Edit tour

Windows Analysis Report
https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344

Overview

General Information

Sample URL:	https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=34
Analysis ID:	1327431
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64native

chrome.exe (PID: 5768 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 6332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,9976906793806323828,1916143722008436818,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)

chrome.exe (PID: 3316 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344 MD5: 464953824E644F10FFDC9E093FD18F94)

cleanup

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 17 Oct 2023 16:17:57 GMTContent-Type: text/html;charset=utf-8Content-Length: 580Connection: closeX-DataDome: protectedAccept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-MemoryCharset: utf-8Cache-Control: max-age=0, private, no-cache, no-store, must-revalidatePragma: no-cacheX-DataDome-CID: AHrlqAAAAAMAh4D1fahKeeEAZoGRIA==Set-Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc; Max-Age=31536000; Domain=.iiasd.org; Path=/; Secure; SameSite=Lax

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51707
Source: unknown	Network traffic detected: HTTP traffic on port 49544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61194
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56243
Source: unknown	Network traffic detected: HTTP traffic on port 56646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58100
Source: unknown	Network traffic detected: HTTP traffic on port 51124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56646
Source: unknown	Network traffic detected: HTTP traffic on port 62585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown	Network traffic detected: HTTP traffic on port 59740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59287
Source: unknown	Network traffic detected: HTTP traffic on port 52443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61232
Source: unknown	Network traffic detected: HTTP traffic on port 62187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown	Network traffic detected: HTTP traffic on port 58411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51683
Source: unknown	Network traffic detected: HTTP traffic on port 63593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54475
Source: unknown	Network traffic detected: HTTP traffic on port 61194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 49315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49315
Source: unknown	Network traffic detected: HTTP traffic on port 59287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59740
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62585
Source: unknown	Network traffic detected: HTTP traffic on port 51683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54475 -> 443

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=YES+srp.gws-20210811-0-RC2.en+FX+979; AEC=Ad49MVFf9Dv7B6egeOgj1KRs9zEJFl7xTeHKFuDQ4w-0aMcEh1ZbUV4GCw; NID=511=Fb9m6orBsCk8g8okbxd0bNA5e4gEdvsO4EJi3xyY6m7-87MqmFZCjWOfTMjEV-QOLAUoCOhPhFMtvtTgGBvdcCeiVLC5sWNyO_yH0057J1bn8o-spwJb2f-JESUqLUGpJTjHkEs42-DVHUt3379gqE-vONgrrWk5I_jFZltuOMiAhKI4gkjoN1x_

Source: unknown	TCP traffic detected without corresponding DNS query: 52.143.87.28
Source: unknown	TCP traffic detected without corresponding DNS query: 52.143.87.28
Source: unknown	TCP traffic detected without corresponding DNS query: 52.143.87.28
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: classification engine

Classification label: clean0.win@26/0@10/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,9976906793806323828,1916143722008436818,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,9976906793806323828,1916143722008436818,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Network Service Scanning	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://static.captcha-delivery.com/common/fonts/roboto/font-face.css	0%	Avira URL Cloud	safe
https://458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/common/fonts/roboto/roboto.woff2	0%	Avira URL Cloud	safe
https://ct.captcha-delivery.com/c.js	0%	Avira URL Cloud	safe
https://members.iiasd.org/favicon.ico	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
api-alb-us-utah-1.datadome.co	34.107.158.74	true	false	high
ct.captcha-delivery.com	13.226.228.36	true	false	unknown
d2lhhyweudwf3e.cloudfront.net	99.84.203.122	true	false	high
accounts.google.com	142.250.72.237	true	false	high
saas.ymaws.com	35.173.82.140	true	false	unknown
www.google.com	142.250.68.36	true	false	high
api-us-west-1.captcha-delivery.com	52.52.48.41	true	false	unknown
js.datadome.co	18.154.206.7	true	false	high
clients.l.google.com	142.250.68.14	true	false	high
baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com	34.237.251.168	true	false	high
clients2.google.com	unknown	unknown	false	high
static.captcha-delivery.com	unknown	unknown	false	unknown
geo.captcha-delivery.com	unknown	unknown	false	unknown
api-js.datadome.co	unknown	unknown	false	high
458rl1jp.r.us-east-1.awstrack.me	unknown	unknown	false	unknown
members.iiasd.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static.captcha-delivery.com/common/fonts/roboto/roboto.woff2	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://api-js.datadome.co/js/	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://js.datadome.co/tags.js	false		high
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css	false	Avira URL Cloud: safe	unknown
https://458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344	false	Avira URL Cloud: safe	unknown
https://static.captcha-delivery.com/captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139	false	Avira URL Cloud: safe	unknown
https://ct.captcha-delivery.com/c.js	false	Avira URL Cloud: safe	unknown
https://members.iiasd.org/surveys/?id=Convention_2023	false		unknown
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAh4D1fahKeeEAZoGRIA%3D%3D&hash=2CF1354F5D33C04234B753357EE0F0&cid=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc&t=fe&referer=https%3A%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid%3DConvention_2023&s=18464&e=b821de14ea111615f4edf644f2cb6d11e84a187fbd64e97b625c2674325e7e2f	false		unknown
https://members.iiasd.org/surveys/?id=Convention_2023	false		unknown
https://members.iiasd.org/favicon.ico	false	Avira URL Cloud: safe	unknown
https://static.captcha-delivery.com/common/fonts/roboto/font-face.css	false	Avira URL Cloud: safe	unknown
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAh4D1fahKeeEAZoGRIA%3D%3D&hash=2CF1354F5D33C04234B753357EE0F0&cid=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc&t=fe&referer=https%3A%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid%3DConvention_2023&s=18464&e=b821de14ea111615f4edf644f2cb6d11e84a187fbd64e97b625c2674325e7e2f	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.72.237	accounts.google.com	United States	15169	GOOGLEUS	false
13.226.228.36	ct.captcha-delivery.com	United States	16509	AMAZON-02US	false
142.250.68.14	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.68.36	www.google.com	United States	15169	GOOGLEUS	false
52.52.48.41	api-us-west-1.captcha-delivery.com	United States	16509	AMAZON-02US	false
99.84.203.122	d2lhhyweudwf3e.cloudfront.net	United States	16509	AMAZON-02US	false
34.237.251.168	baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
34.107.158.74	api-alb-us-utah-1.datadome.co	United States	15169	GOOGLEUS	false
18.154.206.7	js.datadome.co	United States	16509	AMAZON-02US	false
35.173.82.140	saas.ymaws.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.11.20

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1327431
Start date and time:	2023-10-17 18:15:51 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@26/0@10/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, CompPkgSrv.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.217.131, 34.104.35.123, 172.217.12.138, 142.250.189.10, 142.250.72.138, 142.250.68.74, 142.250.217.138, 172.217.14.106, 142.251.40.42, 142.250.72.170, 142.250.68.42, 142.250.176.10, 142.250.72.234, 172.217.14.74, 142.250.188.234, 142.250.68.10, 142.250.68.106, 142.250.188.227, 142.250.72.131
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, content-autofill.googleapis.com, update.googleapis.com, clientservices.googleapis.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344

Total Packets: 375
• 1900 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2023 18:17:46.652832985 CEST	50036	443	192.168.11.20	52.143.87.28
Oct 17, 2023 18:17:46.654244900 CEST	50036	443	192.168.11.20	52.143.87.28
Oct 17, 2023 18:17:46.852943897 CEST	443	50036	52.143.87.28	192.168.11.20
Oct 17, 2023 18:17:46.853019953 CEST	443	50036	52.143.87.28	192.168.11.20
Oct 17, 2023 18:17:46.853209019 CEST	50036	443	192.168.11.20	52.143.87.28
Oct 17, 2023 18:17:53.850123882 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:53.850198030 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:53.850202084 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:53.850274086 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:53.850425005 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:53.850450039 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:53.850893021 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:53.850956917 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:53.850959063 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:53.850994110 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.273488998 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.273875952 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.273894072 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.275898933 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.276145935 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.293395996 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.293494940 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.293540955 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.293646097 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.293823957 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.293842077 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.294341087 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.294552088 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.295283079 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.295456886 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.297863960 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.297925949 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.297969103 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.298199892 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.336230993 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.344926119 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.344927073 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.345009089 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.345038891 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.391813040 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.391812086 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.660891056 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.661686897 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.661900997 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.662015915 CEST	49544	443	192.168.11.20	142.250.68.14
Oct 17, 2023 18:17:54.662096977 CEST	443	49544	142.250.68.14	192.168.11.20
Oct 17, 2023 18:17:54.682970047 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.683835983 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:54.684112072 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.684649944 CEST	56646	443	192.168.11.20	142.250.72.237
Oct 17, 2023 18:17:54.684719086 CEST	443	56646	142.250.72.237	192.168.11.20
Oct 17, 2023 18:17:55.858243942 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.858315945 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:55.858474970 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.858488083 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.858566046 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:55.858685017 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.858743906 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:55.858758926 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.859385014 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:55.859447956 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.644162893 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.644545078 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.644690037 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.644706964 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.644957066 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.644979954 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.646061897 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.646275997 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.646548033 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.646830082 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.647524118 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.647524118 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.647568941 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.647721052 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.647814989 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.648065090 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.693486929 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.693486929 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.693571091 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.693572044 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.741225958 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.741264105 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.883009911 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.883322954 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.883599043 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.883765936 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.883765936 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:56.883821011 CEST	443	52443	34.237.251.168	192.168.11.20
Oct 17, 2023 18:17:56.883974075 CEST	52443	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:17:57.125119925 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.125210047 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.125413895 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.125603914 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.125638962 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.863049030 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.863456011 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.863512039 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.867616892 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.867845058 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.869004965 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.869004965 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.869106054 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.869539022 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.920245886 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:57.920331955 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:57.967416048 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:58.108165979 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:58.108544111 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:58.108743906 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:58.109260082 CEST	54357	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:17:58.109353065 CEST	443	54357	35.173.82.140	192.168.11.20
Oct 17, 2023 18:17:58.308568954 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.308635950 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.308835983 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.308983088 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.309020042 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.631980896 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632061005 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632095098 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:58.632179022 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:58.632308960 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632322073 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632508993 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632512093 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:58.632548094 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:58.632570982 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:58.668983936 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.669317961 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.669337034 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.670510054 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.670754910 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.672246933 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.672343969 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.672357082 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.672375917 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.718641043 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:58.718683958 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:58.765666962 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.004584074 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.004709959 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.004740953 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.004890919 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.004890919 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.005012035 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.005062103 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.005158901 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.005158901 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.005317926 CEST	51707	443	192.168.11.20	13.226.228.36
Oct 17, 2023 18:17:59.005403042 CEST	443	51707	13.226.228.36	192.168.11.20
Oct 17, 2023 18:17:59.050626993 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.051016092 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.051069021 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.054617882 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.054933071 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.054968119 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.055190086 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.055386066 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.056400061 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.056684971 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.057923079 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.058199883 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.059288025 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.059504986 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.109462976 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.109472036 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.109549999 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.109560013 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:17:59.155472994 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.155472040 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:17:59.179239035 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.179362059 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.179593086 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.179742098 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.179788113 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.561006069 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.561431885 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.561450005 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.562938929 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.563173056 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.564810991 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.564810991 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.564860106 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.565037966 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.607012033 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.607090950 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.657754898 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915148973 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915318012 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915345907 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915447950 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915498972 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915528059 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915539980 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915667057 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915667057 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915667057 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915738106 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915774107 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.915925026 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:17:59.915977001 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:17:59.916263103 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:18:00.091068983 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091172934 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091173887 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091242075 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091284990 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091285944 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091347933 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091464043 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091471910 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091514111 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091530085 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091589928 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091629028 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091665030 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.091700077 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.091922045 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.091976881 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.092168093 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.092175007 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.092267036 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.092315912 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.092354059 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.092489004 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.092600107 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.092633009 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.094249010 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:18:00.094357014 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:18:00.094412088 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:18:00.094456911 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:18:00.094506025 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:18:00.094630003 CEST	62187	443	192.168.11.20	52.52.48.41
Oct 17, 2023 18:18:00.094649076 CEST	443	62187	52.52.48.41	192.168.11.20
Oct 17, 2023 18:18:00.517529964 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.517900944 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.517925024 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.520626068 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.520817995 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.522429943 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.522527933 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.522542000 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.522671938 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.548490047 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.548821926 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.548830032 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.549393892 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.549706936 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.549717903 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.549870014 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.550040007 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.550312996 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.550383091 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.550496101 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.550826073 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.550988913 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.552666903 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.552825928 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.554697037 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.554791927 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.555181980 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.555191994 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.555196047 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.555207014 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.556725025 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.556726933 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.556917906 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.556989908 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.557360888 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.557420015 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.557435036 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.558388948 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.558828115 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.563875914 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.563962936 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.595736027 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.595777988 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:00.595837116 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.595844984 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.600142002 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.610717058 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.610717058 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.610718012 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.610750914 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.610754013 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.640633106 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:00.640633106 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.656582117 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.657902956 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.843844891 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.843945026 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.843960047 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.844105959 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.844167948 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.844189882 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.844331026 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.844396114 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.844584942 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.844749928 CEST	56243	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.844814062 CEST	443	56243	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.849200010 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.849564075 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.849822044 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.850029945 CEST	59287	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.850079060 CEST	443	59287	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.853209019 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:00.900252104 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:00.905424118 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.905608892 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:00.905822039 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.905998945 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:00.906059980 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024445057 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024590969 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024621010 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024681091 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024755955 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024781942 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.024889946 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.024954081 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.024972916 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.025032997 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.025239944 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.025264978 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.028412104 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.028923988 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.029011011 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.042541981 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042660952 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042681932 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042776108 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042812109 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042831898 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.042856932 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.042856932 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.042907953 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.043046951 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.043047905 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.043309927 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.047133923 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.047372103 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.047384977 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.047466993 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.047502041 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.047514915 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.047629118 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.047920942 CEST	60546	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.047990084 CEST	443	60546	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.050571918 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.050687075 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.050889015 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.051028967 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.051070929 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.069719076 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.069787025 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.069935083 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.070110083 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.070110083 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.070178032 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.070527077 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.205351114 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.205492973 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.205584049 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.205754042 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.205754995 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.205821991 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.205895901 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.206135035 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.238018990 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.238159895 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.238245010 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.238420010 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.238483906 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.238620996 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.238620996 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.238795996 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.262614012 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.262985945 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.263072014 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.267225981 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.267460108 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.267707109 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.267776012 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.267827034 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.267839909 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.268157959 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.268158913 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.268158913 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.268184900 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.268234015 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.268522024 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.296138048 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.296263933 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.296335936 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.296400070 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.296435118 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.296631098 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.296632051 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.296818972 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.317399979 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.317488909 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.364938021 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.377473116 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.377590895 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.377674103 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.377896070 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.377896070 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.377964020 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.378264904 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.401133060 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.401547909 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.401563883 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.402262926 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.402753115 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.402818918 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.402895927 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.404098034 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.404122114 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.404323101 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.404323101 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.404511929 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.404512882 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.404530048 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.404694080 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.404711962 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.425570011 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.425622940 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.425818920 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.425818920 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.425856113 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.426003933 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.426189899 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.443583965 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.451695919 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.451787949 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.452058077 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.452059031 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.452125072 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.452276945 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.452277899 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.452466965 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.472819090 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.472923040 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.473237991 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.473237991 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.473237991 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.473237991 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.473331928 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.473623991 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.491579056 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.491676092 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.491851091 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.491851091 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.491851091 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.491928101 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.491971970 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.492219925 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.492219925 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.511818886 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.511941910 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.512027979 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.512245893 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.512310982 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.512453079 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.512622118 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.532812119 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.532931089 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.533010960 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.533183098 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.533363104 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.533363104 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.533410072 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.533600092 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.548098087 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.548216105 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.548389912 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.548389912 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.548474073 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.548499107 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.548732996 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.563077927 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.563195944 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.563313961 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.563313961 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.563391924 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.563548088 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.563548088 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.563715935 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576380968 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.576478958 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.576647043 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576647043 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576647043 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576724052 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.576766968 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576766968 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.576983929 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.580554008 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.580758095 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.580821037 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.580862999 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.581046104 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.581048012 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.581048012 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.581110954 CEST	443	59740	18.154.206.7	192.168.11.20
Oct 17, 2023 18:18:01.581257105 CEST	59740	443	192.168.11.20	18.154.206.7
Oct 17, 2023 18:18:01.614769936 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.614928961 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.614957094 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615045071 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615070105 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615091085 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615158081 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615256071 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615295887 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615295887 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615447044 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.615551949 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615688086 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615758896 CEST	62585	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.615833998 CEST	443	62585	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.646858931 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:01.646990061 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:01.647294044 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:01.647538900 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:01.647603989 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:01.671657085 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:01.671782970 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:01.672194958 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:01.672362089 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:01.672405005 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:01.744352102 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.767657995 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.767694950 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.767764091 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.767893076 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.767893076 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.767976046 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.768003941 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.768026114 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.768237114 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.786351919 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.786457062 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.786598921 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.786600113 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.786674023 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.786716938 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.786778927 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:01.786884069 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.786946058 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.787045002 CEST	54475	443	192.168.11.20	99.84.203.122
Oct 17, 2023 18:18:01.787118912 CEST	443	54475	99.84.203.122	192.168.11.20
Oct 17, 2023 18:18:02.041511059 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.042085886 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.042124987 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.043833971 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.044078112 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.044478893 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.044480085 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.044480085 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.044523954 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.044593096 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.044717073 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.099610090 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.099678993 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.146481037 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.373347044 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.373812914 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.373878956 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.375777960 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.376265049 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.376363039 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.376416922 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.376749992 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.413218975 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.413913012 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.414170027 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.414305925 CEST	49829	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.414381981 CEST	443	49829	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.417051077 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.425945997 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.460253954 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.611290932 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.611686945 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.611929893 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.612097979 CEST	51683	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:02.612185001 CEST	443	51683	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:02.618052006 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.618500948 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.618740082 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.618968964 CEST	61232	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.619029999 CEST	443	61232	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.621000051 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.621149063 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:02.621437073 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.621548891 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:02.621589899 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.100167990 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.100621939 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.100642920 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.101385117 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.101866961 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.102001905 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.102016926 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.102067947 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.156760931 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.613657951 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.614023924 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:03.614191055 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.614686966 CEST	63593	443	192.168.11.20	35.173.82.140
Oct 17, 2023 18:18:03.614751101 CEST	443	63593	35.173.82.140	192.168.11.20
Oct 17, 2023 18:18:09.019331932 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:09.019589901 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:09.019768000 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:09.036127090 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:09.036401033 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:09.036587954 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:09.836473942 CEST	52821	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:09.836502075 CEST	51124	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:09.836558104 CEST	443	52821	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:09.836585045 CEST	443	51124	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:14.282267094 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.282427073 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.282582045 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.282788992 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.282840967 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.656757116 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.657210112 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.657278061 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.659396887 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.659815073 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.659888983 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.659888983 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.659931898 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.659967899 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:14.659995079 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.660077095 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.660361052 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:14.713929892 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.026534081 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.027007103 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.027192116 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.027458906 CEST	58100	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.027558088 CEST	443	58100	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.063771009 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.063911915 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.064122915 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.064344883 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.064415932 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.438865900 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.439340115 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.439409971 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.441800117 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.442315102 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.442315102 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.442791939 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.494977951 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.809813976 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.810203075 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:15.810353994 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.810488939 CEST	58411	443	192.168.11.20	34.107.158.74
Oct 17, 2023 18:18:15.810561895 CEST	443	58411	34.107.158.74	192.168.11.20
Oct 17, 2023 18:18:27.436636925 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:18:27.436707020 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:18:27.436954021 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:18:31.721935987 CEST	54328	443	192.168.11.20	34.237.251.168
Oct 17, 2023 18:18:31.722054958 CEST	443	54328	34.237.251.168	192.168.11.20
Oct 17, 2023 18:18:58.529119968 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529237032 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.529289961 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529361010 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.529412031 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529553890 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529762030 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529762030 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.529844999 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.529881001 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.931622028 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.931622982 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.932017088 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.932034969 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.932110071 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.932126999 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.932657003 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.932725906 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.933165073 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.933293104 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.933357954 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.933490038 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:18:58.981193066 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:18:58.981194019 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:19:08.906354904 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:19:08.906620026 CEST	443	61194	142.250.68.36	192.168.11.20
Oct 17, 2023 18:19:08.906867027 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:19:08.911005974 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:19:08.911216021 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:19:08.911355972 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:19:12.170026064 CEST	49315	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:19:12.170026064 CEST	61194	443	192.168.11.20	142.250.68.36
Oct 17, 2023 18:19:12.170042038 CEST	443	49315	142.250.68.36	192.168.11.20
Oct 17, 2023 18:19:12.170047045 CEST	443	61194	142.250.68.36	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2023 18:17:53.678301096 CEST	59214	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:53.679518938 CEST	60986	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:53.692922115 CEST	60987	1900	192.168.11.20	239.255.255.250
Oct 17, 2023 18:17:53.845005035 CEST	53	59214	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:53.846555948 CEST	53	60986	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:54.697451115 CEST	60987	1900	192.168.11.20	239.255.255.250
Oct 17, 2023 18:17:55.690026999 CEST	58661	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:55.698765039 CEST	60987	1900	192.168.11.20	239.255.255.250
Oct 17, 2023 18:17:55.857356071 CEST	53	58661	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:56.700004101 CEST	60987	1900	192.168.11.20	239.255.255.250
Oct 17, 2023 18:17:56.886351109 CEST	60494	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:57.124216080 CEST	53	60494	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:58.130177975 CEST	59689	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:58.307789087 CEST	53	59689	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:58.464004993 CEST	51989	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:58.631012917 CEST	53	51989	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:59.010829926 CEST	64026	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:59.178400993 CEST	53	64026	1.1.1.1	192.168.11.20
Oct 17, 2023 18:17:59.923113108 CEST	57116	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:59.923113108 CEST	61982	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:17:59.923386097 CEST	58046	53	192.168.11.20	1.1.1.1
Oct 17, 2023 18:18:00.090050936 CEST	53	57116	1.1.1.1	192.168.11.20
Oct 17, 2023 18:18:00.090177059 CEST	53	58046	1.1.1.1	192.168.11.20
Oct 17, 2023 18:18:00.090322018 CEST	53	61982	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2023 18:17:53.678301096 CEST	192.168.11.20	1.1.1.1	0x8c18	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:53.679518938 CEST	192.168.11.20	1.1.1.1	0xf1d6	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:55.690026999 CEST	192.168.11.20	1.1.1.1	0xa7ba	Standard query (0)	458rl1jp.r.us-east-1.awstrack.me	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:56.886351109 CEST	192.168.11.20	1.1.1.1	0xc9e5	Standard query (0)	members.iiasd.org	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.130177975 CEST	192.168.11.20	1.1.1.1	0xab40	Standard query (0)	ct.captcha-delivery.com	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.464004993 CEST	192.168.11.20	1.1.1.1	0x1b0f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:59.010829926 CEST	192.168.11.20	1.1.1.1	0xfd8b	Standard query (0)	geo.captcha-delivery.com	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:59.923113108 CEST	192.168.11.20	1.1.1.1	0x4fa6	Standard query (0)	api-js.datadome.co	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:59.923113108 CEST	192.168.11.20	1.1.1.1	0x6d23	Standard query (0)	js.datadome.co	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:59.923386097 CEST	192.168.11.20	1.1.1.1	0xfc58	Standard query (0)	static.captcha-delivery.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2023 18:17:53.845005035 CEST	1.1.1.1	192.168.11.20	0x8c18	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:53.845005035 CEST	1.1.1.1	192.168.11.20	0x8c18	No error (0)	clients.l.google.com		142.250.68.14	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:53.846555948 CEST	1.1.1.1	192.168.11.20	0xf1d6	No error (0)	accounts.google.com		142.250.72.237	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	458rl1jp.r.us-east-1.awstrack.me	r.us-east-1.awstrack.me		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	r.us-east-1.awstrack.me	r.delegate.us-east-1.awstrack.me		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	r.delegate.us-east-1.awstrack.me	baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com		34.237.251.168	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com		54.157.23.244	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:55.857356071 CEST	1.1.1.1	192.168.11.20	0xa7ba	No error (0)	baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com		52.71.154.40	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:57.124216080 CEST	1.1.1.1	192.168.11.20	0xc9e5	No error (0)	members.iiasd.org	saas.ymaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:57.124216080 CEST	1.1.1.1	192.168.11.20	0xc9e5	No error (0)	saas.ymaws.com		35.173.82.140	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:57.124216080 CEST	1.1.1.1	192.168.11.20	0xc9e5	No error (0)	saas.ymaws.com		35.174.132.21	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:57.124216080 CEST	1.1.1.1	192.168.11.20	0xc9e5	No error (0)	saas.ymaws.com		35.169.50.49	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.307789087 CEST	1.1.1.1	192.168.11.20	0xab40	No error (0)	ct.captcha-delivery.com		13.226.228.36	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.307789087 CEST	1.1.1.1	192.168.11.20	0xab40	No error (0)	ct.captcha-delivery.com		13.226.228.31	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.307789087 CEST	1.1.1.1	192.168.11.20	0xab40	No error (0)	ct.captcha-delivery.com		13.226.228.56	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.307789087 CEST	1.1.1.1	192.168.11.20	0xab40	No error (0)	ct.captcha-delivery.com		13.226.228.4	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:58.631012917 CEST	1.1.1.1	192.168.11.20	0x1b0f	No error (0)	www.google.com		142.250.68.36	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:17:59.178400993 CEST	1.1.1.1	192.168.11.20	0xfd8b	No error (0)	geo.captcha-delivery.com	api-us-west-1.captcha-delivery.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:17:59.178400993 CEST	1.1.1.1	192.168.11.20	0xfd8b	No error (0)	api-us-west-1.captcha-delivery.com		52.52.48.41	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090050936 CEST	1.1.1.1	192.168.11.20	0x4fa6	No error (0)	api-js.datadome.co	geoprox-js-sdk.datadome.co		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090050936 CEST	1.1.1.1	192.168.11.20	0x4fa6	No error (0)	geoprox-js-sdk.datadome.co	api-alb-us-utah-1.datadome.co		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090050936 CEST	1.1.1.1	192.168.11.20	0x4fa6	No error (0)	api-alb-us-utah-1.datadome.co		34.107.158.74	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090177059 CEST	1.1.1.1	192.168.11.20	0xfc58	No error (0)	static.captcha-delivery.com	d2lhhyweudwf3e.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090177059 CEST	1.1.1.1	192.168.11.20	0xfc58	No error (0)	d2lhhyweudwf3e.cloudfront.net		99.84.203.122	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090177059 CEST	1.1.1.1	192.168.11.20	0xfc58	No error (0)	d2lhhyweudwf3e.cloudfront.net		99.84.203.7	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090177059 CEST	1.1.1.1	192.168.11.20	0xfc58	No error (0)	d2lhhyweudwf3e.cloudfront.net		99.84.203.73	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090177059 CEST	1.1.1.1	192.168.11.20	0xfc58	No error (0)	d2lhhyweudwf3e.cloudfront.net		99.84.203.42	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090322018 CEST	1.1.1.1	192.168.11.20	0x6d23	No error (0)	js.datadome.co		18.154.206.7	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090322018 CEST	1.1.1.1	192.168.11.20	0x6d23	No error (0)	js.datadome.co		18.154.206.52	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090322018 CEST	1.1.1.1	192.168.11.20	0x6d23	No error (0)	js.datadome.co		18.154.206.120	A (IP address)	IN (0x0001)	false
Oct 17, 2023 18:18:00.090322018 CEST	1.1.1.1	192.168.11.20	0x6d23	No error (0)	js.datadome.co		18.154.206.28	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

458rl1jp.r.us-east-1.awstrack.me

members.iiasd.org

https:

ct.captcha-delivery.com

geo.captcha-delivery.com

static.captcha-delivery.com

js.datadome.co

api-js.datadome.co

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	56646	142.250.72.237	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:54 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=YES+srp.gws-20210811-0-RC2.en+FX+979; AEC=Ad49MVFf9Dv7B6egeOgj1KRs9zEJFl7xTeHKFuDQ4w-0aMcEh1ZbUV4GCw; NID=511=Fb9m6orBsCk8g8okbxd0bNA5e4gEdvsO4EJi3xyY6m7-87MqmFZCjWOfTMjEV-QOLAUoCOhPhFMtvtTgGBvdcCeiVLC5sWNyO_yH0057J1bn8o-spwJb2f-JESUqLUGpJTjHkEs42-DVHUt3379gqE-vONgrrWk5I_jFZltuOMiAhKI4gkjoN1x_
2023-10-17 16:17:54 UTC	0	OUT	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49544	142.250.68.14	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:54 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-94.0.4606.61 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	62187	52.52.48.41	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:59 UTC	14	OUT	GET /captcha/?initialCid=AHrlqAAAAAMAh4D1fahKeeEAZoGRIA%3D%3D&hash=2CF1354F5D33C04234B753357EE0F0&cid=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc&t=fe&referer=https%3A%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid%3DConvention_2023&s=18464&e=b821de14ea111615f4edf644f2cb6d11e84a187fbd64e97b625c2674325e7e2f HTTP/1.1 Host: geo.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://members.iiasd.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	52.52.48.41	443	192.168.11.20	62187	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:59 UTC	15	IN	HTTP/1.1 200 OK Connection: close Date: Tue, 17 Oct 2023 16:17:59 GMT Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding
2023-10-17 16:17:59 UTC	15	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 59 6f 75 20 68 61 76 65 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 21 2d 2d 5b 69 66 20 21 6d 73 6f 5d 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 2f 6d 65 74 61 3e 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 Data Ascii: <!DOCTYPE html><html lang="en" style="background-color:#ffffff"> <head> <title>You have been blocked</title>...[if !mso]><meta http-equiv="X-UA-Compatible" content="IE=edge"></meta><![endif]--><meta http-equiv="Content-Type" content="tex
2023-10-17 16:17:59 UTC	31	IN	Data Raw: 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 77 65 62 6b 69 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 26 20 77 69 6e 64 6f 77 2e 77 65 62 6b 69 74 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 26 20 77 69 6e 64 6f 77 2e 77 65 62 6b 69 74 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 73 2e 6f 6e 43 61 70 74 63 68 61 53 75 63 63 65 73 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 26 20 77 69 6e 64 6f 77 2e 77 65 62 6b 69 74 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 73 2e 6f 6e 43 61 70 74 63 68 61 53 75 63 63 65 73 73 2e 70 6f 73 74 4d 65 73 73 61 67 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e Data Ascii: if (window.webkit && window.webkit.messageHandlers && window.webkit.messageHandlers.onCaptchaSuccess && window.webkit.messageHandlers.onCaptchaSuccess.postMessage) { window.
2023-10-17 16:18:00 UTC	32	IN	Data Raw: 76 61 72 20 75 61 20 3d 20 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 3b 0a 20 20 20 20 76 61 72 20 6d 73 69 65 20 3d 20 75 61 2e 69 6e 64 65 78 4f 66 28 27 4d 53 49 45 20 27 29 3b 0a 20 20 20 20 76 61 72 20 74 72 69 64 65 6e 74 20 3d 20 75 61 2e 69 6e 64 65 78 4f 66 28 27 54 72 69 64 65 6e 74 2f 27 29 3b 0a 20 20 20 20 69 66 20 28 6d 73 69 65 20 3e 20 30 20 7c 7c 20 74 72 69 64 65 6e 74 20 3e 20 30 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0a 20 20 20 20 7d 0a 7d 0a 66 75 6e 63 74 69 6f 6e 20 73 63 72 6f 6c 6c 54 6f 59 28 79 29 20 7b 0a 20 20 20 20 69 66 20 28 69 73 49 45 28 29 29 20 7b 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 73 63 72 6f 6c 6c 54 6f 28 30 2c 20 79 29 3b 0a 20 20 20 Data Ascii: var ua = window.navigator.userAgent; var msie = ua.indexOf('MSIE '); var trident = ua.indexOf('Trident/'); if (msie > 0 \|\| trident > 0) { return true; }}function scrollToY(y) { if (isIE()) { window.scrollTo(0, y);

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	56243	99.84.203.122	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	38	OUT	GET /captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css HTTP/1.1 Host: static.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	59287	99.84.203.122	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	38	OUT	GET /common/fonts/roboto/font-face.css HTTP/1.1 Host: static.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	60546	99.84.203.122	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	39	OUT	GET /captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139 HTTP/1.1 Host: static.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	99.84.203.122	443	192.168.11.20	56243	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	39	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6323 Connection: close Last-Modified: Tue, 09 Jul 2019 14:35:24 GMT x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 17 Oct 2023 00:04:32 GMT ETag: "8ba3717dee9fac12ab09dda082b49fac" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2918d6e6821d66add4209ccb8407d12c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX3-C3 X-Amz-Cf-Id: AbXR83dWRix4jzkrWamO4hMe7QuPJkxMmnqEbOrhyXYGYo6SYlMOCA== Age: 58409
2023-10-17 16:18:00 UTC	40	IN	Data Raw: 62 6f 64 79 0d 0a 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 20 3a 20 30 3b 0d 0a 7d 0d 0a 0d 0a 2a 2c 20 2a 3a 61 66 74 65 72 2c 20 2a 3a 62 65 66 6f 72 65 0d 0a 7b 0d 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 20 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 7d 0d 0a 0d 0a 2a 3a 66 6f 63 75 73 0d 0a 7b 0d 0a 20 20 20 20 6f 75 74 6c 69 6e 65 20 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 63 61 70 74 63 68 61 0d 0a 7b 0d 0a 20 20 20 20 77 69 64 74 68 20 20 20 20 20 20 20 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 20 3a 20 32 30 70 78 3b 0d 0a 7d 0d 0a 0d 0a 61 0d 0a 7b 0d 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 Data Ascii: body{ margin : 0;}, :after, :before{ box-sizing : border-box;}:focus{ outline : none;}.captcha{ width : 100%; padding-top : 20px;}a{ text-decoration: underline; cursor: pointer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	99.84.203.122	443	192.168.11.20	59287	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	46	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 287 Connection: close Last-Modified: Fri, 06 May 2022 16:47:07 GMT x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 17 Oct 2023 06:48:46 GMT ETag: "6fda0c9bdd9b51bc0805fa37f22eb90b" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6ae304c394ca48eaeac474c114a24c88.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX3-C3 X-Amz-Cf-Id: Ro-cmuSK8nXazjJLtQie3vN-Xh-2_QPG8n08QSf6IlTFV1_h0QhT1Q== Age: 34155
2023-10-17 16:18:00 UTC	47	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 6c 6f 63 61 6c 28 27 52 6f 62 6f 74 6f 27 29 2c 0a 20 20 20 20 20 20 20 75 72 6c 28 27 2e 2f 72 6f 62 6f 74 6f 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 2f 2a 20 43 68 72 6f 6d 65 20 32 36 2b 2c 20 4f 70 65 72 61 20 32 33 2b 2c 20 46 69 72 65 66 6f 78 20 33 39 2b 20 2a 2f 0a 20 20 20 20 20 20 20 75 72 6c 28 27 2e 2f 72 6f 62 6f 74 6f 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 20 2f 2a 20 43 68 72 6f 6d 65 20 36 2b 2c 20 46 69 72 65 66 6f Data Ascii: @font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: local('Roboto'), url('./roboto.woff2') format('woff2'), /* Chrome 26+, Opera 23+, Firefox 39+ / url('./roboto.woff') format('woff'); / Chrome 6+, Firefo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	59740	18.154.206.7	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:00 UTC	47	OUT	GET /tags.js HTTP/1.1 Host: js.datadome.co Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	99.84.203.122	443	192.168.11.20	60546	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	47	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 27589 Connection: close Date: Tue, 17 Oct 2023 16:18:01 GMT Last-Modified: Mon, 23 Nov 2020 18:55:10 GMT ETag: "4a06ea2ba0bf9063d7c88afe6a74df11" Cache-Control: public x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 74d35431a23bfc97a6055173d9be2dc4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX3-C3 X-Amz-Cf-Id: WN6m85mch4xzW_gYd9iocY5Jxueejp1vhdau4Awp9y6gX_6q5WxNVQ==
2023-10-17 16:18:01 UTC	48	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 f9 00 00 00 fa 08 06 00 00 00 d3 02 92 bc 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 06 62 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRpHYs.#.#x?vbiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RD
2023-10-17 16:18:01 UTC	63	IN	Data Raw: f0 f3 02 77 a3 85 7a ee 59 32 b9 e7 97 dc 93 ee 00 dc 65 79 91 40 1d 1b 33 8c 9f 98 68 f0 7c 4c b4 23 6f 9b c8 3a 69 95 bc 94 64 df 98 b9 8a 06 6f ec 5c 0a 3d c9 d7 5a 2c 6b 69 b1 ac a0 49 52 6d f9 f8 84 18 ea a6 f4 19 40 32 d2 e6 6b a8 07 b7 93 ea 1a bd 4d 5a d3 5d 3e 3e e1 16 6e f6 71 0b d5 95 e4 Data Ascii: wzY2ey@3h\|L#o:ido\=Z,kiIRm@2kMZ]>>nq
2023-10-17 16:18:01 UTC	64	IN	Data Raw: 4f c3 e4 5e 6d 39 16 5b 6a 4b e5 34 8f 4f 88 26 dc 32 b4 f2 1d 80 23 05 c2 6b 49 6c 43 0b fd ef ac b5 1e 85 25 9d 07 db 18 e3 de 23 5a a8 eb da 5f 81 75 c9 6d a1 f7 fd d6 4e a2 70 e3 c2 77 00 8e b4 f0 7f 1d ad c7 da d0 88 e7 ec 1a c0 5f 00 d6 6f e5 41 08 78 b1 7f 37 2d b8 de fa 35 11 38 ed eb 62 6f 92 e4 ae 01 14 92 f0 4b 01 7c 84 bb e4 44 0b ff c7 44 03 bd ef be 71 12 85 7b 95 e6 f2 8d e5 ed 37 9a 31 d8 de be 37 9d 64 5f 02 77 49 f4 06 f2 2c 7d ca 2f ab f6 79 f7 f3 e7 cf dd 1f bc 7b 37 72 28 af 3d 3e e1 07 ec 7d e1 ef 4f 39 e9 74 cc e3 13 22 a8 13 e8 77 a8 1b 53 62 a9 e8 1a ea 02 f5 0f 54 62 af b5 54 ee e4 48 52 35 05 f0 07 f0 eb bf fb 6a a1 f6 e5 df 00 2a b6 da 23 a2 31 49 f2 20 85 ba 7e a5 b0 73 ef 6d d1 b9 3f bc c5 4a 16 91 2b 59 5e 44 78 3e 67 13 f9 Data Ascii: O^m9[jK4O&2#kIlC%#Z_umNpw_oAx7-58boK\|DDq{717d_wI,}/y{7r(=>}O9t"wSbTbTHR5j*#1I ~sm?J+Y^Dx>g
2023-10-17 16:18:01 UTC	81	IN	Data Raw: 76 4e 8f dd 75 89 88 88 88 88 88 02 90 e5 c5 15 fa 25 f8 00 95 50 ba 37 dc d4 f6 83 f5 b6 19 80 07 49 06 d2 01 59 5e a4 00 7e 40 7d 6f a9 fc cc a1 92 a8 44 b4 df ae eb 50 22 bf 27 43 4c f2 11 11 11 11 11 11 85 e1 a3 e6 f2 89 6e 22 4e ba 02 cf fb 94 0d e0 4a 33 9e b7 e8 cb 9e df a7 d2 c2 8f 88 76 4b f7 fc 3e 1a 31 86 93 c3 24 1f 11 11 11 11 11 51 18 52 83 75 12 cd e5 3f 6b 2c ab 9b 74 7c 8b a2 03 9f c5 23 c5 40 74 4a fe f1 1d c0 94 31 c9 47 44 44 44 44 44 f4 76 24 8e 96 25 22 22 cf 98 e4 23 22 22 22 22 22 7a 3b 22 df 01 10 11 91 1b 4c f2 11 11 11 11 11 11 11 11 11 4d 1c 93 7c 44 44 44 44 44 44 61 68 74 57 58 2d ca ca 7e 18 44 44 34 45 4c f2 11 11 11 11 11 11 85 a1 d2 5c 7e e9 20 06 22 22 9a 28 26 f9 88 88 88 88 88 88 c2 70 8b fe ad f9 5a 00 85 b3 48 88 88 Data Ascii: vNu%P7IY^~@}oDP"'CLn"NJ3vK>1$QRu?k,t\|#@tJ1GDDDDDv$%""#"""""z;"LM\|DDDDDDahtWX-~DD4EL\~ ""(&pZH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	18.154.206.7	443	192.168.11.20	59740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	65	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 283092 Connection: close Server: Apache Strict-Transport-Security: max-age=15768000 Last-Modified: Tue, 10 Oct 2023 08:42:12 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Date: Tue, 17 Oct 2023 16:08:05 GMT Expires: Tue, 17 Oct 2023 17:08:05 GMT Cache-Control: max-age=3600, public ETag: "451d4-60758aedec29a" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 b1ef6ba7e467ee00b7e5f07d263b2d12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P5 X-Amz-Cf-Id: ovdmLlqL3FMynm3bRaA5VwuP9mQBe3aQLxCxWm61twAIC98axaNcwQ== Age: 595
2023-10-17 16:18:01 UTC	66	IN	Data Raw: 2f 2a 2a 20 44 61 74 61 44 6f 6d 65 20 69 73 20 61 20 63 79 62 65 72 73 65 63 75 72 69 74 79 20 73 6f 6c 75 74 69 6f 6e 20 74 6f 20 64 65 74 65 63 74 20 62 6f 74 20 61 63 74 69 76 69 74 79 20 68 74 74 70 73 3a 2f 2f 64 61 74 61 64 6f 6d 65 2e 63 6f 20 28 76 65 72 73 69 6f 6e 20 34 2e 31 34 2e 31 29 20 2a 2f 20 0a 76 61 72 20 5f 30 78 31 61 39 65 36 34 3d 5f 30 78 31 38 39 66 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 36 32 39 32 39 2c 5f 30 78 32 63 37 65 37 63 29 7b 76 61 72 20 5f 30 78 32 66 65 33 62 38 3d 5f 30 78 31 38 39 66 2c 5f 30 78 32 37 38 63 33 63 3d 5f 30 78 31 36 32 39 32 39 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 32 38 62 31 62 36 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 32 66 65 33 62 38 28 32 33 34 29 Data Ascii: /** DataDome is a cybersecurity solution to detect bot activity https://datadome.co (version 4.14.1) */ var _0x1a9e64=_0x189f;(function(_0x162929,_0x2c7e7c){var _0x2fe3b8=_0x189f,_0x278c3c=_0x162929();while(!![]){try{var _0x28b1b6=parseInt(_0x2fe3b8(234)
2023-10-17 16:18:01 UTC	91	IN	Data Raw: 78 36 37 5c 78 37 32 5c 78 35 39 5c 78 34 31 5c 78 37 38 5c 78 37 61 5c 78 34 63 5c 78 34 33 5c 78 34 63 5c 78 33 39 5c 78 33 31 5c 78 34 32 5c 78 34 65 5c 78 34 34 5c 78 35 39 5c 78 37 39 5c 78 37 38 5c 78 36 32 5c 78 35 37 5c 78 37 61 5c 78 37 37 5c 78 37 31 27 2c 27 5c 78 37 39 5c 78 37 37 5c 78 37 32 5c 78 34 62 5c 78 37 32 5c 78 37 38 5c 78 37 61 5c 78 34 63 5c 78 34 32 5c 78 34 65 5c 78 37 32 5c 78 36 64 5c 78 34 31 5c 78 37 38 5c 78 36 65 5c 78 33 30 5c 78 37 61 5c 78 37 37 5c 78 33 35 5c 78 34 63 5c 78 34 33 5c 78 34 37 27 2c 27 5c 78 37 39 5c 78 37 37 5c 78 35 30 5c 78 34 38 5c 78 34 35 5c 78 36 35 5c 78 35 38 5c 78 35 30 5c 78 34 33 5c 78 33 33 5c 78 37 32 5c 78 34 63 5c 78 34 32 5c 78 34 64 5c 78 37 36 5c 78 35 39 5c 78 37 35 5c 78 36 37 5c 78 Data Ascii: x67\x72\x59\x41\x78\x7a\x4c\x43\x4c\x39\x31\x42\x4e\x44\x59\x79\x78\x62\x57\x7a\x77\x71','\x79\x77\x72\x4b\x72\x78\x7a\x4c\x42\x4e\x72\x6d\x41\x78\x6e\x30\x7a\x77\x35\x4c\x43\x47','\x79\x77\x50\x48\x45\x65\x58\x50\x43\x33\x72\x4c\x42\x4d\x76\x59\x75\x67\x
2023-10-17 16:18:01 UTC	107	IN	Data Raw: 5c 78 34 33 5c 78 34 37 27 2c 27 5c 78 37 39 5c 78 33 33 5c 78 37 61 5c 78 35 61 27 2c 27 5c 78 37 61 5c 78 37 37 5c 78 33 31 5c 78 33 30 27 2c 27 5c 78 36 39 5c 78 34 39 5c 78 36 31 5c 78 34 37 5c 78 34 34 5c 78 33 32 5c 78 34 63 5c 78 34 62 5c 78 34 34 5c 78 36 37 5c 78 34 37 5c 78 33 39 5c 78 36 39 5c 78 34 61 5c 78 36 35 5c 78 35 37 5c 78 36 64 5c 78 36 33 5c 78 37 35 5c 78 34 39 5c 78 36 39 5c 78 36 37 5c 78 34 38 5c 78 34 63 5c 78 34 31 5c 78 37 37 5c 78 34 34 5c 78 34 66 5c 78 34 34 5c 78 36 34 5c 78 33 30 5c 78 34 39 5c 78 36 64 5c 78 37 34 5c 78 36 31 5c 78 35 37 5c 78 36 61 5c 78 37 33 5c 78 36 39 5c 78 34 37 5c 78 34 33 5c 78 33 33 5c 78 37 32 5c 78 33 35 5c 78 34 32 5c 78 36 37 5c 78 37 35 5c 78 33 39 5c 78 36 39 5c 78 34 64 5c 78 34 38 5c 78 Data Ascii: \x43\x47','\x79\x33\x7a\x5a','\x7a\x77\x31\x30','\x69\x49\x61\x47\x44\x32\x4c\x4b\x44\x67\x47\x39\x69\x4a\x65\x57\x6d\x63\x75\x49\x69\x67\x48\x4c\x41\x77\x44\x4f\x44\x64\x30\x49\x6d\x74\x61\x57\x6a\x73\x69\x47\x43\x33\x72\x35\x42\x67\x75\x39\x69\x4d\x48\x
2023-10-17 16:18:01 UTC	123	IN	Data Raw: 27 2c 5f 30 78 31 30 34 61 36 34 5b 5f 30 78 31 35 36 61 66 66 28 33 30 33 29 5d 3d 27 5c 78 36 34 5c 78 36 34 5c 78 35 66 5c 78 37 32 5c 78 36 35 5c 78 37 33 5c 78 37 30 5c 78 36 66 5c 78 36 65 5c 78 37 33 5c 78 36 35 5c 78 35 66 5c 78 36 35 5c 78 37 32 5c 78 37 32 5c 78 36 66 5c 78 37 32 27 2c 5f 30 78 31 30 34 61 36 34 5b 5f 30 78 31 35 36 61 66 66 28 35 34 38 29 5d 3d 27 5c 78 36 34 5c 78 36 34 5c 78 35 66 5c 78 37 32 5c 78 36 35 5c 78 37 33 5c 78 37 30 5c 78 36 66 5c 78 36 65 5c 78 37 33 5c 78 36 35 5c 78 35 66 5c 78 37 30 5c 78 36 31 5c 78 37 33 5c 78 37 33 5c 78 36 35 5c 78 36 34 27 2c 5f 30 78 31 30 34 61 36 34 5b 5f 30 78 31 35 36 61 66 66 28 33 39 31 29 5d 3d 5f 30 78 31 35 36 61 66 66 28 32 32 31 29 2c 5f 30 78 31 30 34 61 36 34 5b 27 5c 78 36 Data Ascii: ',_0x104a64[_0x156aff(303)]='\x64\x64\x5f\x72\x65\x73\x70\x6f\x6e\x73\x65\x5f\x65\x72\x72\x6f\x72',_0x104a64[_0x156aff(548)]='\x64\x64\x5f\x72\x65\x73\x70\x6f\x6e\x73\x65\x5f\x70\x61\x73\x73\x65\x64',_0x104a64[_0x156aff(391)]=_0x156aff(221),_0x104a64['\x6
2023-10-17 16:18:01 UTC	139	IN	Data Raw: 35 33 5c 78 37 31 5c 78 37 31 5c 78 35 31 5c 78 32 37 5c 78 32 63 5c 78 32 37 5c 78 35 37 5c 78 35 32 5c 78 33 33 5c 78 36 33 5c 78 35 36 5c 78 33 38 5c 78 36 62 5c 78 35 32 5c 78 34 31 5c 78 35 38 5c 78 37 35 5c 78 32 37 5c 78 32 63 5c 78 32 37 5c 78 34 32 5c 78 36 64 5c 78 36 62 5c 78 37 37 5c 78 35 37 5c 78 33 34 5c 78 33 35 5c 78 34 31 5c 78 37 36 5c 78 34 37 5c 78 34 62 5c 78 36 64 5c 78 35 37 5c 78 35 32 5c 78 36 63 5c 78 36 33 5c 78 35 32 5c 78 37 34 5c 78 36 34 5c 78 36 34 5c 78 35 31 5c 78 33 38 5c 78 36 66 5c 78 36 66 5c 78 36 34 5c 78 37 31 5c 78 36 38 5c 78 36 34 5c 78 35 35 5c 78 34 37 5c 78 32 37 5c 78 32 63 5c 78 32 37 5c 78 37 38 5c 78 34 33 5c 78 36 66 5c 78 35 30 5c 78 34 31 5c 78 34 61 5c 78 34 65 5c 78 36 33 5c 78 35 32 5c 78 37 31 5c Data Ascii: 53\x71\x71\x51\x27\x2c\x27\x57\x52\x33\x63\x56\x38\x6b\x52\x41\x58\x75\x27\x2c\x27\x42\x6d\x6b\x77\x57\x34\x35\x41\x76\x47\x4b\x6d\x57\x52\x6c\x63\x52\x74\x64\x64\x51\x38\x6f\x6f\x64\x71\x68\x64\x55\x47\x27\x2c\x27\x78\x43\x6f\x50\x41\x4a\x4e\x63\x52\x71\
2023-10-17 16:18:01 UTC	155	IN	Data Raw: 32 37 5c 78 32 39 5c 78 35 64 5c 78 32 38 5c 78 32 64 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 32 63 5c 78 35 39 5c 78 35 62 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 35 64 5c 78 35 62 5c 78 34 32 5c 78 32 38 5c 78 33 30 5c 78 37 38 5c 78 33 32 5c 78 33 31 5c 78 33 33 5c 78 32 63 5c 78 32 37 5c 78 36 65 5c 78 34 36 5c 78 35 64 5c 78 34 34 5c 78 32 37 5c 78 32 39 5c 78 35 64 5c 78 32 38 5c 78 34 32 5c 78 32 38 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 36 35 5c 78 36 32 5c 78 32 63 5c 78 32 37 5c 78 37 33 5c 78 34 38 5c 78 35 34 5c 78 34 64 5c 78 32 37 5c 78 32 39 5c 78 32 39 5c 78 32 39 5c 78 32 39 5c 78 33 62 5c 78 37 64 5c 78 37 37 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 66 5c 78 37 37 5c 78 35 62 5c 78 37 31 5c 78 32 38 5c 78 33 30 5c 78 37 38 5c Data Ascii: 27\x29\x5d\x28\x2d\x30\x78\x31\x2c\x59\x5b\x30\x78\x31\x5d\x5b\x42\x28\x30\x78\x32\x31\x33\x2c\x27\x6e\x46\x5d\x44\x27\x29\x5d\x28\x42\x28\x30\x78\x31\x65\x62\x2c\x27\x73\x48\x54\x4d\x27\x29\x29\x29\x29\x3b\x7d\x77\x69\x6e\x64\x6f\x77\x5b\x71\x28\x30\x78\
2023-10-17 16:18:01 UTC	171	IN	Data Raw: 33 27 5d 3d 27 5c 78 32 66 5c 78 32 61 5c 78 32 61 5c 78 32 66 27 2c 5f 30 78 33 38 37 30 30 61 5b 27 5c 78 37 33 5c 78 36 35 5c 78 37 34 5c 78 34 31 5c 78 37 34 5c 78 37 34 5c 78 37 32 5c 78 36 39 5c 78 36 32 5c 78 37 35 5c 78 37 34 5c 78 36 35 27 5d 28 5f 30 78 31 34 36 38 33 30 28 31 39 35 29 2c 27 5c 78 36 34 5c 78 36 39 5c 78 37 33 5c 78 37 30 5c 78 36 63 5c 78 36 31 5c 78 37 39 5c 78 33 61 5c 78 32 30 5c 78 36 65 5c 78 36 66 5c 78 36 65 5c 78 36 35 5c 78 33 62 27 29 2c 64 6f 63 75 6d 65 6e 74 26 26 64 6f 63 75 6d 65 6e 74 5b 27 5c 78 36 38 5c 78 36 35 5c 78 36 31 5c 78 36 34 27 5d 26 26 28 64 6f 63 75 6d 65 6e 74 5b 27 5c 78 36 38 5c 78 36 35 5c 78 36 31 5c 78 36 34 27 5d 5b 27 5c 78 36 31 5c 78 37 30 5c 78 37 30 5c 78 36 35 5c 78 36 65 5c 78 36 34 Data Ascii: 3']='\x2f\x2a\x2a\x2f',_0x38700a['\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65'](_0x146830(195),'\x64\x69\x73\x70\x6c\x61\x79\x3a\x20\x6e\x6f\x6e\x65\x3b'),document&&document['\x68\x65\x61\x64']&&(document['\x68\x65\x61\x64']['\x61\x70\x70\x65\x6e\x64
2023-10-17 16:18:01 UTC	188	IN	Data Raw: 5b 27 5c 78 36 33 5c 78 37 32 5c 78 36 35 5c 78 36 31 5c 78 37 34 5c 78 36 35 5c 78 34 35 5c 78 37 36 5c 78 36 35 5c 78 36 65 5c 78 37 34 27 5d 28 5f 30 78 34 66 33 32 31 39 28 32 38 33 29 29 2c 5f 30 78 61 34 31 65 32 66 5b 27 5c 78 37 34 5c 78 37 33 5c 78 35 66 5c 78 37 34 5c 78 36 35 5c 78 36 33 27 5d 3d 21 30 3b 7d 63 61 74 63 68 28 5f 30 78 33 30 33 31 37 65 29 7b 5f 30 78 61 34 31 65 32 66 5b 27 5c 78 37 34 5c 78 37 33 5c 78 35 66 5c 78 37 34 5c 78 36 35 5c 78 36 33 27 5d 3d 21 31 3b 7d 5f 30 78 61 34 31 65 32 66 5b 27 5c 78 37 34 5c 78 37 33 5c 78 35 66 5c 78 37 34 5c 78 37 33 5c 78 36 31 27 5d 3d 27 5c 78 36 66 5c 78 36 65 5c 78 37 34 5c 78 36 66 5c 78 37 35 5c 78 36 33 5c 78 36 38 5c 78 37 33 5c 78 37 34 5c 78 36 31 5c 78 37 32 5c 78 37 34 27 69 Data Ascii: ['\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6e\x74'](_0x4f3219(283)),_0xa41e2f['\x74\x73\x5f\x74\x65\x63']=!0;}catch(_0x30317e){_0xa41e2f['\x74\x73\x5f\x74\x65\x63']=!1;}_0xa41e2f['\x74\x73\x5f\x74\x73\x61']='\x6f\x6e\x74\x6f\x75\x63\x68\x73\x74\x61\x72\x74'i
2023-10-17 16:18:01 UTC	204	IN	Data Raw: 78 36 66 5c 78 36 65 5c 78 37 34 5c 78 36 35 5c 78 36 65 5c 78 37 34 5c 78 35 37 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 66 5c 78 37 37 27 5d 5b 27 5c 78 37 30 5c 78 36 66 5c 78 37 33 5c 78 37 34 5c 78 34 64 5c 78 36 35 5c 78 37 33 5c 78 37 33 5c 78 36 31 5c 78 36 37 5c 78 36 35 27 5d 28 5f 30 78 34 33 32 33 30 35 2c 27 5c 78 32 61 27 29 3b 7d 63 61 74 63 68 28 5f 30 78 31 32 31 66 31 32 29 7b 5f 30 78 36 61 32 39 31 65 3d 5f 30 78 31 32 31 66 31 32 3b 7d 69 66 28 21 5f 30 78 36 61 32 39 31 65 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 5f 30 78 33 37 35 66 65 39 3d 5f 30 78 33 30 35 64 66 62 28 36 31 32 29 2b 5f 30 78 32 31 39 35 64 30 2b 5f 30 78 33 30 35 64 66 62 28 32 32 30 29 3b 72 65 74 75 72 6e 20 5f 30 78 36 61 32 39 31 65 5b 5f 30 78 33 30 35 Data Ascii: x6f\x6e\x74\x65\x6e\x74\x57\x69\x6e\x64\x6f\x77']['\x70\x6f\x73\x74\x4d\x65\x73\x73\x61\x67\x65'](_0x432305,'\x2a');}catch(_0x121f12){_0x6a291e=_0x121f12;}if(!_0x6a291e)return!0;var _0x375fe9=_0x305dfb(612)+_0x2195d0+_0x305dfb(220);return _0x6a291e[_0x305
2023-10-17 16:18:01 UTC	220	IN	Data Raw: 34 5b 27 5c 78 36 33 5c 78 36 66 5c 78 36 65 5c 78 37 34 5c 78 36 35 5c 78 36 65 5c 78 37 34 5c 78 35 37 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 66 5c 78 37 37 27 5d 5b 5f 30 78 32 36 63 32 38 63 28 34 36 35 29 5d 2c 5f 30 78 35 39 61 63 65 34 3d 5f 30 78 32 38 32 64 31 37 5b 27 5c 78 36 33 5c 78 37 32 5c 78 36 35 5c 78 36 31 5c 78 37 34 5c 78 36 35 5c 78 34 35 5c 78 36 63 5c 78 36 35 5c 78 36 64 5c 78 36 35 5c 78 36 65 5c 78 37 34 27 5d 28 27 5c 78 37 33 5c 78 36 33 5c 78 37 32 5c 78 36 39 5c 78 37 30 5c 78 37 34 27 29 3b 5f 30 78 35 39 61 63 65 34 5b 27 5c 78 37 34 5c 78 37 39 5c 78 37 30 5c 78 36 35 27 5d 3d 5f 30 78 32 36 63 32 38 63 28 32 31 37 29 2c 5f 30 78 35 39 61 63 65 34 5b 5f 30 78 32 36 63 32 38 63 28 36 30 33 29 5d 28 5f 30 78 32 38 32 Data Ascii: 4['\x63\x6f\x6e\x74\x65\x6e\x74\x57\x69\x6e\x64\x6f\x77'][_0x26c28c(465)],_0x59ace4=_0x282d17['\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74']('\x73\x63\x72\x69\x70\x74');_0x59ace4['\x74\x79\x70\x65']=_0x26c28c(217),_0x59ace4[_0x26c28c(603)](_0x282
2023-10-17 16:18:01 UTC	236	IN	Data Raw: 5c 78 37 35 5c 78 37 32 5c 78 36 65 5c 78 32 31 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 33 62 5c 78 37 64 5c 78 37 64 5c 78 32 38 5c 78 35 39 5c 78 32 39 5c 78 32 39 5c 78 37 63 5c 78 37 63 5c 78 32 31 5c 78 32 31 5c 78 32 38 5c 78 34 32 5c 78 32 38 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 36 35 5c 78 33 35 5c 78 32 63 5c 78 32 37 5c 78 32 35 5c 78 37 31 5c 78 36 39 5c 78 35 64 5c 78 32 37 5c 78 32 39 5c 78 33 64 5c 78 33 64 5c 78 33 64 5c 78 35 39 5c 78 35 62 5c 78 34 32 5c 78 32 38 5c 78 33 30 5c 78 37 38 5c 78 33 31 5c 78 36 36 5c 78 33 37 5c 78 32 63 5c 78 32 37 5c 78 33 32 5c 78 34 66 5c 78 37 30 5c 78 35 62 5c 78 32 37 5c 78 32 39 5c 78 35 64 5c 78 37 63 5c 78 37 63 5c 78 32 38 5c 78 35 39 5c 78 33 64 5c 78 35 39 5c 78 32 63 5c 78 34 35 5c 78 37 Data Ascii: \x75\x72\x6e\x21\x30\x78\x31\x3b\x7d\x7d\x28\x59\x29\x29\x7c\x7c\x21\x21\x28\x42\x28\x30\x78\x31\x65\x35\x2c\x27\x25\x71\x69\x5d\x27\x29\x3d\x3d\x3d\x59\x5b\x42\x28\x30\x78\x31\x66\x37\x2c\x27\x32\x4f\x70\x5b\x27\x29\x5d\x7c\x7c\x28\x59\x3d\x59\x2c\x45\x7
2023-10-17 16:18:01 UTC	252	IN	Data Raw: 5c 78 35 66 5c 78 36 31 5c 78 36 36 27 5d 29 3b 7d 2c 74 68 69 73 5b 5f 30 78 32 31 30 35 35 66 28 31 38 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 66 63 33 63 37 2c 5f 30 78 34 35 66 63 30 66 2c 5f 30 78 31 66 61 37 37 30 29 7b 76 61 72 20 5f 30 78 32 37 64 37 33 30 3d 74 68 69 73 3b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 32 61 37 62 36 32 3d 5f 30 78 31 38 39 66 3b 5f 30 78 33 30 34 63 36 34 5b 5f 30 78 32 61 37 62 36 32 28 34 30 31 29 5d 7c 7c 28 5f 30 78 33 30 34 63 36 34 5b 5f 30 78 32 61 37 62 36 32 28 34 30 31 29 5d 3d 30 29 3b 76 61 72 20 5f 30 78 33 64 35 33 31 31 3d 70 65 72 66 6f 72 6d 61 6e 63 65 5b 5f 30 78 32 61 37 62 36 32 28 34 30 39 29 5d 28 29 3b 74 72 79 7b 5f 30 78 32 66 63 33 63 Data Ascii: \x5f\x61\x66']);},this[_0x21055f(189)]=function(_0x2fc3c7,_0x45fc0f,_0x1fa770){var _0x27d730=this;setTimeout(function(){var _0x2a7b62=_0x189f;_0x304c64[_0x2a7b62(401)]\|\|(_0x304c64[_0x2a7b62(401)]=0);var _0x3d5311=performance[_0x2a7b62(409)]();try{_0x2fc3c
2023-10-17 16:18:01 UTC	268	IN	Data Raw: 5c 78 36 35 27 21 3d 3d 5f 30 78 35 36 61 62 36 36 7c 7c 28 5f 30 78 35 61 35 37 31 34 5b 5f 30 78 32 31 66 35 31 38 28 31 37 35 29 5d 28 27 5c 78 36 63 5c 78 36 39 5c 78 36 65 5c 78 37 35 5c 78 37 38 27 29 3e 3d 30 7c 7c 5f 30 78 35 61 35 37 31 34 5b 5f 30 78 32 31 66 35 31 38 28 31 37 35 29 5d 28 5f 30 78 32 31 66 35 31 38 28 36 34 36 29 29 3e 3d 30 7c 7c 5f 30 78 35 61 35 37 31 34 5b 27 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 35 5c 78 37 38 5c 78 34 66 5c 78 36 36 27 5d 28 27 5c 78 37 30 5c 78 36 39 5c 78 36 62 5c 78 36 35 27 29 3e 3d 30 29 26 26 27 5c 78 34 63 5c 78 36 39 5c 78 36 65 5c 78 37 35 5c 78 37 38 27 21 3d 3d 5f 30 78 35 36 61 62 36 36 26 26 27 5c 78 34 31 5c 78 36 65 5c 78 36 34 5c 78 37 32 5c 78 36 66 5c 78 36 39 5c 78 36 34 27 21 3d Data Ascii: \x65'!==_0x56ab66\|\|(_0x5a5714[_0x21f518(175)]('\x6c\x69\x6e\x75\x78')>=0\|\|_0x5a5714[_0x21f518(175)](_0x21f518(646))>=0\|\|_0x5a5714['\x69\x6e\x64\x65\x78\x4f\x66']('\x70\x69\x6b\x65')>=0)&&'\x4c\x69\x6e\x75\x78'!==_0x56ab66&&'\x41\x6e\x64\x72\x6f\x69\x64'!=
2023-10-17 16:18:01 UTC	284	IN	Data Raw: 73 65 7b 69 66 28 5f 30 78 35 35 30 36 33 65 29 74 72 79 7b 76 61 72 20 5f 30 78 33 37 61 37 64 33 3d 5f 30 78 31 39 66 38 32 34 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3e 32 26 26 5f 30 78 33 63 62 65 34 64 5b 27 5c 78 37 34 5c 78 36 35 5c 78 37 33 5c 78 37 34 27 5d 28 5f 30 78 31 39 66 38 32 34 5b 5f 30 78 31 39 66 38 32 34 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 2d 33 5d 29 3b 5f 30 78 33 37 61 37 64 33 26 26 28 5f 30 78 33 30 34 63 36 34 5b 5f 30 78 63 61 32 64 30 37 28 32 31 38 29 5d 3d 21 30 2c 5f 30 78 34 30 30 39 37 63 28 27 5c 78 36 31 5c 78 37 33 5c 78 37 39 5c 78 36 65 5c 78 36 33 5c 78 34 33 5c 78 36 38 5c 78 36 31 5c 78 36 63 5c 78 36 63 5c 78 36 35 5c 78 Data Ascii: se{if(_0x55063e)try{var _0x37a7d3=_0x19f824['\x6c\x65\x6e\x67\x74\x68']>2&&_0x3cbe4d['\x74\x65\x73\x74'](_0x19f824[_0x19f824['\x6c\x65\x6e\x67\x74\x68']-3]);_0x37a7d3&&(_0x304c64[_0xca2d07(218)]=!0,_0x40097c('\x61\x73\x79\x6e\x63\x43\x68\x61\x6c\x6c\x65\x
2023-10-17 16:18:01 UTC	300	IN	Data Raw: 27 5d 28 29 2f 31 30 30 30 29 2c 21 5f 30 78 33 39 61 30 66 39 5b 27 5c 78 36 39 5c 78 37 33 5c 78 35 33 5c 78 36 31 5c 78 36 36 5c 78 36 31 5c 78 37 32 5c 78 36 39 5c 78 35 35 5c 78 34 31 27 5d 28 29 26 26 21 5f 30 78 32 35 62 61 65 37 26 26 77 69 6e 64 6f 77 5b 27 5c 78 36 65 5c 78 36 31 5c 78 37 36 5c 78 36 39 5c 78 36 37 5c 78 36 31 5c 78 37 34 5c 78 36 66 5c 78 37 32 27 5d 26 26 77 69 6e 64 6f 77 5b 5f 30 78 33 66 38 35 39 32 28 33 35 35 29 5d 5b 27 5c 78 37 33 5c 78 36 35 5c 78 36 65 5c 78 36 34 5c 78 34 32 5c 78 36 35 5c 78 36 31 5c 78 36 33 5c 78 36 66 5c 78 36 65 27 5d 26 26 77 69 6e 64 6f 77 5b 27 5c 78 34 32 5c 78 36 63 5c 78 36 66 5c 78 36 32 27 5d 29 7b 76 61 72 20 5f 30 78 32 32 39 61 63 32 3d 7b 7d 3b 5f 30 78 32 32 39 61 63 32 5b 27 5c 78 Data Ascii: ']()/1000),!_0x39a0f9['\x69\x73\x53\x61\x66\x61\x72\x69\x55\x41']()&&!_0x25bae7&&window['\x6e\x61\x76\x69\x67\x61\x74\x6f\x72']&&window[_0x3f8592(355)]['\x73\x65\x6e\x64\x42\x65\x61\x63\x6f\x6e']&&window['\x42\x6c\x6f\x62']){var _0x229ac2={};_0x229ac2['\x
2023-10-17 16:18:01 UTC	316	IN	Data Raw: 78 37 32 5c 78 37 32 5c 78 36 39 5c 78 36 34 5c 78 36 35 5c 78 34 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 5c 78 34 34 5c 78 36 66 5c 78 36 64 5c 78 36 31 5c 78 36 39 5c 78 36 65 27 5d 26 26 28 5f 30 78 34 34 32 63 38 38 5b 27 5c 78 36 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 27 5d 3d 5f 30 78 31 32 62 35 62 38 5b 27 5c 78 37 32 5c 78 36 35 5c 78 37 30 5c 78 36 63 5c 78 36 31 5c 78 36 33 5c 78 36 35 5c 78 34 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 5c 78 34 34 5c 78 36 66 5c 78 36 64 5c 78 36 31 5c 78 36 39 5c 78 36 65 27 5d 28 5f 30 78 34 34 32 63 38 38 5b 27 5c 78 36 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 27 5d 2c 77 69 6e 64 6f 77 5b 27 5c 78 36 63 5c 78 36 66 5c Data Ascii: x72\x72\x69\x64\x65\x43\x6f\x6f\x6b\x69\x65\x44\x6f\x6d\x61\x69\x6e']&&(_0x442c88['\x63\x6f\x6f\x6b\x69\x65']=_0x12b5b8['\x72\x65\x70\x6c\x61\x63\x65\x43\x6f\x6f\x6b\x69\x65\x44\x6f\x6d\x61\x69\x6e'](_0x442c88['\x63\x6f\x6f\x6b\x69\x65'],window['\x6c\x6f\
2023-10-17 16:18:01 UTC	332	IN	Data Raw: 78 35 37 61 30 33 38 3d 6e 65 77 20 5f 30 78 34 31 36 32 33 33 28 29 2c 5f 30 78 35 35 66 66 38 38 3d 6e 65 77 20 5f 30 78 33 33 65 66 65 36 28 29 2c 5f 30 78 32 64 34 63 62 37 3d 21 31 2c 5f 30 78 34 32 30 62 61 61 3d 6e 75 6c 6c 2c 5f 30 78 62 65 35 61 34 3d 21 31 2c 5f 30 78 34 33 64 61 34 39 3d 21 31 2c 5f 30 78 32 64 30 65 39 65 3d 5b 5f 30 78 36 65 38 31 63 39 28 35 35 34 29 2c 27 5c 78 36 33 5c 78 36 63 5c 78 36 39 5c 78 36 33 5c 78 36 62 27 2c 5f 30 78 36 65 38 31 63 39 28 34 32 35 29 2c 5f 30 78 36 65 38 31 63 39 28 36 30 30 29 2c 5f 30 78 36 65 38 31 63 39 28 31 32 38 29 2c 5f 30 78 36 65 38 31 63 39 28 31 35 37 29 2c 27 5c 78 36 62 5c 78 36 35 5c 78 37 39 5c 78 36 34 5c 78 36 66 5c 78 37 37 5c 78 36 65 27 2c 27 5c 78 36 62 5c 78 36 35 5c 78 37 Data Ascii: x57a038=new _0x416233(),_0x55ff88=new _0x33efe6(),_0x2d4cb7=!1,_0x420baa=null,_0xbe5a4=!1,_0x43da49=!1,_0x2d0e9e=[_0x6e81c9(554),'\x63\x6c\x69\x63\x6b',_0x6e81c9(425),_0x6e81c9(600),_0x6e81c9(128),_0x6e81c9(157),'\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x7
2023-10-17 16:18:01 UTC	348	IN	Data Raw: 5c 78 32 65 5c 78 32 66 5c 78 36 33 5c 78 36 66 5c 78 36 64 5c 78 36 64 5c 78 36 66 5c 78 36 65 5c 78 32 66 5c 78 34 34 5c 78 36 31 5c 78 37 34 5c 78 36 31 5c 78 34 34 5c 78 36 66 5c 78 36 64 5c 78 36 35 5c 78 35 35 5c 78 37 32 5c 78 36 63 5c 78 35 34 5c 78 36 66 5c 78 36 66 5c 78 36 63 5c 78 37 33 5c 78 32 65 5c 78 36 61 5c 78 37 33 27 29 5b 27 5c 78 36 64 5c 78 36 31 5c 78 37 34 5c 78 36 33 5c 78 36 38 5c 78 35 35 5c 78 35 32 5c 78 34 63 5c 78 34 33 5c 78 36 66 5c 78 36 65 5c 78 36 36 5c 78 36 39 5c 78 36 37 27 5d 28 5f 30 78 31 61 61 32 30 31 2c 5f 30 78 32 33 35 31 36 31 2c 5f 30 78 35 61 35 61 63 63 29 3b 7d 3b 7d 3b 7d 2c 5f 30 78 62 36 37 66 62 66 5d 2c 31 31 3a 5b 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 35 33 64 34 36 2c 5f 30 78 31 36 33 39 39 39 Data Ascii: \x2e\x2f\x63\x6f\x6d\x6d\x6f\x6e\x2f\x44\x61\x74\x61\x44\x6f\x6d\x65\x55\x72\x6c\x54\x6f\x6f\x6c\x73\x2e\x6a\x73')['\x6d\x61\x74\x63\x68\x55\x52\x4c\x43\x6f\x6e\x66\x69\x67'](_0x1aa201,_0x235161,_0x5a5acc);};};},_0xb67fbf],11:[function(_0x253d46,_0x163999

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	142.250.68.14	443	192.168.11.20	49544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:54 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-PjBTew3QaWT0oe7nU2WN6w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 Oct 2023 16:17:54 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6133 X-Daystart: 33474 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-17 16:17:54 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 33 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 33 34 37 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6133" elapsed_seconds="33474"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-17 16:17:54 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-17 16:17:54 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.11.20	62585	99.84.203.122	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	155	OUT	GET /common/fonts/roboto/roboto.woff2 HTTP/1.1 Host: static.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" Origin: https://geo.captcha-delivery.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.captcha-delivery.com/common/fonts/roboto/font-face.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.11.20	54475	99.84.203.122	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	187	OUT	GET /captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139 HTTP/1.1 Host: static.captcha-delivery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	99.84.203.122	443	192.168.11.20	62585	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	353	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 15688 Connection: close Access-Control-Allow-Origin: https://geo.captcha-delivery.com Access-Control-Allow-Methods: GET, HEAD Access-Control-Max-Age: 3000 Access-Control-Allow-Credentials: true Last-Modified: Fri, 06 May 2022 16:47:07 GMT x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 17 Oct 2023 04:17:38 GMT ETag: "aa23b7b4bcf2b8f0e876106bb3de69c6" Vary: Accept-Encoding,Origin X-Cache: Hit from cloudfront Via: 1.1 5f77bd93eaeac8e32d1c411a80449034.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX3-C3 X-Amz-Cf-Id: mfzFCSQm9EtqQjmbR8K_TXm2GxcYe0gkueL-J_OedKxRFtWwsD_oFA== Age: 43224
2023-10-17 16:18:01 UTC	354	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 3d 48 00 12 00 00 00 00 8e 74 00 00 3c e4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 64 1c 85 5e 06 60 00 83 20 08 54 09 83 3c 11 0c 0a 81 dc 7c 81 c4 7b 0b 84 0a 00 12 82 10 01 36 02 24 03 88 10 04 20 05 82 74 07 20 0c 82 49 1b 33 7f 15 ec d8 4b 80 f3 40 81 10 7d 8e 20 23 11 c2 c6 99 30 36 78 3d 32 90 db 01 a9 4a f8 fd e0 ff af 09 72 8c d1 c0 fe 06 6a f6 25 32 5b ce 90 5d a2 5b d6 5c 74 47 da 16 b2 da 25 2a 22 f2 8d 26 b1 a6 75 27 27 59 a2 08 4f 74 8b d0 62 e0 9f 92 de f9 79 32 8b 5f 63 5f 01 83 af a0 08 06 b8 e8 5d 83 a7 7c f9 22 5b e5 00 a1 02 d3 99 dd e1 0e 55 6d be d6 53 42 5f 6f 6d c2 8a 4e e6 c9 2b 3b 03 db 46 fe 24 27 2f 0f 91 dd ff ff af aa ae 9e d9 e7 0a d1 13 f4 65 66 df 11 Data Ascii: wOF2=Ht<dd^` T<\|{6$ t I3K@} #06x=2Jrj%2[][\tG%*"&u''YOtby2_c_]\|"[UmSB_omN+;F$'/ef

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	99.84.203.122	443	192.168.11.20	54475	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:01 UTC	369	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 27589 Connection: close Date: Tue, 17 Oct 2023 16:18:01 GMT Last-Modified: Mon, 23 Nov 2020 18:55:10 GMT ETag: "4a06ea2ba0bf9063d7c88afe6a74df11" Cache-Control: public x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 0bc1bd7d49e301d0a79457bc9c864cd2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX3-C3 X-Amz-Cf-Id: TapHa5GxMtmmiNcD-3nBtE9H04BY7kVSBNQZveoV3YQO4k1H9_aI5A== Age: 1
2023-10-17 16:18:01 UTC	369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 f9 00 00 00 fa 08 06 00 00 00 d3 02 92 bc 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 06 62 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRpHYs.#.#x?vbiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RD
2023-10-17 16:18:01 UTC	385	IN	Data Raw: 1c be 96 fd 2d ff b6 90 87 96 b7 d4 12 88 28 14 d2 f5 f4 90 86 dd 41 cd c8 be 8d f1 5c 57 fe e3 c0 e2 35 80 ff c3 f3 35 91 fb fd 8d 90 64 45 7c 64 31 de 23 29 18 21 24 f9 f6 e9 71 4f e3 b9 84 89 24 f9 24 31 f2 1d f6 5a f1 5d 9e d2 b8 70 44 44 44 44 44 44 44 44 43 84 9c e4 a3 7e b6 73 7a ff cf 53 1c c7 d8 9c 75 a5 65 82 8f 88 88 88 88 88 88 88 88 4e 59 70 49 be c7 27 cc 00 5c 59 2c f2 ab c5 b2 88 88 88 88 88 88 88 88 88 82 63 25 c9 27 63 bb d9 2a c7 d6 38 7c 1b 77 96 cb 23 22 22 22 22 22 22 22 22 0a ca bf 86 16 20 e3 e7 3d 3c 3e a1 05 f0 27 80 3b 93 19 56 a5 05 df 3d f4 67 25 3a 64 f9 96 67 7b 25 22 22 22 22 22 22 22 a2 b7 61 70 92 0f c0 1c 2a 31 17 41 8d a5 77 fd f8 84 35 80 bf 00 ac 8f 25 d9 1e 9f 10 cb 7a 73 0b b1 6c bb 75 50 26 11 11 11 11 11 11 11 11 Data Ascii: -(A\W55dE\|d1#)!$qO$$1Z]pDDDDDDDDC~szSueNYpI'\Y,c%'c8\|w#"""""""" =<>';V=g%:dg{%"""""""ap1Aw5%zsluP&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.11.20	49829	34.107.158.74	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	396	OUT	POST /js/ HTTP/1.1 Host: api-js.datadome.co Connection: keep-alive Content-Length: 5028 sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Content-type: application/x-www-form-urlencoded Accept: / Origin: https://geo.captcha-delivery.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-17 16:18:02 UTC	397	OUT	Data Raw: 6a 73 44 61 74 61 3d 25 37 42 25 32 32 6f 70 74 73 25 32 32 25 33 41 25 32 32 72 65 73 70 6f 6e 73 65 50 61 67 65 25 32 32 25 32 43 25 32 32 74 74 73 74 25 32 32 25 33 41 36 35 2e 39 30 30 30 30 30 30 30 30 31 33 39 37 25 32 43 25 32 32 69 66 6f 76 25 32 32 25 33 41 66 61 6c 73 65 25 32 43 25 32 32 64 70 30 25 32 32 25 33 41 66 61 6c 73 65 25 32 43 25 32 32 74 61 67 70 75 25 32 32 25 33 41 36 2e 32 33 30 34 37 34 39 32 38 39 35 39 36 38 38 25 32 43 25 32 32 67 6c 76 64 25 32 32 25 33 41 25 32 32 47 6f 6f 67 6c 65 25 32 30 49 6e 63 2e 25 32 30 28 49 6e 74 65 6c 29 25 32 32 25 32 43 25 32 32 67 6c 72 64 25 32 32 25 33 41 25 32 32 41 4e 47 4c 45 25 32 30 28 49 6e 74 65 6c 25 32 43 25 32 30 49 6e 74 65 6c 28 52 29 25 32 30 55 48 44 25 32 30 47 72 61 70 68 69 Data Ascii: jsData=%7B%22opts%22%3A%22responsePage%22%2C%22ttst%22%3A65.9000000001397%2C%22ifov%22%3Afalse%2C%22dp0%22%3Afalse%2C%22tagpu%22%3A6.230474928959688%2C%22glvd%22%3A%22Google%20Inc.%20(Intel)%22%2C%22glrd%22%3A%22ANGLE%20(Intel%2C%20Intel(R)%20UHD%20Graphi

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.11.20	61232	35.173.82.140	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	402	OUT	GET /favicon.ico HTTP/1.1 Host: members.iiasd.org Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-model: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://members.iiasd.org/surveys/?id=Convention_2023 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	34.107.158.74	443	192.168.11.20	49829	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	403	IN	HTTP/1.1 200 OK Date: Tue, 17 Oct 2023 16:18:02 GMT Server: DataDome Access-Control-Allow-Origin: * Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Content-Type: application/json;charset=utf-8 Content-Length: 241 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-17 16:18:02 UTC	403	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 63 6f 6f 6b 69 65 22 3a 22 64 61 74 61 64 6f 6d 65 3d 41 48 34 34 36 42 65 46 73 30 4d 78 58 56 31 36 6c 73 6d 48 67 4b 66 64 7a 63 70 4f 74 67 64 76 32 54 41 76 52 67 34 53 63 63 62 61 70 6a 38 34 57 7e 58 42 5a 74 52 4a 51 73 34 56 63 38 62 38 6e 72 52 6c 76 68 53 31 62 7e 56 67 53 70 78 5a 42 63 67 43 4b 75 44 6f 38 70 63 72 6c 5a 6f 50 57 4c 7e 32 66 76 55 58 30 72 6e 77 4b 36 38 62 71 4e 49 32 41 72 78 58 7a 43 78 6b 48 71 4f 77 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 33 36 30 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 63 61 70 74 63 68 61 2d 64 65 6c 69 76 65 72 79 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 7d Data Ascii: {"status":200,"cookie":"datadome=AH446BeFs0MxXV16lsmHgKfdzcpOtgdv2TAvRg4Sccbapj84W~XBZtRJQs4Vc8b8nrRlvhS1b~VgSpxZBcgCKuDo8pcrlZoPWL~2fvUX0rnwK68bqNI2ArxXzCxkHqOw; Max-Age=31536000; Domain=.captcha-delivery.com; Path=/; Secure; SameSite=Lax"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.11.20	51683	34.107.158.74	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	403	OUT	GET /js/ HTTP/1.1 Host: api-js.datadome.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	34.107.158.74	443	192.168.11.20	51683	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	404	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html;charset=iso-8859-1 Content-Length: 319 Date: Tue, 17 Oct 2023 16:18:02 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-17 16:18:02 UTC	404	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 3c 2f 68 32 3e 0a 3c 70 3e 50 72 6f 62 6c 65 6d 20 61 63 63 65 73 73 69 6e 67 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 20 52 65 61 73 6f 6e 3a 0a 3c 70 72 65 3e 20 20 20 20 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 70 72 Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=utf-8"/><title>Error 405</title></title></head><body><h2>HTTP ERROR 405</h2><p>Problem accessing this resource. Reason:<pre> HTTP method GET is not supported by this URL</pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	35.173.82.140	443	192.168.11.20	61232	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:02 UTC	404	IN	HTTP/1.1 200 OK Date: Tue, 17 Oct 2023 16:18:02 GMT Content-Type: image/x-icon Content-Length: 198 Connection: close Last-Modified: Thu, 28 Sep 2023 14:03:14 GMT Accept-Ranges: bytes ETag: "03dab8514f2d91:0" X-Powered-By: ASP.NET Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2023-10-17 16:18:02 UTC	405	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 01 00 01 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 Data Ascii: (

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	142.250.72.237	443	192.168.11.20	56646	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:54 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 Oct 2023 16:17:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-4jJmcLXaHfmxtBu0DevTAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-17 16:17:54 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-17 16:17:54 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.11.20	63593	35.173.82.140	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:03 UTC	405	OUT	GET /favicon.ico HTTP/1.1 Host: members.iiasd.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	35.173.82.140	443	192.168.11.20	63593	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:03 UTC	405	IN	HTTP/1.1 200 OK Date: Tue, 17 Oct 2023 16:18:03 GMT Content-Type: image/x-icon Content-Length: 198 Connection: close Last-Modified: Thu, 28 Sep 2023 14:03:14 GMT Accept-Ranges: bytes ETag: "03dab8514f2d91:0" X-Powered-By: ASP.NET Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2023-10-17 16:18:03 UTC	406	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 01 00 01 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 Data Ascii: (

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.11.20	58100	34.107.158.74	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:14 UTC	406	OUT	POST /js/ HTTP/1.1 Host: api-js.datadome.co Connection: keep-alive Content-Length: 5451 sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Content-type: application/x-www-form-urlencoded Accept: / Origin: https://geo.captcha-delivery.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geo.captcha-delivery.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-17 16:18:14 UTC	407	OUT	Data Raw: 6a 73 44 61 74 61 3d 25 37 42 25 32 32 6f 70 74 73 25 32 32 25 33 41 25 32 32 72 65 73 70 6f 6e 73 65 50 61 67 65 25 32 32 25 32 43 25 32 32 74 74 73 74 25 32 32 25 33 41 36 35 2e 39 30 30 30 30 30 30 30 30 31 33 39 37 25 32 43 25 32 32 69 66 6f 76 25 32 32 25 33 41 66 61 6c 73 65 25 32 43 25 32 32 64 70 30 25 32 32 25 33 41 66 61 6c 73 65 25 32 43 25 32 32 74 61 67 70 75 25 32 32 25 33 41 36 2e 32 33 30 34 37 34 39 32 38 39 35 39 36 38 38 25 32 43 25 32 32 67 6c 76 64 25 32 32 25 33 41 25 32 32 47 6f 6f 67 6c 65 25 32 30 49 6e 63 2e 25 32 30 28 49 6e 74 65 6c 29 25 32 32 25 32 43 25 32 32 67 6c 72 64 25 32 32 25 33 41 25 32 32 41 4e 47 4c 45 25 32 30 28 49 6e 74 65 6c 25 32 43 25 32 30 49 6e 74 65 6c 28 52 29 25 32 30 55 48 44 25 32 30 47 72 61 70 68 69 Data Ascii: jsData=%7B%22opts%22%3A%22responsePage%22%2C%22ttst%22%3A65.9000000001397%2C%22ifov%22%3Afalse%2C%22dp0%22%3Afalse%2C%22tagpu%22%3A6.230474928959688%2C%22glvd%22%3A%22Google%20Inc.%20(Intel)%22%2C%22glrd%22%3A%22ANGLE%20(Intel%2C%20Intel(R)%20UHD%20Graphi

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	34.107.158.74	443	192.168.11.20	58100	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:15 UTC	412	IN	HTTP/1.1 200 OK Date: Tue, 17 Oct 2023 16:18:14 GMT Server: DataDome Access-Control-Allow-Origin: * Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Content-Type: application/json;charset=utf-8 Content-Length: 241 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-17 16:18:15 UTC	412	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 63 6f 6f 6b 69 65 22 3a 22 64 61 74 61 64 6f 6d 65 3d 30 56 69 5f 78 74 46 37 57 51 66 6c 49 32 44 37 63 53 4c 72 52 35 47 4d 39 6b 45 45 32 37 4a 69 6d 77 34 48 6d 70 56 61 6f 70 4e 54 46 6e 34 39 41 50 52 67 5f 35 76 59 62 37 64 36 62 77 6e 72 6e 68 46 33 6e 32 63 68 32 77 32 5a 78 36 7a 71 4b 55 68 6e 52 69 53 6f 4b 73 6e 41 46 75 33 5f 65 72 31 70 75 44 6f 37 75 6d 59 58 4c 65 4d 42 47 77 54 77 67 6b 73 5f 6c 54 47 69 4c 6c 53 4c 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 33 36 30 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 63 61 70 74 63 68 61 2d 64 65 6c 69 76 65 72 79 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 22 7d Data Ascii: {"status":200,"cookie":"datadome=0Vi_xtF7WQflI2D7cSLrR5GM9kEE27Jimw4HmpVaopNTFn49APRg_5vYb7d6bwnrnhF3n2ch2w2Zx6zqKUhnRiSoKsnAFu3_er1puDo7umYXLeMBGwTwgks_lTGiLlSL; Max-Age=31536000; Domain=.captcha-delivery.com; Path=/; Secure; SameSite=Lax"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.11.20	58411	34.107.158.74	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:15 UTC	412	OUT	GET /js/ HTTP/1.1 Host: api-js.datadome.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	34.107.158.74	443	192.168.11.20	58411	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:18:15 UTC	413	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html;charset=iso-8859-1 Content-Length: 319 Date: Tue, 17 Oct 2023 16:18:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-17 16:18:15 UTC	413	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 3c 2f 68 32 3e 0a 3c 70 3e 50 72 6f 62 6c 65 6d 20 61 63 63 65 73 73 69 6e 67 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 20 52 65 61 73 6f 6e 3a 0a 3c 70 72 65 3e 20 20 20 20 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 70 72 Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=utf-8"/><title>Error 405</title></title></head><body><h2>HTTP ERROR 405</h2><p>Problem accessing this resource. Reason:<pre> HTTP method GET is not supported by this URL</pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	52443	34.237.251.168	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:56 UTC	4	OUT	GET /L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344 HTTP/1.1 Host: 458rl1jp.r.us-east-1.awstrack.me Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	34.237.251.168	443	192.168.11.20	52443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:56 UTC	5	IN	HTTP/1.1 302 Found Date: Tue, 17 Oct 2023 16:17:55 GMT Location: https://members.iiasd.org/surveys/?id=Convention_2023 Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	54357	35.173.82.140	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:57 UTC	5	OUT	GET /surveys/?id=Convention_2023 HTTP/1.1 Host: members.iiasd.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	35.173.82.140	443	192.168.11.20	54357	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:58 UTC	6	IN	HTTP/1.1 403 Forbidden Date: Tue, 17 Oct 2023 16:17:57 GMT Content-Type: text/html;charset=utf-8 Content-Length: 580 Connection: close X-DataDome: protected Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory Charset: utf-8 Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate Pragma: no-cache X-DataDome-CID: AHrlqAAAAAMAh4D1fahKeeEAZoGRIA== Set-Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc; Max-Age=31536000; Domain=.iiasd.org; Path=/; Secure; SameSite=Lax
2023-10-17 16:17:58 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 69 69 61 73 64 2e 6f 72 67 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 23 63 6d 73 67 7b 61 6e 69 6d 61 74 69 6f 6e 3a 20 41 20 31 2e 35 73 3b 7d 40 6b 65 79 66 72 61 6d 65 73 20 41 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 7d 39 39 25 7b 6f 70 61 63 69 74 79 3a 30 3b 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 22 3e 3c 70 20 69 64 3d 22 63 6d 73 67 22 3e 50 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 4a 53 20 61 6e 64 20 64 69 73 61 62 6c 65 20 61 6e 79 20 61 64 20 62 6c 6f 63 6b 65 72 3c 2f 70 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 3e 76 Data Ascii: <html><head><title>iiasd.org</title><style>#cmsg{animation: A 1.5s;}@keyframes A{0%{opacity:0;}99%{opacity:0;}100%{opacity:1;}}</style></head><body style="margin:0"><p id="cmsg">Please enable JS and disable any ad blocker</p><script data-cfasync="false">v

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	51707	13.226.228.36	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:58 UTC	7	OUT	GET /c.js HTTP/1.1 Host: ct.captcha-delivery.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://members.iiasd.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	13.226.228.36	443	192.168.11.20	51707	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-17 16:17:59 UTC	7	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 6313 Connection: close Date: Tue, 17 Oct 2023 12:25:45 GMT Last-Modified: Tue, 17 Oct 2023 12:25:23 GMT ETag: "10dfd7a432e1f0339945a67e3252139c" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 aa1f70daaa47b93e5c2a62ff47f68d56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-C3 X-Amz-Cf-Id: 2uEKVcAgRZmy-uZntrkZANA6lyI6W9gOr4eeQkSNEdxXUSZEQpub3w== Age: 13934
2023-10-17 16:17:59 UTC	8	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 2f 2a 2a 0a 20 20 20 20 20 2a 20 53 61 76 65 73 20 61 63 74 75 61 6c 20 72 65 66 65 72 72 65 72 20 74 6f 20 73 65 73 73 69 6f 6e 20 73 74 6f 72 61 67 65 0a 20 20 20 20 20 2a 20 40 72 65 74 75 72 6e 20 7b 76 6f 69 64 7d 0a 20 20 20 20 20 2a 2f 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 73 61 76 65 52 65 66 65 72 72 65 72 28 29 20 7b 0a 20 20 20 20 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 27 64 64 4f 72 69 67 69 6e 61 6c 52 65 66 65 72 72 65 72 27 2c 20 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 20 20 20 20 20 20 20 20 7d 20 63 61 74 63 68 20 28 65 72 72 6f 72 29 20 7b 0a Data Ascii: (function () { /** * Saves actual referrer to session storage * @return {void} */ function saveReferrer() { try { window.sessionStorage.setItem('ddOriginalReferrer', document.referrer); } catch (error) {

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	18:17:51
Start date:	17/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7d0b60000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	18:17:52
Start date:	17/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,9976906793806323828,1916143722008436818,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 /prefetch:8
Imagebase:	0x7ff7d0b60000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:17:54
Start date:	17/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344
Imagebase:	0x7ff7d0b60000
File size:	2'509'656 bytes
MD5 hash:	464953824E644F10FFDC9E093FD18F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Source: https://members.iiasd.org/surveys/?id=Convention_2023	HTTP Parser: No favicon
Source: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAh4D1fahKeeEAZoGRIA%3D%3D&hash=2CF1354F5D33C04234B753357EE0F0&cid=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc&t=fe&referer=https%3A%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid%3DConvention_2023&s=18464&e=b821de14ea111615f4edf644f2cb6d11e84a187fbd64e97b625c2674325e7e2f	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-94.0.4606.61Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344 HTTP/1.1Host: 458rl1jp.r.us-east-1.awstrack.meConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /surveys/?id=Convention_2023 HTTP/1.1Host: members.iiasd.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.js HTTP/1.1Host: ct.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://members.iiasd.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/?initialCid=AHrlqAAAAAMAh4D1fahKeeEAZoGRIA%3D%3D&hash=2CF1354F5D33C04234B753357EE0F0&cid=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc&t=fe&referer=https%3A%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid%3DConvention_2023&s=18464&e=b821de14ea111615f4edf644f2cb6d11e84a187fbd64e97b625c2674325e7e2f HTTP/1.1Host: geo.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://members.iiasd.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css HTTP/1.1Host: static.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://geo.captcha-delivery.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/fonts/roboto/font-face.css HTTP/1.1Host: static.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://geo.captcha-delivery.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139 HTTP/1.1Host: static.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://geo.captcha-delivery.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tags.js HTTP/1.1Host: js.datadome.coConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://geo.captcha-delivery.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/fonts/roboto/roboto.woff2 HTTP/1.1Host: static.captcha-delivery.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"Origin: https://geo.captcha-delivery.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.captcha-delivery.com/common/fonts/roboto/font-face.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/set/6dd7cb5359f54edb9eb0becd33d19118d3e93e26/logo.png?update_cache=2408786060224526139 HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: members.iiasd.orgConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-model: sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://members.iiasd.org/surveys/?id=Convention_2023Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc
Source: global traffic	HTTP traffic detected: GET /js/ HTTP/1.1Host: api-js.datadome.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: members.iiasd.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=e~BGEu68PrpKrnyrPVLvdV4EdjEHnpxGjp_XHECFg6S0HVsa1Kohaqvfra~oEcf7qGgg2RdauNK~RzIwFMvObMPz92LIBzyDCWf3CmK2IzOjqJA3DtKJm0RcaeDlWiyc
Source: global traffic	HTTP traffic detected: GET /js/ HTTP/1.1Host: api-js.datadome.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	TCP traffic: 192.168.11.20:60987 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:60987 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:60987 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:60987 -> 239.255.255.250:1900

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5768, Parent PID: 5136

General

File Activities

File Opened

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

Process Activities

Process Created

Process Terminated

Thread Activities

Thread Terminated

Memory Activities

Memory Usage Statistics

Windows Analysis Report
https:/458rl1jp.r.us-east-1.awstrack.me/L0/https:%2F%2Fmembers.iiasd.org%2Fsurveys%2F%3Fid=Convention_2023/1/0100018b3e12279d-e727ffa9-e7f1-4823-b721-a57801c3275a-000000/skMU3gbPAfcMHPAB2YbPLnQK65o=344