69 6f 6e 49 64 28 29 3b 0d 0a 09 73 68 6f 77 4c 6f 63 61 74 69 6f 6e 28 22 75 73 65 72 4c 6f 63 61 74 69 6f 6e 22 29 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 2f 2a 20 0d 0a 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 73 65 74 54 69 6d 65 6f 75 74 28 61 70 70 65 6e 64 50 69 78 65 6c 73 2c 20 32 30 30 30 29 3b 0d 0a 20 7d 3b 2a 2f Data Ascii: tElementsByClassName("unsubscribe")[0]) {hideUnsub();}addSessionId();showLocation("userLocation");});/* window.onload = function() { setTimeout(appendPixels, 2000); };*/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49732	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:25 UTC	400	OUT	GET /cookie/js.cookie.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:26 UTC	879	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:26 GMT Content-Type: application/javascript Content-Length: 4264 Connection: close ETag: "a7e9883924072f15259de6888d5ef515" Last-Modified: Wed, 20 Sep 2023 15:19:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC4900AC396A0F X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1693134513#248036972/gid:0/gname:root/mode:33188/mtime:1658397637#354375000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-07-21T10:00:37.354375Z Expires: Tue, 07 Oct 2025 21:30:26 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:26 UTC	3217	IN	Data Raw: 2f 2a 21 0d 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 43 6f 6f 6b 69 65 20 76 32 2e 31 2e 33 0d 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 73 2d 63 6f 6f 6b 69 65 2f 6a 73 2d 63 6f 6f 6b 69 65 0d 0a 20 2a 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 35 20 4b 6c 61 75 73 20 48 61 72 74 6c 20 26 20 46 61 67 6e 65 72 20 42 72 61 63 6b 0d 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0d 0a 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 21 31 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 26 26 28 64 65 66 69 6e 65 28 65 29 2c 6e 3d 21 30 29 2c 22 Data Ascii: /! JavaScript Cookie v2.1.3 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */!function(e){var n=!1;if("function"==typeof define&&define.amd&&(define(e),n=!0),"
2024-10-07 21:30:26 UTC	1047	IN	Data Raw: 65 6d 6f 76 65 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 22 29 3b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 73 65 74 28 27 49 73 4e 6f 74 55 6e 69 71 75 65 32 27 2c 20 27 74 72 75 65 27 2c 20 7b 20 65 78 70 69 72 65 73 3a 20 65 78 44 61 79 73 20 7d 29 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 65 6c 73 65 20 69 66 20 28 43 6f 6f 6b 69 65 73 2e 67 65 74 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 32 22 29 29 7b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 72 65 6d 6f 76 65 28 22 49 73 4e 6f 74 55 6e 69 71 75 65 32 22 29 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 65 6c 73 65 20 7b 0d 0a 09 09 09 09 43 6f 6f 6b 69 65 73 2e 73 65 74 28 27 49 73 4e 6f 74 55 6e 69 71 75 65 27 2c 20 27 74 72 75 65 27 2c 20 7b 20 65 78 70 69 72 65 73 3a 20 65 78 44 61 79 73 20 7d 29 3b 0d 0a 09 09 09 7d Data Ascii: emove("IsNotUnique");Cookies.set('IsNotUnique2', 'true', { expires: exDays });}else if (Cookies.get("IsNotUnique2")){Cookies.remove("IsNotUnique2");}else {Cookies.set('IsNotUnique', 'true', { expires: exDays });}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49735	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:26 UTC	423	OUT	GET /media/dating/striptease2/js/main_casual.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:27 UTC	869	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:27 GMT Content-Type: text/javascript Content-Length: 7742 Connection: close ETag: "8c162e9dc38a2e41524268290545d238" Last-Modified: Mon, 01 Jul 2024 09:48:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 17FC490119A1246C X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1988 X-Ratelimit-Remaining: 1988 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1715611637#105343911/gid:0/gname:root/mode:33188/mtime:1719827312#262092674/uid:0/uname:root x-amz-meta-mm-source-mtime: 2024-07-01T09:48:32.319Z Expires: Tue, 07 Oct 2025 21:30:27 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:27 UTC	3227	IN	Data Raw: ef bb bf 76 61 72 20 73 74 72 69 70 74 65 61 73 65 20 3d 20 7b 7d 3b 0d 0a 0d 0a 2f 2f 20 49 66 20 73 69 74 65 20 69 73 20 6e 6f 74 20 6d 75 6c 74 69 6c 61 6e 67 0d 0a 69 66 28 21 24 28 27 62 6f 64 79 27 29 2e 68 61 73 43 6c 61 73 73 28 27 6d 75 6c 74 69 6c 61 6e 67 27 29 29 20 7b 0d 0a 09 66 75 6e 63 74 69 6f 6e 20 63 68 61 6e 67 65 43 69 74 79 28 64 61 74 61 29 20 7b 0d 0a 09 09 69 66 20 28 64 61 74 61 2e 63 69 74 79 2e 72 75 20 26 26 20 24 28 27 23 74 69 74 6c 65 2d 72 75 27 29 2e 6c 65 6e 67 74 68 29 20 7b 0d 0a 09 09 09 24 28 27 23 74 69 74 6c 65 2d 72 75 27 29 2e 74 65 78 74 28 27 d0 a2 d0 b0 d0 b9 d0 bd d1 8b d0 b5 20 d0 b7 d0 bd d0 b0 d0 ba d0 be d0 bc d1 81 d1 82 d0 b2 d0 b0 20 d0 b2 20 d0 b3 2e 20 27 20 2b 20 64 61 74 61 2e 63 69 74 79 2e 72 75 Data Ascii: var striptease = {};// If site is not multilangif(!$('body').hasClass('multilang')) {function changeCity(data) {if (data.city.ru && $('#title-ru').length) {$('#title-ru').text(' . ' + data.city.ru
2024-10-07 21:30:27 UTC	4096	IN	Data Raw: 65 3b 0d 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 45 6e 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 73 68 6f 77 28 29 3b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 70 72 6f 70 28 27 64 69 73 61 62 6c 65 64 27 2c 20 66 61 6c 73 65 29 3b 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 44 69 73 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 22 29 2e 70 72 6f 70 28 27 64 69 73 61 62 6c 65 64 27 2c 20 74 72 75 65 29 3b 0d 0a 09 09 09 09 24 28 22 2e 73 6c 69 64 65 5f 6e 65 78 74 Data Ascii: e;return false;},EnableNextButton: function () {$(".slide_next").show();$(".slide_next").prop('disabled', false);},DisableNextButton: function () {$(".slide_next").prop('disabled', true);$(".slide_next
2024-10-07 21:30:27 UTC	419	IN	Data Raw: 65 2e 46 75 6e 63 74 69 6f 6e 73 2e 45 6e 61 62 6c 65 4e 65 78 74 42 75 74 74 6f 6e 28 29 3b 0d 0a 09 09 09 09 7d 0d 0a 0d 0a 09 09 09 7d 2c 0d 0a 0d 0a 09 09 09 2f 2f 53 6f 6d 65 20 71 75 65 73 74 69 6f 6e 73 20 63 6f 6e 73 69 73 74 20 6f 66 20 61 20 73 65 6c 65 63 74 20 62 6f 78 2e 20 57 68 65 6e 20 61 6e 20 61 6e 73 77 65 72 20 69 73 20 73 65 6c 65 63 74 65 64 20 69 6e 20 6f 6e 65 2c 0d 0a 09 09 09 2f 2f 74 68 69 73 20 6d 65 74 68 6f 64 20 69 73 20 74 72 69 67 67 65 72 65 64 2e 0d 0a 09 09 09 41 6e 73 77 65 72 43 68 61 6e 67 65 64 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 09 09 09 69 66 20 28 73 74 72 69 70 74 65 61 73 65 2e 46 75 6e 63 74 69 6f 6e 73 2e 4e 65 78 74 42 75 74 74 6f 6e 45 78 69 73 74 49 6e 43 75 72 72 65 6e 74 53 6c 69 64 65 Data Ascii: e.Functions.EnableNextButton();}},//Some questions consist of a select box. When an answer is selected in one,//this method is triggered.AnswerChanged: function () {if (striptease.Functions.NextButtonExistInCurrentSlide

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49736	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:27 UTC	404	OUT	GET /media/exit-new/exit1.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:27 UTC	870	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:27 GMT Content-Type: text/javascript Content-Length: 3473 Connection: close ETag: "625e5e2950612f771e246beb33c9ea61" Last-Modified: Thu, 01 Aug 2024 07:20:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 42aa5a63a589b4374a9c1295fb1c20dcda18b77f2cb8e112e03c5ecdf9b92360 X-Amz-Request-Id: 17FC490120DF38E6 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 336 X-Ratelimit-Remaining: 336 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014412#200181126/gid:0/gname:root/mode:33279/mtime:1655385544#182688000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-06-16T13:19:04.182688Z Expires: Tue, 07 Oct 2025 21:30:27 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:27 UTC	3226	IN	Data Raw: 2f 2a 20 64 6f 63 52 65 61 64 79 20 69 73 20 61 20 73 69 6e 67 6c 65 20 70 6c 61 69 6e 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 20 74 68 61 74 20 70 72 6f 76 69 64 65 73 20 61 20 6d 65 74 68 6f 64 20 6f 66 20 73 63 68 65 64 75 6c 69 6e 67 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6a 61 76 61 73 63 72 69 70 74 20 66 75 6e 63 74 69 6f 6e 73 20 74 6f 20 72 75 6e 20 61 74 20 73 6f 6d 65 20 6c 61 74 65 72 20 70 6f 69 6e 74 20 77 68 65 6e 20 74 68 65 20 44 4f 4d 20 68 61 73 20 66 69 6e 69 73 68 65 64 20 6c 6f 61 64 69 6e 67 2e 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6f 2e Data Ascii: /* docReady is a single plain javascript function that provides a method of scheduling one or more javascript functions to run at some later point when the DOM has finished loading. */!function(t,e){"use strict";function n(){if(!a){a=!0;for(var t=0;t<o.
2024-10-07 21:30:27 UTC	247	IN	Data Raw: 6b 27 20 7c 7c 20 65 2e 74 61 72 67 65 74 2e 63 6c 6f 73 65 73 74 28 22 61 5b 68 72 65 66 5e 3d 27 2f 77 65 62 2f 27 22 29 20 7c 7c 20 65 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 3d 3d 3d 20 27 61 27 20 26 26 20 65 2e 74 61 72 67 65 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 29 20 3d 3d 3d 20 27 2f 75 6e 73 75 62 73 63 72 69 62 65 2e 61 73 70 78 27 29 3b 0d 0a 09 09 7d 0d 0a 09 09 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 62 65 66 6f 72 65 75 6e 6c 6f 61 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0d 0a 09 09 09 44 69 73 70 6c 61 79 45 78 69 74 53 70 6c 61 73 68 28 65 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 7d 0d 0a 7d 29 3b Data Ascii: k' \|\| e.target.closest("a[href^='/web/'") \|\| e.target.tagName.toLowerCase() === 'a' && e.target.getAttribute("href") === '/unsubscribe.aspx');}window.addEventListener('beforeunload', function (e) {DisplayExitSplash(e);});}});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49737	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:27 UTC	392	OUT	GET /media/bb.js HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:27 UTC	876	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:27 GMT Content-Type: application/javascript Content-Length: 639 Connection: close ETag: "0d553e4bac91c74bfee2dbabba61e99e" Last-Modified: Mon, 20 Feb 2023 09:29:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 354f9eb41c4f44111da43ee93430d467ccc8f740dac6a89f93d2690a13b4c5b4 X-Amz-Request-Id: 17FC490120EF88A3 X-Content-Type-Options: nosniff X-Ratelimit-Limit: 365 X-Ratelimit-Remaining: 365 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1676832256#258761277/gid:0/gname:root/mode:33188/mtime:1659030913#852764000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-07-28T17:55:13.852764Z Expires: Tue, 07 Oct 2025 21:30:27 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:27 UTC	639	IN	Data Raw: 76 61 72 20 50 72 65 76 65 6e 74 42 62 3d 21 5b 5d 3b 67 65 74 55 72 6c 50 61 72 61 6d 65 74 65 72 28 27 62 27 29 3d 3d 3d 27 30 27 3f 50 72 65 76 65 6e 74 42 62 3d 21 21 5b 5d 3a 50 72 65 76 65 6e 74 42 62 3d 21 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 50 72 65 76 65 6e 74 42 62 29 7b 76 61 72 20 61 3b 74 72 79 7b 66 6f 72 28 61 3d 30 78 30 3b 30 78 61 3e 61 3b 2b 2b 61 29 68 69 73 74 6f 72 79 5b 27 70 75 73 68 53 74 61 74 65 27 5d 28 7b 7d 2c 27 27 2c 27 27 29 3b 6f 6e 70 6f 70 73 74 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 5b 27 73 74 61 74 65 27 5d 26 26 6c 6f 63 61 74 69 6f 6e 5b 27 72 65 70 6c 61 63 65 27 5d 28 67 65 74 55 72 6c 57 69 74 68 50 61 72 61 6d 28 27 78 3d 31 27 29 29 3b 7d 3b 7d 63 61 74 63 68 28 62 29 7b 7d 7d Data Ascii: var PreventBb=![];getUrlParameter('b')==='0'?PreventBb=!![]:PreventBb=![];!function(){if(!PreventBb){var a;try{for(a=0x0;0xa>a;++a)history['pushState']({},'','');onpopstate=function(b){b['state']&&location['replace'](getUrlWithParam('x=1'));};}catch(b){}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49738	136.243.216.252	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:27 UTC	573	OUT	GET /ExtService.svc/getextparams HTTP/1.1 Host: bigdatajsext.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://flirtfantasy.one Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://flirtfantasy.one/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 21:30:27 UTC	213	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 21:30:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 633 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-10-07 21:30:27 UTC	633	IN	Data Raw: 7b 22 63 63 22 3a 22 55 53 22 2c 22 63 6e 61 6d 65 73 22 3a 7b 22 64 65 22 3a 22 55 53 41 22 2c 22 65 6e 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 65 73 22 3a 22 45 73 74 61 64 6f 73 20 55 6e 69 64 6f 73 22 2c 22 66 72 22 3a 22 c3 89 74 61 74 73 20 55 6e 69 73 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 a1 e3 83 aa e3 82 ab 22 2c 22 70 74 2d 42 52 22 3a 22 45 55 41 22 2c 22 72 75 22 3a 22 d0 a1 d0 a8 d0 90 22 2c 22 7a 68 2d 43 4e 22 3a 22 e7 be 8e e5 9b bd 22 7d 2c 22 63 69 74 79 22 3a 7b 22 64 65 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 65 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 65 73 22 3a 22 4e 75 65 76 61 20 59 6f 72 6b 22 2c 22 66 72 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 6a 61 22 3a 22 e3 83 8b e3 83 a5 e3 83 bc e3 Data Ascii: {"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"tats Unis","ja":"","pt-BR":"EUA","ru":"","zh-CN":""},"city":{"de":"New York City","en":"New York","es":"Nueva York","fr":"New York","ja":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49740	136.243.216.252	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:28 UTC	367	OUT	GET /ExtService.svc/getextparams HTTP/1.1 Host: bigdatajsext.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 21:30:28 UTC	213	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 21:30:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 633 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: *
2024-10-07 21:30:28 UTC	633	IN	Data Raw: 7b 22 63 63 22 3a 22 55 53 22 2c 22 63 6e 61 6d 65 73 22 3a 7b 22 64 65 22 3a 22 55 53 41 22 2c 22 65 6e 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 65 73 22 3a 22 45 73 74 61 64 6f 73 20 55 6e 69 64 6f 73 22 2c 22 66 72 22 3a 22 c3 89 74 61 74 73 20 55 6e 69 73 22 2c 22 6a 61 22 3a 22 e3 82 a2 e3 83 a1 e3 83 aa e3 82 ab 22 2c 22 70 74 2d 42 52 22 3a 22 45 55 41 22 2c 22 72 75 22 3a 22 d0 a1 d0 a8 d0 90 22 2c 22 7a 68 2d 43 4e 22 3a 22 e7 be 8e e5 9b bd 22 7d 2c 22 63 69 74 79 22 3a 7b 22 64 65 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 65 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 65 73 22 3a 22 4e 75 65 76 61 20 59 6f 72 6b 22 2c 22 66 72 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 6a 61 22 3a 22 e3 83 8b e3 83 a5 e3 83 bc e3 Data Ascii: {"cc":"US","cnames":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"tats Unis","ja":"","pt-BR":"EUA","ru":"","zh-CN":""},"city":{"de":"New York City","en":"New York","es":"Nueva York","fr":"New York","ja":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49739	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:28 UTC	681	OUT	GET /util/flag-icon/flags/4x3/us.svg HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://flirtfantasy.one/util/flag-icon/css/flag-icon.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:28 UTC	866	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:29 GMT Content-Type: image/svg+xml Content-Length: 6215 Connection: close ETag: "2b327bda75ccb4c9c3cd7ea61c4fed82" Last-Modified: Thu, 01 Aug 2024 07:23:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c X-Amz-Request-Id: 17FC4901A35A1DFE X-Content-Type-Options: nosniff X-Ratelimit-Limit: 374 X-Ratelimit-Remaining: 374 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720010399#15855069/gid:0/gname:root/mode:33188/mtime:1655386310#704090000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-06-16T13:31:50.70409Z Expires: Tue, 07 Oct 2025 21:30:29 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:28 UTC	3230	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 34 38 30 22 20 77 69 64 74 68 3d 22 36 34 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 34 30 20 34 38 30 22 3e 0d 0a 20 20 3c 67 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 73 63 61 6c 65 28 2e 39 33 37 35 29 22 3e 0d 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 70 74 22 3e 0d 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480"> <g fill-rule="evenodd" transform="scale(.9375)"> <g stroke-width="1pt"> <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z
2024-10-07 21:30:28 UTC	2985	IN	Data Raw: 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 48 39 33 2e 37 34 7a 6d 36 34 2e 38 35 36 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 38 6c 2d 39 2e 32 37 20 36 2e 37 33 35 20 33 2e 35 34 31 20 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 34 2d 39 2e 32 36 39 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 32 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 37 6c 2d 39 2e 32 36 39 20 36 2e 37 33 35 20 33 2e 35 34 20 31 30 2e 38 39 36 2d 39 2e 32 36 38 2d 36 2e 37 33 34 2d 39 2e 32 37 20 36 2e 37 33 34 20 33 2e 35 34 31 2d 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 35 20 30 Data Ascii: .54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54 10.896h11.457l-9.269 6.735 3.54 10.896-9.268-6.734-9.27 6.734 3.541-10.896-9.27-6.735h11.458zm64.855 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49741	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:29 UTC	412	OUT	GET /util/flag-icon/flags/4x3/us.svg HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:29 UTC	866	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:30 GMT Content-Type: image/svg+xml Content-Length: 6215 Connection: close ETag: "2b327bda75ccb4c9c3cd7ea61c4fed82" Last-Modified: Thu, 01 Aug 2024 07:23:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c X-Amz-Request-Id: 17FC4901A35A1DFE X-Content-Type-Options: nosniff X-Ratelimit-Limit: 374 X-Ratelimit-Remaining: 374 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720010399#15855069/gid:0/gname:root/mode:33188/mtime:1655386310#704090000/uid:0/uname:root x-amz-meta-mm-source-mtime: 2022-06-16T13:31:50.70409Z Expires: Tue, 07 Oct 2025 21:30:30 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:29 UTC	3230	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 34 38 30 22 20 77 69 64 74 68 3d 22 36 34 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 34 30 20 34 38 30 22 3e 0d 0a 20 20 3c 67 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 73 63 61 6c 65 28 2e 39 33 37 35 29 22 3e 0d 0a 20 20 20 20 3c 67 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 70 74 22 3e 0d 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a 6d 30 20 37 38 2e 37 37 68 39 37 32 2e 38 31 76 33 39 2e 33 38 35 48 30 7a Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="480" width="640" viewBox="0 0 640 480"> <g fill-rule="evenodd" transform="scale(.9375)"> <g stroke-width="1pt"> <path d="M0 0h972.81v39.385H0zm0 78.77h972.81v39.385H0zm0 78.77h972.81v39.385H0z
2024-10-07 21:30:29 UTC	2985	IN	Data Raw: 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 48 39 33 2e 37 34 7a 6d 36 34 2e 38 35 36 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 38 6c 2d 39 2e 32 37 20 36 2e 37 33 35 20 33 2e 35 34 31 20 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 34 2d 39 2e 32 36 39 20 36 2e 37 33 34 20 33 2e 35 34 2d 31 30 2e 38 39 36 2d 39 2e 32 36 39 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 32 20 30 6c 33 2e 35 34 20 31 30 2e 38 39 36 68 31 31 2e 34 35 37 6c 2d 39 2e 32 36 39 20 36 2e 37 33 35 20 33 2e 35 34 20 31 30 2e 38 39 36 2d 39 2e 32 36 38 2d 36 2e 37 33 34 2d 39 2e 32 37 20 36 2e 37 33 34 20 33 2e 35 34 31 2d 31 30 2e 38 39 36 2d 39 2e 32 37 2d 36 2e 37 33 35 68 31 31 2e 34 35 38 7a 6d 36 34 2e 38 35 35 20 30 Data Ascii: .54-10.896-9.269-6.735H93.74zm64.856 0l3.54 10.896h11.458l-9.27 6.735 3.541 10.896-9.269-6.734-9.269 6.734 3.54-10.896-9.269-6.735h11.458zm64.852 0l3.54 10.896h11.457l-9.269 6.735 3.54 10.896-9.268-6.734-9.27 6.734 3.541-10.896-9.27-6.735h11.458zm64.855 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49742	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:29 UTC	712	OUT	GET /media/dating/striptease2/images/casual_2/1.jpg HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://flirtfantasy.one/media/dating/striptease2/css/style_shagslags.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:29 UTC	868	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:30 GMT Content-Type: image/jpeg Content-Length: 69020 Connection: close ETag: "29d4b3a7272689e578c5f6dd5ecc8ace" Last-Modified: Thu, 01 Aug 2024 07:19:47 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: af968cfc53e5d4d46c2a7314ea3774fe010d1d1a8defca6495a09901b4f201c0 X-Amz-Request-Id: 17FC4901E4F745DD X-Content-Type-Options: nosniff X-Ratelimit-Limit: 336 X-Ratelimit-Remaining: 336 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014410#312176943/gid:0/gname:root/mode:33152/mtime:1702499647#20491135/uid:0/uname:root x-amz-meta-mm-source-mtime: 2023-12-13T20:34:07.020491135Z Expires: Tue, 07 Oct 2025 21:30:30 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:29 UTC	3228	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 ff c0 00 11 08 04 39 07 81 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF,,C%# , #&')*)-0-(0%()(C(((((((((((((((((((((((((((((((((((((((((((((((((((9"}!1AQa"q2
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 28 ac e3 a8 30 72 ce a3 8e de 95 6b 6c af 23 21 42 7a 63 da b3 6e ed 25 f9 c6 d3 cf 39 a5 64 3d 7a 1b 3a 47 89 5e de 65 31 16 4f 6c f0 6b aa 7d 7e 47 89 6e 2d 9f 63 03 c8 c7 7f 5a f2 ad 86 26 3b b3 ba b7 b4 3b e2 ae 12 46 f6 20 f4 a9 71 b0 45 f4 67 b5 78 1f e2 d6 a3 a4 5c 2c 57 8e 6f 2c b1 f3 46 ed 96 5f 70 6b e8 7f 0c f8 8f 4e f1 1d 82 dd 69 b3 ab 82 06 e4 cf cc a7 d0 8a f8 be 5d 3d 1c ac f6 bf 29 ea 54 1c 1f c2 ba ff 00 86 3a e4 fa 3f 89 6d f7 4e d1 c5 21 f2 c3 8e 36 93 d0 30 e8 46 69 c6 5d 01 c6 db 1f 5c d1 59 7a 2e a6 6f 63 68 ee 13 c9 bc 8f ef c7 9e 0f a3 2f a8 35 a7 5a 92 2d 14 94 50 31 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 Data Ascii: (0rkl#!Bzcn%9d=z:G^e1Olk}~Gn-cZ&;;F qEgx\,Wo,F_pkNi]=)T:?mN!60Fi]\Yz.och/5Z-P1hJ(hJ(hJ(hJ(hJ(hJ(h
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 49 45 00 2e 68 cd 25 14 00 b9 a3 34 94 50 02 e6 b0 7c 5f b8 69 37 6e a3 38 84 e3 b5 6e d6 4f 89 d0 3e 8f 76 a7 f8 a2 60 3f 2a 00 f9 0b e2 40 67 d4 36 39 19 08 00 23 a5 79 fd ec 80 06 45 ef 5d df 8e dd ae 6f 19 89 04 e0 8c 8f 6a f3 eb a2 0c a0 9f 5c 56 28 b9 9e d3 f0 a6 0d 9a 24 72 63 1d 6b 6b 5b 81 6e cb 89 7e 6e e0 53 3e 15 db ee f0 a5 bb 81 cf 7a db be b6 fd e7 2b d6 b0 e6 69 dd 1d 6a 09 c5 1c 16 a5 a5 45 70 49 30 00 71 d5 78 cd 63 4d a4 86 60 88 a3 68 39 c7 bd 7a 0d f5 b3 88 8f cb c1 1d ab 02 50 11 8e 7e b5 5e d1 b1 7b 24 87 78 63 4c 58 a7 8f 80 70 0b 57 ac f8 4d 24 8e 3c 05 3f 31 c8 c5 72 5a 4c 16 5a 46 8c ba 96 b3 34 76 f1 4e 00 42 e7 18 15 e9 1e 10 9e 1f b3 79 e5 a3 78 02 17 59 01 ca ed c7 5c d4 38 b6 ee cd 13 51 56 34 2e ac e3 bb b5 f9 d7 92 30 47 Data Ascii: IE.h%4P\|_i7n8nO>v`?*@g69#yE]oj\V($rckk[n~nS>z+ijEpI0qxcM`h9zP~^{$xcLXpWM$<?1rZLZF4vNByxY\8QV4.0G
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 5a 00 df a2 8a 29 19 18 32 1f de 37 d4 d3 73 4b 27 fa c6 fa 9a 6d 33 51 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 Data Ascii: sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\JZ)27sK'm3QsFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sF
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: ad 1d 42 35 f2 0f cc 2b 3e 1b 26 81 77 44 70 7d 29 d2 dc b8 8c a1 19 3d 39 aa 8c 9a 5a 99 4e 29 bb a3 c9 7c 5e cd f6 c7 19 c8 15 cb 6b b2 79 da 40 85 4f 39 e6 bd 23 5a d1 cd cd c4 8e cb 9c fb 57 01 ab 69 37 11 ca e8 87 28 3b 53 4c ae 5d 0f 3a 9c 08 5f 6b 0e fc 56 95 cd d2 b7 87 16 3f 59 b0 47 af 14 6a f6 8b b8 e4 90 e9 d8 d6 55 e3 85 b5 b6 8b 23 05 cb 63 be 78 ad 13 b9 84 91 b7 a2 db 7e e6 e1 dc fc b1 ae 06 38 c6 47 ff 00 aa b2 b5 71 fb d8 39 1b 82 0f eb 5a fa 53 ff 00 c4 a6 fb 83 9e 09 3d eb 03 54 9c 47 70 18 60 9d a0 0f d6 b4 46 6d 0e bf b8 de 21 84 9d cb b3 27 f3 e2 9f 22 18 a3 8d 3a 17 03 8a 76 9f 66 61 80 5e 5f 7d d1 c8 5f ef 7a 0a 8e 7b a1 77 79 14 bb 40 52 7f ef 9f 6a 00 f5 ef 87 fa ae 9f 7b a6 5b 69 fa c4 11 4c b0 b6 d5 0e b9 ca 93 9c 7e b5 eb fa Data Ascii: B5+>&wDp})=9ZN)\|^ky@O9#ZWi7(;SL]:_kV?YGjU#cx~8Gq9ZS=TGp`Fm!'":vfa^_}_z{wy@Rj{[iL~
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 07 4d 45 14 52 33 39 a9 7f d6 bf fb c6 9b 4b 29 fd eb ff 00 bc 69 b9 a6 68 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd 00 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd 00 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPMER39K)ih-4RfI3@E&h-4RfI3@E&h-4RfI3@E&h
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 04 84 ed 81 cd 72 77 ae 7e d1 b8 63 e9 5d 35 db ec b5 6f a5 70 fa b5 d0 8b 71 c8 e6 b9 ea bd 4d a9 23 9d f1 a5 e1 64 d9 1f 52 71 55 7c 66 7e c1 a3 69 7a 60 e3 64 61 d8 7f b4 dc 9a 34 98 9b 5a f1 5d b5 b9 c9 85 0f 9b 27 d0 55 2f 1e 5c 0b bf 11 3e ce 55 38 15 82 d9 b3 ae da a4 56 d1 63 da a8 45 75 d6 5d 33 cd 73 9a 5c 61 55 33 d4 d7 4b 6a 0f 1c e4 57 3b dc db a1 af 65 1e 58 13 d3 15 e3 7f b4 5e a6 5a 4d 36 c1 5b e5 52 59 85 7b 14 04 aa 67 9a f9 c3 e3 65 e7 da 7c 56 ab 9e 11 71 5b d0 5a 9c f5 9e 87 1a bc e3 34 1c 0a 48 8f cb f8 50 d5 b3 47 6a f8 45 07 d2 Data Ascii: E-PIE-PIE-PIE-PIE-PIE-PIE-PIE-Prw~c]5opqM#dRqU\|f~iz`da4Z]'U/\>U8VcEu]3s\aU3KjW;eX^ZM6[RY{ge\|Vq[Z4HPGjE
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 0e be 8a 4c d1 48 c8 e4 e6 ff 00 5c ff 00 ef 1a 65 3a 6f f5 cf fe f1 a6 66 83 51 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 Data Ascii: Fh(4f(3Fh(4f(3Fh(4f(3Fh(4f(LH\e:ofQh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 5a 00 ec a8 a2 8a 0c 8e 3e 73 fb e9 3f de 34 cc d3 a7 ff 00 5d 27 fb c6 99 4c Data Ascii: sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\JZ>s?4]'L
2024-10-07 21:30:29 UTC	4096	IN	Data Raw: c8 55 88 b4 e2 e4 05 69 1c fa 9e 00 ad ab 1b 48 c0 c8 42 ec 0f 24 8c 8f a0 ad 9b 7b 68 cb b2 9f de 3e 37 03 8f 94 7d 47 ad 69 0c 1d 2d ec 65 57 3b c5 5b e3 7a 19 5a 5e 8f e4 95 0b 19 79 4f 3b c8 e9 5d 8f 86 f4 13 ae 6a 89 63 6d 29 88 95 2d 23 7a 01 dc 55 ad 23 c3 ba ce a7 04 0d 63 69 28 56 3c cc fc 28 19 c7 5a f5 4f 05 f8 55 7c 3d 69 23 cc e2 5b e9 f1 e6 48 07 0a 3b 28 f6 ac 31 58 ba 58 7a 6e 34 fe 23 2c 3e 17 11 8d aa a7 5a ee 3e 64 1e 14 f0 b5 b7 86 ad a4 8a da 59 27 69 30 59 df a9 af 20 f8 e1 e1 51 65 ab c7 ad da c7 88 6e f0 b3 e0 74 90 77 fc 6b e8 19 3a d6 17 8c 34 88 f5 ef 0e de 58 ca a3 32 21 2b c7 46 1d 0d 7c cc aa ca a4 f9 a6 f5 3e cf 07 18 61 da 50 5a 19 9f 0b b5 23 a9 f8 2b 4e 91 ff 00 d6 46 9e 53 7a fc bc 7f 4a eb 2b c7 7e 01 ea 2d 17 f6 96 91 Data Ascii: UiHB${h>7}Gi-eW;[zZ^yO;]jcm)-#zU#ci(V<(ZOU\|=i#[H;(1XXzn4#,>Z>dY'i0Y Qentwk:4X2!+F\|>aPZ#+NFSzJ+~-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49744	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:29 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vsl6d7rgkFzyLwn&MD=stGBhGMU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-07 21:30:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a4296fd5-ee8d-41fd-9803-2ff846f44c37 MS-RequestId: dc6641c7-583e-4eb1-85eb-b14b1bd2181f MS-CV: 9nQ0lRlo70G/2nf7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 07 Oct 2024 21:30:29 GMT Connection: close Content-Length: 24490
2024-10-07 21:30:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-07 21:30:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49745	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:30 UTC	427	OUT	GET /media/dating/striptease2/images/casual_2/1.jpg HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:30 UTC	868	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 21:30:31 GMT Content-Type: image/jpeg Content-Length: 69020 Connection: close ETag: "29d4b3a7272689e578c5f6dd5ecc8ace" Last-Modified: Thu, 01 Aug 2024 07:19:47 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: af968cfc53e5d4d46c2a7314ea3774fe010d1d1a8defca6495a09901b4f201c0 X-Amz-Request-Id: 17FC4901E4F745DD X-Content-Type-Options: nosniff X-Ratelimit-Limit: 336 X-Ratelimit-Remaining: 336 X-Xss-Protection: 1; mode=block x-amz-meta-mc-attrs: atime:1720014410#312176943/gid:0/gname:root/mode:33152/mtime:1702499647#20491135/uid:0/uname:root x-amz-meta-mm-source-mtime: 2023-12-13T20:34:07.020491135Z Expires: Tue, 07 Oct 2025 21:30:31 GMT Cache-Control: max-age=31536000 Cache-Control: no-transform Accept-Ranges: bytes
2024-10-07 21:30:30 UTC	3228	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 ff c0 00 11 08 04 39 07 81 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF,,C%# , #&')*)-0-(0%()(C(((((((((((((((((((((((((((((((((((((((((((((((((((9"}!1AQa"q2
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 28 ac e3 a8 30 72 ce a3 8e de 95 6b 6c af 23 21 42 7a 63 da b3 6e ed 25 f9 c6 d3 cf 39 a5 64 3d 7a 1b 3a 47 89 5e de 65 31 16 4f 6c f0 6b aa 7d 7e 47 89 6e 2d 9f 63 03 c8 c7 7f 5a f2 ad 86 26 3b b3 ba b7 b4 3b e2 ae 12 46 f6 20 f4 a9 71 b0 45 f4 67 b5 78 1f e2 d6 a3 a4 5c 2c 57 8e 6f 2c b1 f3 46 ed 96 5f 70 6b e8 7f 0c f8 8f 4e f1 1d 82 dd 69 b3 ab 82 06 e4 cf cc a7 d0 8a f8 be 5d 3d 1c ac f6 bf 29 ea 54 1c 1f c2 ba ff 00 86 3a e4 fa 3f 89 6d f7 4e d1 c5 21 f2 c3 8e 36 93 d0 30 e8 46 69 c6 5d 01 c6 db 1f 5c d1 59 7a 2e a6 6f 63 68 ee 13 c9 bc 8f ef c7 9e 0f a3 2f a8 35 a7 5a 92 2d 14 94 50 31 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 a4 a2 80 16 8a 4a 28 01 68 Data Ascii: (0rkl#!Bzcn%9d=z:G^e1Olk}~Gn-cZ&;;F qEgx\,Wo,F_pkNi]=)T:?mN!60Fi]\Yz.och/5Z-P1hJ(hJ(hJ(hJ(hJ(hJ(h
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 49 45 00 2e 68 cd 25 14 00 b9 a3 34 94 50 02 e6 b0 7c 5f b8 69 37 6e a3 38 84 e3 b5 6e d6 4f 89 d0 3e 8f 76 a7 f8 a2 60 3f 2a 00 f9 0b e2 40 67 d4 36 39 19 08 00 23 a5 79 fd ec 80 06 45 ef 5d df 8e dd ae 6f 19 89 04 e0 8c 8f 6a f3 eb a2 0c a0 9f 5c 56 28 b9 9e d3 f0 a6 0d 9a 24 72 63 1d 6b 6b 5b 81 6e cb 89 7e 6e e0 53 3e 15 db ee f0 a5 bb 81 cf 7a db be b6 fd e7 2b d6 b0 e6 69 dd 1d 6a 09 c5 1c 16 a5 a5 45 70 49 30 00 71 d5 78 cd 63 4d a4 86 60 88 a3 68 39 c7 bd 7a 0d f5 b3 88 8f cb c1 1d ab 02 50 11 8e 7e b5 5e d1 b1 7b 24 87 78 63 4c 58 a7 8f 80 70 0b 57 ac f8 4d 24 8e 3c 05 3f 31 c8 c5 72 5a 4c 16 5a 46 8c ba 96 b3 34 76 f1 4e 00 42 e7 18 15 e9 1e 10 9e 1f b3 79 e5 a3 78 02 17 59 01 ca ed c7 5c d4 38 b6 ee cd 13 51 56 34 2e ac e3 bb b5 f9 d7 92 30 47 Data Ascii: IE.h%4P\|_i7n8nO>v`?*@g69#yE]oj\V($rckk[n~nS>z+ijEpI0qxcM`h9zP~^{$xcLXpWM$<?1rZLZF4vNByxY\8QV4.0G
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 5a 00 df a2 8a 29 19 18 32 1f de 37 d4 d3 73 4b 27 fa c6 fa 9a 6d 33 51 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 Data Ascii: sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\JZ)27sK'm3QsFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sF
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: ad 1d 42 35 f2 0f cc 2b 3e 1b 26 81 77 44 70 7d 29 d2 dc b8 8c a1 19 3d 39 aa 8c 9a 5a 99 4e 29 bb a3 c9 7c 5e cd f6 c7 19 c8 15 cb 6b b2 79 da 40 85 4f 39 e6 bd 23 5a d1 cd cd c4 8e cb 9c fb 57 01 ab 69 37 11 ca e8 87 28 3b 53 4c ae 5d 0f 3a 9c 08 5f 6b 0e fc 56 95 cd d2 b7 87 16 3f 59 b0 47 af 14 6a f6 8b b8 e4 90 e9 d8 d6 55 e3 85 b5 b6 8b 23 05 cb 63 be 78 ad 13 b9 84 91 b7 a2 db 7e e6 e1 dc fc b1 ae 06 38 c6 47 ff 00 aa b2 b5 71 fb d8 39 1b 82 0f eb 5a fa 53 ff 00 c4 a6 fb 83 9e 09 3d eb 03 54 9c 47 70 18 60 9d a0 0f d6 b4 46 6d 0e bf b8 de 21 84 9d cb b3 27 f3 e2 9f 22 18 a3 8d 3a 17 03 8a 76 9f 66 61 80 5e 5f 7d d1 c8 5f ef 7a 0a 8e 7b a1 77 79 14 bb 40 52 7f ef 9f 6a 00 f5 ef 87 fa ae 9f 7b a6 5b 69 fa c4 11 4c b0 b6 d5 0e b9 ca 93 9c 7e b5 eb fa Data Ascii: B5+>&wDp})=9ZN)\|^ky@O9#ZWi7(;SL]:_kV?YGjU#cx~8Gq9ZS=TGp`Fm!'":vfa^_}_z{wy@Rj{[iL~
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 07 4d 45 14 52 33 39 a9 7f d6 bf fb c6 9b 4b 29 fd eb ff 00 bc 69 b9 a6 68 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd 00 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd 00 2d 14 99 a3 34 00 b4 52 66 8c d0 02 d1 49 9a 33 40 0b 45 26 68 cd Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPMER39K)ih-4RfI3@E&h-4RfI3@E&h-4RfI3@E&h
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 02 d1 49 45 00 2d 14 94 50 04 84 ed 81 cd 72 77 ae 7e d1 b8 63 e9 5d 35 db ec b5 6f a5 70 fa b5 d0 8b 71 c8 e6 b9 ea bd 4d a9 23 9d f1 a5 e1 64 d9 1f 52 71 55 7c 66 7e c1 a3 69 7a 60 e3 64 61 d8 7f b4 dc 9a 34 98 9b 5a f1 5d b5 b9 c9 85 0f 9b 27 d0 55 2f 1e 5c 0b bf 11 3e ce 55 38 15 82 d9 b3 ae da a4 56 d1 63 da a8 45 75 d6 5d 33 cd 73 9a 5c 61 55 33 d4 d7 4b 6a 0f 1c e4 57 3b dc db a1 af 65 1e 58 13 d3 15 e3 7f b4 5e a6 5a 4d 36 c1 5b e5 52 59 85 7b 14 04 aa 67 9a f9 c3 e3 65 e7 da 7c 56 ab 9e 11 71 5b d0 5a 9c f5 9e 87 1a bc e3 34 1c 0a 48 8f cb f8 50 d5 b3 47 6a f8 45 07 d2 Data Ascii: E-PIE-PIE-PIE-PIE-PIE-PIE-PIE-Prw~c]5opqM#dRqU\|f~iz`da4Z]'U/\>U8VcEu]3s\aU3KjW;eX^ZM6[RY{ge\|Vq[Z4HPGjE
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 02 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 cd 19 a0 0e be 8a 4c d1 48 c8 e4 e6 ff 00 5c ff 00 ef 1a 65 3a 6f f5 cf fe f1 a6 66 83 51 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 66 80 16 8a 4c d1 9a 00 5a 29 33 46 68 01 68 a4 cd 19 a0 05 a2 93 34 Data Ascii: Fh(4f(3Fh(4f(3Fh(4f(3Fh(4f(LH\e:ofQh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4fLZ)3Fhh4
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 28 01 73 46 69 28 a0 05 cd 19 a4 a2 80 17 34 66 92 8a 00 5c d1 9a 4a 5a 00 ec a8 a2 8a 0c 8e 3e 73 fb e9 3f de 34 cc d3 a7 ff 00 5d 27 fb c6 99 4c Data Ascii: sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\J(sFi(4f\JZ>s?4]'L
2024-10-07 21:30:30 UTC	4096	IN	Data Raw: c8 55 88 b4 e2 e4 05 69 1c fa 9e 00 ad ab 1b 48 c0 c8 42 ec 0f 24 8c 8f a0 ad 9b 7b 68 cb b2 9f de 3e 37 03 8f 94 7d 47 ad 69 0c 1d 2d ec 65 57 3b c5 5b e3 7a 19 5a 5e 8f e4 95 0b 19 79 4f 3b c8 e9 5d 8f 86 f4 13 ae 6a 89 63 6d 29 88 95 2d 23 7a 01 dc 55 ad 23 c3 ba ce a7 04 0d 63 69 28 56 3c cc fc 28 19 c7 5a f5 4f 05 f8 55 7c 3d 69 23 cc e2 5b e9 f1 e6 48 07 0a 3b 28 f6 ac 31 58 ba 58 7a 6e 34 fe 23 2c 3e 17 11 8d aa a7 5a ee 3e 64 1e 14 f0 b5 b7 86 ad a4 8a da 59 27 69 30 59 df a9 af 20 f8 e1 e1 51 65 ab c7 ad da c7 88 6e f0 b3 e0 74 90 77 fc 6b e8 19 3a d6 17 8c 34 88 f5 ef 0e de 58 ca a3 32 21 2b c7 46 1d 0d 7c cc aa ca a4 f9 a6 f5 3e cf 07 18 61 da 50 5a 19 9f 0b b5 23 a9 f8 2b 4e 91 ff 00 d6 46 9e 53 7a fc bc 7f 4a eb 2b c7 7e 01 ea 2d 17 f6 96 91 Data Ascii: UiHB${h>7}Gi-eW;[zZ^yO;]jcm)-#zU#ci(V<(ZOU\|=i#[H;(1XXzn4#,>Z>dY'i0Y Qentwk:4X2!+F\|>aPZ#+NFSzJ+~-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49752	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:40 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 21:30:40 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=155702 Date: Mon, 07 Oct 2024 21:30:40 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 21:30:41 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=155637 Date: Mon, 07 Oct 2024 21:30:41 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-07 21:30:41 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49754	185.155.186.18	443	2296	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:30:55 UTC	649	OUT	GET /favicon.ico HTTP/1.1 Host: flirtfantasy.one Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=t1~h3kot5fviqggcvkjcizogbcq
2024-10-07 21:30:56 UTC	131	IN	HTTP/1.1 204 No Content Server: openresty Date: Mon, 07 Oct 2024 21:30:56 GMT Connection: close Cache-Control: no-transform

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.17	49755	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:31:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4808 Host: login.live.com
2024-10-07 21:31:02 UTC	4808	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-07 21:31:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 07 Oct 2024 21:30:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BL2 x-ms-request-id: 71992d60-9e45-411b-af7a-d9ba44926e0a PPServer: PPV: 30 H: BL02EPF0002790F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 07 Oct 2024 21:31:02 GMT Connection: close Content-Length: 11177
2024-10-07 21:31:02 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.17	49756	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:31:02 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-10-07 21:31:03 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: B63FF159D71545A2A956B5833BC1B832 Ref B: EWR311000102009 Ref C: 2024-10-07T21:31:03Z Date: Mon, 07 Oct 2024 21:31:03 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49757	2.23.209.179	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:31:03 UTC	2579	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAde7GwOL8Egr0r5UswbJ5wRdmT7SgLMdQndTk4qXfrEdhwfTcwHLdHFU8z2svTOE%2Brn6Al36I/MWudCkBN8W4F/41tW72QaonHoN0/q8wLIGgkVzTJgUj6DZ/idrftXenWFI/tzDehu5hIToGokBltXTbeD56uUl5MFxivtNp5rQy3VMBb8YNmGwF5zMdCbDa3PY5V2iJWPO0B2VcMU036cyylVMCxVYSfJHEuxnvedx57Yzj/ZnA4nErzm7EUNiKnvr7DberM7Kx%2BExzMJIfh0mUm0r6sljKt89FHWSrUFjytmT/U9I1vLnYjgu8LE4uzNiZH/sRD4JMhJhpD2Cj2EQZgAAEN02P8cD8lbpFvPVOwF3I%2BywAVeENeSeHknI520OCoYeim7PGL/lYDvFBFJ5xjEKjjc2mYznqVcNhRty5waTnjJKR2M1xeuCB8/0JwH9wY5LlOAXP2kbwj2X9auZfWNKplHBQ0ozJhuPEri3TgXcOpVAmcju99iSmS6T6pRB7AssH1XNxb4QUVCHMlW1By089IeqyXCSefrn%2BEFZNQPCAvpa7eI0JvslciVGMhpdS3oDPQtfg8BbFcAfwx3OA92zv2Mws9y8nXxoctEd7cw/xYwGsSIqB20xOi/x0LKmgM6q170i9k06Tupq0fUdK9dag2SlzlUN5FVuR/cZCwiFDT3J27OlFHOfjevVTw7%2Bzgyo5ilOOzPxL%2B7MQXToi0%2BRi/kd/ynxy4xtFff2WytDF0iG%2BsnERvwKoWWfYC%2Bkz4Qahdlu4EKxG1/4sum9cYywIaQGm5mZfsQf9JndC5arsyH2G4vkffaSaztG8nxjsfMH%2Bk3Ubmnfpdn%2BkOgv4wuPu3H0of2R4ad6O1tYuvDOMwqRrY2Lpv5XhdL3QXgjNVnvjuHyOuicrx3p5TK8bOTV0K9pBe5Tb/zvhHQ [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1728336660 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 179D7B1C6CC64DDBBC9118DC08018856 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-10-07 21:31:04 UTC	1147	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 670453184d4e4165ad839c37eb317071 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Mon, 07 Oct 2024 21:31:04 GMT Connection: close Set-Cookie: _EDGE_S=SID=292EE82983E16E081341FD3882AD6F57&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Sat, 01-Nov-2025 21:31:04 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=292EE82983E16E081341FD3882AD6F57; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.36d01702.1728336664.81ea488
2024-10-07 21:31:04 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49758	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:31:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vsl6d7rgkFzyLwn&MD=stGBhGMU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-07 21:31:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: bcd17763-c9e4-4d0c-8f0c-29531d75f414 MS-RequestId: 40a4ec44-6fbe-4f90-9c42-a6d00d76165a MS-CV: yU38d1vM8Emv0hNY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 07 Oct 2024 21:31:06 GMT Connection: close Content-Length: 30005
2024-10-07 21:31:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-07 21:31:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	17:30:18
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	17:30:18
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1976,i,11710375692768624198,1828441770441939256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:30:19
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://addicted.live"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq	HTTP Parser: No favicon
Source: https://flirtfantasy.one/?u=y098rk1&o=2n0kmbq	HTTP Parser: No favicon

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://addicted.live

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Windows Analysis Report
http://addicted.live