Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com

Overview

General Information

Sample URL:https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
Analysis ID:1399959
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Stores files to the Windows start menu directory
URL contains potential PII (phishing indication)
Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 3176 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,12986730996068424384,15838849726941630066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 1876 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comSlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
Source: https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comSample URL: PII: utilities@affordablecare.com
Source: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49727 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49727 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Feb 2024 23:31:27 GMTServer: ApacheLast-Modified: Thu, 29 Sep 2022 22:57:04 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1191Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: application/javascriptData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 7f 45 64 1e 89 eb 4a 06 c3 d4 13 c4 f3 78 ac fb 5b a3 54 34 45 f3 5c 81 5e 60 b3 e7 2d bc 4b 2d 51 0a 15 ee 3a ee 0b db 3c d1 b6 84 dc 82 a8 43 9e 36 4e ed 45 8a 14 59 9a 0d cc 94 70 2e 4d 2a a3 94 58 39 a8 13 9e 8b ba 6e a3 91 04 1f f4 7b 1a b3 4d 35 e7 c5 69 ef b1 aa d7 da 1b 48 bd 5e 57 df bb 6f bf 7b 20 f9 ee 48 65 de e9 5f 96 65 df 01 17 18 27 f0 e2 07 b5 f7 c2 c9 2a 19 8d ba ba 7d 8b f7 ff ef 09 57 fe c2 9e 58 e7 f7 54 0d 54 0f 1f 4f 6d f5 d9 02 79 b1 96 7e b9 2b 7b da ca 79 cf 3b f9 77 76 1c 8d 86 79 b4 23 ed 5b 13 ad e4 12 a8 79 b0 33 d3 b0 65 1f ac 35 36 7d 69 d3 82 7d 37 87 99 95 5f c8 2c fc b3 96 16 1c eb c6 32 34 ec 1e 58 3b 38 4f c2 0d de 1d b1 af 0f d5 7b 07 cb ae b1 0f 3b 46 ae c5 12 c8 4c d1 cf 48 78 f5 5a a9 e7 67 ff 95 24 17 bb 7d f1 e7 ed cd b5 77 af f3 ae eb f6 9c ba 34 50 32 f8 19 27 3c ae 18 9c 4f 3d 22 5d 62 2e 10 89 83 4b 32 d7 94 9a f5 0b aa 62 f1 b4 6f fc 38 26 e5 99 2c ed 17 fd 95 ca 07 93 e7 67 9a d7 62 97 c1 2f 62 03 a7 d8 32 fd cb e8 da 85 a7 d8 ec 8f b0 c9 13 6c 53 f9 c5 7e 2d 75 f6 73 ba b3 40 a9 43 4b 71 39 7f 4a 25 cf 76 56 6c 8b c1 24 5b 09 6c 8a ad d4 b5 d9 e6 ca 54 c2 5f 90 fb a0 a6 be 7d a0 1f 83 cd 4f ee eb 88 8a c9 99 73 24 49 47 4c 0f 43 23 6b b8 32 b5 b7 65 32 17 35 dc 85 f2 e4 42 e7 c7 57 7a fe db 84 17 3f 68 ba 17 4e 56 be 3e 2e 4a 79 31 cc a5 fb bd c3 f2 4a 17 1f 8d 5e 89 7a d4 99 e5 7d c5 28 44 81 c1 f9 f1 46 3a e3 78 26 f0 dd e1 9e 46 b8 99 12 74 64 02 8f 2b 41 c2 90 4e 17 e9 a1 2d a6 2a a3 94 58 39 a8 d9 b1 88 c6 f3 e2 b4 b0 4b b3 43 87 2f 9c 04 b2 49 f1 fa 4e d8 05 a0 7b c1 38 41 dd 45 03 7c f9 da b9 37 11 f7 ce a8 35 42 c2 65 39 4c 2d 9f 82 72 c0 ba ac 05 45 72 6e 42 36 0e fe 04 1b 50 37 1a de 93 1b
Source: global trafficHTTP traffic detected: GET /campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com HTTP/1.1Host: tracker.club-os.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /jahn/00987667839933/utilities@affordablecare.com HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/js/simple-expand.min.js HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/x.png HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://demsaenlinea.mx/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/x.png HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: demsaenlinea.mxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: unknownDNS traffic detected: queries for: tracker.club-os.com
Source: unknownHTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1709076669819&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Feb 2024 23:31:27 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Thu, 29 Sep 2022 22:59:45 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Keep-Alive: timeout=5, max=75Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Feb 2024 23:31:28 GMTServer: ApacheLast-Modified: Thu, 29 Sep 2022 22:59:45 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownHTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: classification engineClassification label: mal48.win@17/26@10/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,12986730996068424384,15838849726941630066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,12986730996068424384,15838849726941630066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media5
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive6
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture4
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com0%Avira URL Cloudsafe
https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com100%SlashNextCredential Stealing type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://demsaenlinea.mx/cgi-sys/images/x.png0%Avira URL Cloudsafe
http://demsaenlinea.mx/cgi-sys/images/404mid.gif0%Avira URL Cloudsafe
http://demsaenlinea.mx/cgi-sys/images/404top_w.jpg0%Avira URL Cloudsafe
http://demsaenlinea.mx/favicon.ico0%Avira URL Cloudsafe
http://demsaenlinea.mx/cgi-sys/images/404bottom.gif0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
code.jquery.com
151.101.194.137
truefalse
    		high
    tracker.club-os.com
    		44.206.44.177
    		truefalse
      		high
      www.google.com
      		172.253.63.104
      		truefalse
        		high
        demsaenlinea.mx
        		162.241.60.132
        		truefalse
          		unknown
          fp2e7a.wpc.phicdn.net
          		192.229.211.108
          		truefalse
            		unknown
            windowsupdatebg.s.llnwi.net
            		69.164.0.0
            		truefalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comfalse
                		unknown
                http://demsaenlinea.mx/cgi-sys/images/404mid.giffalse
                • Avira URL Cloud: safe
                		unknown
                https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comfalse
                  		high
                  http://demsaenlinea.mx/favicon.icofalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://demsaenlinea.mx/cgi-sys/images/404bottom.giffalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://demsaenlinea.mx/cgi-sys/images/404top_w.jpgfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://demsaenlinea.mx/cgi-sys/images/x.pngfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://code.jquery.com/jquery-3.3.1.min.jsfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    44.206.44.177
                    		tracker.club-os.comUnited States
                    		14618AMAZON-AESUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    162.241.60.132
                    		demsaenlinea.mxUnited States
                    		46606UNIFIEDLAYER-AS-1USfalse
                    172.253.63.104
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    151.101.194.137
                    		code.jquery.comUnited States
                    		54113FASTLYUSfalse

                    Private

                    IP
                    192.168.2.5

                    General Information

                    Joe Sandbox version:40.0.0 Tourmaline
                    Analysis ID:1399959
                    Start date and time:2024-02-28 00:30:34 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 3m 4s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:browseurl.jbs
                    Sample URL:https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:7
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal48.win@17/26@10/6
                    EGA Information:Failed
                    HCA Information:
                    • Successful, ratio: 100%
                    • Number of executed functions: 0
                    • Number of non-executed functions: 0

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 142.251.167.94, 142.251.167.84, 172.253.62.139, 172.253.62.101, 172.253.62.113, 172.253.62.100, 172.253.62.138, 172.253.62.102, 34.104.35.123, 40.68.123.157, 69.164.0.128, 192.229.211.108, 69.164.0.0, 20.166.126.56, 72.21.81.240, 172.253.115.94
                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
                    • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtSetInformationFile calls found.
                    • VT rate limit hit for: https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com

                    Simulations

                    Behavior and APIs

                    ⊘No simulations

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 22:31:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.982146523407861
                    Encrypted:false
                    SSDEEP:48:8gdNTVNRHvidAKZdA19ehwiZUklqeh1y+3:8yDXmy
                    MD5:CEA3AA345D750FC73B8966253C5F3F74
                    SHA1:2584CB5898E79E8772DC57DEB41B9EEEA2220B7C
                    SHA-256:8073F7863D705CAA3906467D19F5E9388C9393CBDD7FD48DC57DF768DEC05B76
                    SHA-512:FF2000E7FE033BA4FAD475B297C470064CB91F621821B114D050B3C92C7782124F37124D0E523CE8F3911A3C3D285B73ED6096426989D556B0F7BC40222B9814
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,......+..i..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 22:31:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.9975704328063757
                    Encrypted:false
                    SSDEEP:48:8kdNTVNRHvidAKZdA1weh/iZUkAQkqehWy+2:8uDd9QLy
                    MD5:0BBC5DD7CA6CA1063ECE70C055751326
                    SHA1:1FAE5BCB3AD69384F08E20E22F194563C7864BAD
                    SHA-256:21A78F38656BE9DB27C187C8123183B2EE20CC3C806BE0F5DE6F67E9D0A9857A
                    SHA-512:C1F0B67B5BE78214BA9D065BEB265BC38C96BE7635D25F74F199689A6CD39E4F9774D158D9A9F3704AE5FF2D8C981FE5CBB596013792CBF75E6FC9B6D9B958F7
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.........i..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2693
                    Entropy (8bit):4.0104434947777765
                    Encrypted:false
                    SSDEEP:48:8x+dNTVNsHvidAKZdA14tseh7sFiZUkmgqeh7sEy+BX:8x4D6nqy
                    MD5:AB46489A70449E6BC90B08869F9AD8F1
                    SHA1:1D08E97B6599F50843323F9F372FABB8E5AF135E
                    SHA-256:5304E1C0E841D20FDB2FA9273F08FBB80461B75323B0524C03AC7BEB61FF4EC5
                    SHA-512:03DAA0D362A9DE74E09388438571C473ABF197729BEEB037D327043789036271780AF9327250DD9D717FCEE5CE173A9D290EFEDF73C41F4DEE4BB84B4808A512
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 22:31:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2681
                    Entropy (8bit):3.9955003034574057
                    Encrypted:false
                    SSDEEP:48:8wdNTVNRHvidAKZdA1vehDiZUkwqehCy+R:8iDe8y
                    MD5:9CB13AF9A9E09C6B60478E80DDBFD2F8
                    SHA1:F5537469EF44710B126391931B5B282A4AA2F725
                    SHA-256:7F5E3E9EAAB4C6A4956B6D26F2FE5113C9085D8CE87D787D77F54B4CA53B4115
                    SHA-512:7A696C0029603E72E28310D9B85987A1BF28889F5AC6B9BE89BB260018A73990BDCD4A3998A8BAAD9BF9D58CF7A2A0D9DF282FEF84277354FB808536B5CA9E11
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....g....i..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 22:31:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2681
                    Entropy (8bit):3.9865469311230366
                    Encrypted:false
                    SSDEEP:48:8KdNTVNRHvidAKZdA1hehBiZUk1W1qehIy+C:8MDu9oy
                    MD5:61C6746C8B22514573C3AF19C05168DA
                    SHA1:8521301F05521B18B7BF5F49813A87D477A0865F
                    SHA-256:E7F7FD3A1498EB3DA6A9348326A88E058688D1692D4DA998BCE636E70D3AC21B
                    SHA-512:1B36DB0F856EF467C4291174A7ECD05AC416436F43CB385027FF4603E844B7CC59F1773B856A582EF347A7CD6E1B18C89222A6573A0AF76FE142B299EB3A7DC7
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,......%..i..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 27 22:31:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2683
                    Entropy (8bit):3.9958899392807865
                    Encrypted:false
                    SSDEEP:48:8sydNTVNRHvidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbqy+yT+:8sEDQT/TbxWOvTbqy7T
                    MD5:8B461DEE23EC6F76F3822088C56DC7FF
                    SHA1:25C68ED7BBD08EB430EB515DF2046095B42052EC
                    SHA-256:E34DCBFEB3295D5E4C31F01C1CFEFC8A5FE05245CCF6A1F833814C5AB6D9DF3A
                    SHA-512:1D47B00AEC8F125DF58879DEE6A90BE87312A27C0159976AE271A96F4EB8A88DF16B32922B1BDFDF24E2740F18AE0C61EF76714CE1BFAA572F2E0995FFC3AE3D
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....t;...i..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    Chrome Cache Entry: 63

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 97 x 97, 8-bit colormap, non-interlaced
                    Category:downloaded
                    Size (bytes):2672
                    Entropy (8bit):7.864218635615192
                    Encrypted:false
                    SSDEEP:48:TlCtqLaLvN6P+NsI1hmhzoioE0jAoeZBrnFIVVbtdoV0GdXSnZ9wKS6Ei3:ItqLaLVvk9X08n3nWV5+B1SnZ9wKfD3
                    MD5:F851DB995B0253A71D638F779BE88330
                    SHA1:5F5319E016676E6B92F7E597B837677DDF52C0A5
                    SHA-256:2C024E287D53DCC084B60B01A69990C369E758DC7C91B0FE4791F02D18AAE61A
                    SHA-512:AB09FAECBB8C24ACADE89EFC25515C2B25C12C378144180E5B807309F793720E30BCE75A604515181554068FE4BAAD34E4EE050A6B5C5F9485D1E4712B9EC724
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/cgi-sys/images/x.png
                    Preview:.PNG........IHDR...a...a.......?.....sBIT.....O....`PLTEf.....^^.77...zz|....uu.-&.{W.........A-. ..3&.iH.RB.......\@....//.............`.....t.__...3j&.....pHYs...........~.....tEXtCreation Time.03/04/09.......tEXtSoftware.Adobe Fireworks CS4......]IDATh....z....1.H..*..m....[....t...6..........]].S.SY.C..z.O..................g^tf.e:0[...^..B19.m9......5(.....p......Z..1.E.}....Z.Q..R...w........C.......;..ZH..j8stB0....t..._4M.D{..c.U..:...w..*..&.q...f..+..F..b.7*...H...P........u.s..D....?.n.S.H...su....K.!R;DN..BA._..K,..]/....(o.}..~...v.Gke.~.66.+..#6.SW.N..w9.&.}..m...j...kW.....0E.{.........8...!2NT.....AU../.kUu...D._..w.[..........]%@.cm.(.UU..L_.%....XWU..3[.T...m. J...T.9@..Of.b....C|Ukk/..R8.H.>p.V....R.....e.Es$...=@x...A...?.$..=.....T<..`j..o4.B..b.......]...h.M.p....<z.:.@H.*....y..N.........."..0T.....X..71.4...k..$...V.Tx^...s...}..1../.7.`s+..6..W!..!.zR....V....I..N...}7}...X-.2T.........6).V........`6+.Y..6t'".U/.#>F..80.

                    Chrome Cache Entry: 64

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:gzip compressed data, from Unix, original size modulo 2^32 2782
                    Category:downloaded
                    Size (bytes):1191
                    Entropy (8bit):7.796270292729931
                    Encrypted:false
                    SSDEEP:24:XcZ+V72kAJOJMbpIYwbu7xzHfOHSyW3BgOk0o8fG+ITcIlp4ezR1ZO5:XcZKAeYpIrqzHfkSLHkbH4sRjO5
                    MD5:DE892F8C9F4F88B59E09D5F162C5E1F2
                    SHA1:1D257DA4E5DDE3A5817F2F41F047BAFD49B646A3
                    SHA-256:70C74579F4A1E433CC33E298EA1C08073BFFCDFB6D6DD36163C942B2C8FE4381
                    SHA-512:84006416B70DFE6B8CBA6F5EAA0F618406D8404A9FE0E04680BAC3D63F43294F7514A1777D1882A19574331599E4A3E4BC4B6298822535C7283CC1557A2024DC
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/cgi-sys/js/simple-expand.min.js
                    Preview:...........RMo.8...W.a..";.."C...b.m...=.=0..bC.^rl'p..wHJ....|.8.o.{.lfVOV..d.w..w..Im........5..5.+W......>..rl.n.:.4vr.Rp..+..7W.w.@Wp.b..w.x).....~....#...7.|.+.F.C.K...C++L.].A.w.a...H7....X+t.5\...d.j.3...$k. l...JX.xH....,...1$..f{...sR/..`.=..nQ \.1....yV..k..H^...3.. .....9<.:=.......R.`..F.{ZV....3.w.pm..P."..Ed...J......x..[.T4E.\.^`..-.K-Q...:...<....C.6N.E..Y...p.M*..X9.....n.....{..M5..i....H.^W.o.{ ..He.._.e....'.......*....}.....W..X..T.T..Om...y..~.+{..y.;.wv...y.#.[.....y.3.e..56}i.}7..._.,.......24..X;8O........{....;F....L..Hx.Z..g..$..}....w......4P2..'<...O="]b....K2.....b.o.8&.,........g..b../b...2.........lS..~-u.s..@.CKq9.J%.vVl..$[.l......T._.....}....O...s$IGL.C#k.2..e2.5...B..Wz...?h..NV.>.Jy1.....J...^.z..}.(D....F:.x&...F...td..+A.N..-.*..X9......K.C./...I..N...{.8A.E.|..7...5B.e9L-..r....ErnB6....P7......i.JX..U.l....W..0%.......LF......F.r/K\....[..g@......p....t...T_5P=|$,A.K=...l.2..~.Ky.9..I.

                    Chrome Cache Entry: 65

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:GIF image data, version 89a, 868 x 4
                    Category:downloaded
                    Size (bytes):120
                    Entropy (8bit):6.060493667147718
                    Encrypted:false
                    SSDEEP:3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
                    MD5:DC8055F43FBB4A4B6DFB298EC35188F2
                    SHA1:1FFC540743DE1CDB929D9D1218978005141E8D9D
                    SHA-256:B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
                    SHA-512:2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/cgi-sys/images/404mid.gif
                    Preview:GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

                    Chrome Cache Entry: 66

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:gzip compressed data, max compression, from Unix, original size modulo 2^32 86927
                    Category:downloaded
                    Size (bytes):30288
                    Entropy (8bit):7.989374364238999
                    Encrypted:false
                    SSDEEP:384:vqVmdqPCM85TevWTS9XJbgB2EttwJ52qjCpG6XUcUsJ5plH94VYb/n9SjXjwPG6G:vqUdH5TevT9Zi2CtE5FcGcUvq9f9tG
                    MD5:FA20D8437865646E82DC61B9ADF6C93E
                    SHA1:936B2B3A3757ECA48867CF43BADEF1C608177A28
                    SHA-256:777EFEE22CC03118F4E5BA78AEF0CF7ADB1E8A13FC2B5C60FD220E80472F0188
                    SHA-512:81C77E1A7B29D089EF10056C10AAC8F696CC889499D9B68B40550E861173557EDAF39049859188FE9EEC55F69B3B22B05044AFD8B6B212101EC792A7FD289F02
                    Malicious:false
                    Reputation:low
                    URL:http://code.jquery.com/jquery-3.3.1.min.js
                    Preview:............y{.F./...)D....-Jr&.w@..8^.gs&v.C1y .I!.....D.|.[......3s.}3c.K.......q.....Uqwp........ .F._.=x...YR.yv.d....T..4.".XWyQR.......X./..Ju...........JT.}...%}6..a._...B..n....U>[/.....u....5o......Je..fz'Q\....W....".9......00c....P.Arp.f3*s.V.tg...a..u..P+.6.a@3..i.fA.vW.?.?qu...i.N..L.'..F"R..'a.P.wE^...\.2...`.....4.DI..uy).tA..[*...[1..A.........eR....*.;.....L...d..u..D..i;..B...>.W.....W......d.L....... [/.T..T.@..V\.{...NDYL.......v...,..<.4?a%.....B%.z.T..0(.E..*.@.J.VR.ws... ....l.N...~$..a5.T.l..V*.=.L..0...........u._+.f.zu....(...~..;..6...T..x..CE.*b>...-.{!.....M..M.........7[.N..:>/..^.zu~..d...../..L..V.....m.`.@x=........e|"..YQ$w..t...x......m.,.p..NF...>~...I..M.....J...Ub.*..*....x..#..-M.U...%..j+T2......o.B.b+..UW1n..,.~$.....pMqeF,2,SD..>..V.9.sy..N..#.......U...O..2y...).Q.t...".}..y..zR.........y..$.OP}6.;J.*.....KQ.A..b..Q.x../....6$..s..0... .B..M.......R..nu...w:.....|..o.'.H.2iTV....H...d.Y.I..

                    Chrome Cache Entry: 67

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 97 x 97, 8-bit colormap, non-interlaced
                    Category:dropped
                    Size (bytes):2672
                    Entropy (8bit):7.864218635615192
                    Encrypted:false
                    SSDEEP:48:TlCtqLaLvN6P+NsI1hmhzoioE0jAoeZBrnFIVVbtdoV0GdXSnZ9wKS6Ei3:ItqLaLVvk9X08n3nWV5+B1SnZ9wKfD3
                    MD5:F851DB995B0253A71D638F779BE88330
                    SHA1:5F5319E016676E6B92F7E597B837677DDF52C0A5
                    SHA-256:2C024E287D53DCC084B60B01A69990C369E758DC7C91B0FE4791F02D18AAE61A
                    SHA-512:AB09FAECBB8C24ACADE89EFC25515C2B25C12C378144180E5B807309F793720E30BCE75A604515181554068FE4BAAD34E4EE050A6B5C5F9485D1E4712B9EC724
                    Malicious:false
                    Reputation:low
                    Preview:.PNG........IHDR...a...a.......?.....sBIT.....O....`PLTEf.....^^.77...zz|....uu.-&.{W.........A-. ..3&.iH.RB.......\@....//.............`.....t.__...3j&.....pHYs...........~.....tEXtCreation Time.03/04/09.......tEXtSoftware.Adobe Fireworks CS4......]IDATh....z....1.H..*..m....[....t...6..........]].S.SY.C..z.O..................g^tf.e:0[...^..B19.m9......5(.....p......Z..1.E.}....Z.Q..R...w........C.......;..ZH..j8stB0....t..._4M.D{..c.U..:...w..*..&.q...f..+..F..b.7*...H...P........u.s..D....?.n.S.H...su....K.!R;DN..BA._..K,..]/....(o.}..~...v.Gke.~.66.+..#6.SW.N..w9.&.}..m...j...kW.....0E.{.........8...!2NT.....AU../.kUu...D._..w.[..........]%@.cm.(.UU..L_.%....XWU..3[.T...m. J...T.9@..Of.b....C|Ukk/..R8.H.>p.V....R.....e.Es$...=@x...A...?.$..=.....T<..`j..o4.B..b.......]...h.M.p....<z.:.@H.*....y..N.........."..0T.....X..71.4...k..$...V.Tx^...s...}..1../.7.`s+..6..W!..!.zR....V....I..N...}7}...X-.2T.........6).V........`6+.Y..6t'".U/.#>F..80.

                    Chrome Cache Entry: 68

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
                    Category:dropped
                    Size (bytes):4335
                    Entropy (8bit):5.483603315043782
                    Encrypted:false
                    SSDEEP:48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
                    MD5:DE6ECBBB2471827D90BF32C47A0CBC45
                    SHA1:FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
                    SHA-256:5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
                    SHA-512:FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
                    Malicious:false
                    Reputation:low
                    Preview:......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    Chrome Cache Entry: 69

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:GIF image data, version 89a, 868 x 14
                    Category:downloaded
                    Size (bytes):537
                    Entropy (8bit):6.848296452361371
                    Encrypted:false
                    SSDEEP:12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
                    MD5:54EB288427ACF79ED320EFD4916FE0B7
                    SHA1:67BA813FF74D52035D70FCDA58B57563F01FB829
                    SHA-256:70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
                    SHA-512:C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/cgi-sys/images/404bottom.gif
                    Preview:GIF89ad......6e............|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

                    Chrome Cache Entry: 70

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:GIF image data, version 89a, 868 x 4
                    Category:dropped
                    Size (bytes):120
                    Entropy (8bit):6.060493667147718
                    Encrypted:false
                    SSDEEP:3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
                    MD5:DC8055F43FBB4A4B6DFB298EC35188F2
                    SHA1:1FFC540743DE1CDB929D9D1218978005141E8D9D
                    SHA-256:B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
                    SHA-512:2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
                    Malicious:false
                    Reputation:low
                    Preview:GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

                    Chrome Cache Entry: 71

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
                    Category:downloaded
                    Size (bytes):4335
                    Entropy (8bit):5.483603315043782
                    Encrypted:false
                    SSDEEP:48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
                    MD5:DE6ECBBB2471827D90BF32C47A0CBC45
                    SHA1:FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
                    SHA-256:5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
                    SHA-512:FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/cgi-sys/images/404top_w.jpg
                    Preview:......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    Chrome Cache Entry: 72

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:gzip compressed data, from Unix, original size modulo 2^32 11816
                    Category:downloaded
                    Size (bytes):4677
                    Entropy (8bit):7.946065353100574
                    Encrypted:false
                    SSDEEP:96:bZ/NwFlux9fPOlplZDCxX44cnBn4PxuyjWe8zngjoNRc/YrdgN:bZ/CQZOLUcFleWJMUraYrdgN
                    MD5:E6AAE2410885DF2F2629465B60A2691D
                    SHA1:859D3D883FB8CA2AADEDF5753ABCD7ACCE922479
                    SHA-256:A113D210F17827A95D9D1EEE68BF4E0AA8BD39D67DF1D9420FF5E9C0F49B1D48
                    SHA-512:77CFA85A05295F3E1D239AE09D6EC80B7D038A0466276B7D5586E614035BABFAA7FAC4B965643EF18C38648ED68BACBFB510BCF06AC578BCFE2C11F7892544AD
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Preview:...........Rms......sg...J&av.......$...Nm.Rm.H.I...n..M...=._c.pw...~y...........3(\.........G...(z}.......[8....32qQt.....j.E..l0;.....h.Q....o.A....q...K......./^..z..P....P.`..1P.P...%J^Vy..g::<.s.}........k9=.v.].....I.v.s8w..>....;.]........N......p..3x.y......v...G......e...).e.,...v.&FV..I...Jq....M3H.......hp8(...a{.8jo..t..EI......6.....q^..>.Y.Z...Q.....H.].rBis_.4.:...Jar..!c...(.j...):....{{.d!5........D.h4..+....k5.y...U...D$w..Z.}Y....QO.,..5..I>.i6...<..]2X.pCM.....e^...Wh.2...|~..l'....|..v,.....sT.Wd....G.'.8R.....F......O.......E..>.......8....V..?\....~..[..K..J.z.....p...=4.LB)..Y....y..u.F......M.........Y.....b....;...C..d.5.[.&TW...Rd.{/_..l..y.o...Y'.+....G.;G.....\...?z..JL.9*..~"...P..,E....O.$.}..(..O.W...<...2X!.SS..Q..rx......O....x."..#.D.J...M...A.P.!3-.u.H.2..6....?.....<g...R.;1<.]..........9....G..$.Vp...0s.B.Q.=.f.%a..fQmB<.q..MZq..0&....V....k....I&;..A...}*m.D3.q..Icy+!Ef.}.~...`.i....../~].B......&.

                    Chrome Cache Entry: 73

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:GIF image data, version 89a, 868 x 14
                    Category:dropped
                    Size (bytes):537
                    Entropy (8bit):6.848296452361371
                    Encrypted:false
                    SSDEEP:12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
                    MD5:54EB288427ACF79ED320EFD4916FE0B7
                    SHA1:67BA813FF74D52035D70FCDA58B57563F01FB829
                    SHA-256:70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
                    SHA-512:C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
                    Malicious:false
                    Reputation:low
                    Preview:GIF89ad......6e............|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

                    Chrome Cache Entry: 74

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:gzip compressed data, from Unix, original size modulo 2^32 11816
                    Category:downloaded
                    Size (bytes):4677
                    Entropy (8bit):7.946065353100574
                    Encrypted:false
                    SSDEEP:96:bZ/NwFlux9fPOlplZDCxX44cnBn4PxuyjWe8zngjoNRc/YrdgN:bZ/CQZOLUcFleWJMUraYrdgN
                    MD5:E6AAE2410885DF2F2629465B60A2691D
                    SHA1:859D3D883FB8CA2AADEDF5753ABCD7ACCE922479
                    SHA-256:A113D210F17827A95D9D1EEE68BF4E0AA8BD39D67DF1D9420FF5E9C0F49B1D48
                    SHA-512:77CFA85A05295F3E1D239AE09D6EC80B7D038A0466276B7D5586E614035BABFAA7FAC4B965643EF18C38648ED68BACBFB510BCF06AC578BCFE2C11F7892544AD
                    Malicious:false
                    Reputation:low
                    URL:http://demsaenlinea.mx/favicon.ico
                    Preview:...........Rms......sg...J&av.......$...Nm.Rm.H.I...n..M...=._c.pw...~y...........3(\.........G...(z}.......[8....32qQt.....j.E..l0;.....h.Q....o.A....q...K......./^..z..P....P.`..1P.P...%J^Vy..g::<.s.}........k9=.v.].....I.v.s8w..>....;.]........N......p..3x.y......v...G......e...).e.,...v.&FV..I...Jq....M3H.......hp8(...a{.8jo..t..EI......6.....q^..>.Y.Z...Q.....H.].rBis_.4.:...Jar..!c...(.j...):....{{.d!5........D.h4..+....k5.y...U...D$w..Z.}Y....QO.,..5..I>.i6...<..]2X.pCM.....e^...Wh.2...|~..l'....|..v,.....sT.Wd....G.'.8R.....F......O.......E..>.......8....V..?\....~..[..K..J.z.....p...=4.LB)..Y....y..u.F......M.........Y.....b....;...C..d.5.[.&TW...Rd.{/_..l..y.o...Y'.+....G.;G.....\...?z..JL.9*..~"...P..,E....O.$.}..(..O.W...<...2X!.SS..Q..rx......O....x."..#.D.J...M...A.P.!3-.u.H.2..6....?.....<g...R.;1<.]..........9....G..$.Vp...0s.B.Q.=.f.%a..fQmB<.q..MZq..0&....V....k....I&;..A...}*m.D3.q..Icy+!Ef.}.~...`.i....../~].B......&.

                    Static File Info

                    ⊘No static file info

                    Network Behavior

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Feb 28, 2024 00:31:20.029037952 CET49674443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:20.029052973 CET49675443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:20.138417959 CET49673443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:26.865192890 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.865228891 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:26.865345955 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.865725040 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.865746975 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:26.889614105 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.889652014 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:26.889733076 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.890130043 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:26.890144110 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.076363087 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.076642036 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.076670885 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.077653885 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.077728033 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.079958916 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.080029964 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.080161095 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.080172062 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.091752052 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.091980934 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.091994047 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.093424082 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.093504906 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.093775988 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.093856096 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.144328117 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.144339085 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.173554897 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.190608025 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.257083893 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.257179976 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.257251024 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.257690907 CET49709443192.168.2.544.206.44.177
                    Feb 28, 2024 00:31:27.257719040 CET4434970944.206.44.177192.168.2.5
                    Feb 28, 2024 00:31:27.452662945 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.513765097 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.564800024 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.564929008 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.569927931 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.626002073 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.626112938 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.681659937 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.700313091 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.700349092 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.700371027 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.700391054 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.700436115 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.700462103 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.770251036 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.770303965 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.883735895 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.890181065 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.890213966 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.890296936 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.891685009 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.891705036 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.891722918 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:27.891760111 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:27.900418043 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:27.940871000 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.002444983 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.002557039 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.002803087 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.104976892 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105357885 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105494022 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105520010 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105542898 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105559111 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.105566978 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105587006 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.105591059 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105616093 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105633020 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.105638981 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105675936 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.105720997 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105742931 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105762959 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.105786085 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.108966112 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.108989954 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.109061956 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.110091925 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.112411022 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.112449884 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.112473965 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.115813971 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.115852118 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.115885019 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.119241953 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.119271040 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.119314909 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.122678041 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.122714043 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.122751951 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.126094103 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.126132011 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.126166105 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.129515886 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.129547119 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:31:28.129585981 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.171601057 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:31:28.176007032 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.222841978 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.222971916 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.223047972 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.223618984 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.223917961 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.224021912 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.289194107 CET8049717162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.289283991 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.336672068 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.336745977 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.337091923 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.337342024 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.345051050 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.345086098 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.345109940 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.345141888 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.350182056 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.350219011 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.350243092 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.350267887 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.350295067 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.350332975 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.352125883 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.385663986 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.401339054 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.450856924 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.461226940 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.482839108 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.513509035 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.515775919 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.525866032 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.606504917 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.606539011 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.606560946 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.606579065 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.606584072 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.606621027 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.627629995 CET8049717162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.632116079 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.632152081 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.632174969 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.632196903 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.635072947 CET8049717162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.637439966 CET8049719162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.643213987 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.643241882 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.668786049 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.683779955 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:28.780371904 CET8049719162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.787635088 CET8049719162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:28.828376055 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:29.609446049 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.609534025 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.609637022 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.609985113 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.610025883 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.643573999 CET49674443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:29.643744946 CET49675443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:29.750813007 CET49673443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:29.810277939 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.860182047 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.871079922 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.871100903 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.872252941 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.872347116 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.873857021 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.873939037 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.922666073 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:29.922689915 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:29.969557047 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:30.181696892 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.181732893 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.181801081 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.186150074 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.186192989 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.384819031 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.384910107 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.392141104 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.392157078 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.392381907 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.438318014 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.547858953 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.589915991 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.643699884 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.643831968 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.647983074 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.648427010 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.648459911 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.648488045 CET49722443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.648502111 CET4434972223.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.717468023 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.717549086 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.717639923 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.718307018 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.718341112 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.922847033 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.922934055 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.925070047 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.925076008 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.925390959 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:30.927016020 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:30.969923973 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:31.107481003 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:31.107636929 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:31.107815981 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:31.108949900 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:31.108949900 CET49723443192.168.2.523.221.242.90
                    Feb 28, 2024 00:31:31.108978987 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:31.109003067 CET4434972323.221.242.90192.168.2.5
                    Feb 28, 2024 00:31:31.125905991 CET4434970323.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:31.126209021 CET49703443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:33.355439901 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.358654976 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.359781981 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.362639904 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.410474062 CET4971180192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.410619974 CET4971380192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.522272110 CET8049713162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.522330046 CET8049711162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.607736111 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.607809067 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.636404991 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.636465073 CET8049717162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.637427092 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.637574911 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:33.789509058 CET8049719162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:33.789627075 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:35.400018930 CET4971780192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:35.400080919 CET4971980192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:35.400080919 CET4971680192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:35.400119066 CET4971880192.168.2.5162.241.60.132
                    Feb 28, 2024 00:31:35.514023066 CET8049716162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:35.514077902 CET8049719162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:35.514131069 CET8049718162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:35.514164925 CET8049717162.241.60.132192.168.2.5
                    Feb 28, 2024 00:31:39.814986944 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:39.815155983 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:39.815392017 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:41.240987062 CET49703443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.241300106 CET49703443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.242053986 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.242084980 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.242347002 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.244270086 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.244288921 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.393996000 CET4434970323.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.394036055 CET4434970323.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.401860952 CET49721443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:31:41.401894093 CET44349721172.253.63.104192.168.2.5
                    Feb 28, 2024 00:31:41.562544107 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.562622070 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.579979897 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.579993010 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.580284119 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.580339909 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.580899954 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.580935955 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.581070900 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.581082106 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.954423904 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.954480886 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.955095053 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.955133915 CET4434972723.1.237.91192.168.2.5
                    Feb 28, 2024 00:31:41.955135107 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:31:41.955188990 CET49727443192.168.2.523.1.237.91
                    Feb 28, 2024 00:32:12.156215906 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:32:12.156234980 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:32:13.140837908 CET4971580192.168.2.5151.101.194.137
                    Feb 28, 2024 00:32:13.243673086 CET8049715151.101.194.137192.168.2.5
                    Feb 28, 2024 00:32:27.082823038 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:32:27.082911015 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:32:27.083051920 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:32:27.392865896 CET49710443192.168.2.544.206.44.177
                    Feb 28, 2024 00:32:27.392894030 CET4434971044.206.44.177192.168.2.5
                    Feb 28, 2024 00:32:29.189830065 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:29.189867973 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.190253019 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:29.190336943 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:29.190370083 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.386080980 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.386483908 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:29.386493921 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.386836052 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.387307882 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:29.387370110 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:29.440082073 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:39.450454950 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:39.450536013 CET44349734172.253.63.104192.168.2.5
                    Feb 28, 2024 00:32:39.450829029 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:41.402553082 CET49734443192.168.2.5172.253.63.104
                    Feb 28, 2024 00:32:41.402570963 CET44349734172.253.63.104192.168.2.5

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Feb 28, 2024 00:31:25.280714035 CET53649321.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:25.294008017 CET53539311.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:25.890809059 CET53495021.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:26.726346970 CET5280353192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:26.726654053 CET5393553192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:26.854675055 CET53528031.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:26.864587069 CET53539351.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:27.260566950 CET5554453192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:27.260878086 CET5642553192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:27.421807051 CET53564251.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:27.441948891 CET53555441.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:27.769382954 CET5862453192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:27.769726992 CET6459153192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:27.896269083 CET53645911.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:27.897255898 CET53586241.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:27.922045946 CET6228653192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:27.922374010 CET6463853192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:28.084764957 CET53622861.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:28.108923912 CET53646381.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:29.127685070 CET5899053192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:29.128762007 CET6172053192.168.2.51.1.1.1
                    Feb 28, 2024 00:31:29.252727032 CET53589901.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:29.253619909 CET53617201.1.1.1192.168.2.5
                    Feb 28, 2024 00:31:43.600796938 CET53595651.1.1.1192.168.2.5
                    Feb 28, 2024 00:32:02.488364935 CET53569441.1.1.1192.168.2.5
                    Feb 28, 2024 00:32:24.806945086 CET53627871.1.1.1192.168.2.5
                    Feb 28, 2024 00:32:25.045423985 CET53571601.1.1.1192.168.2.5

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Feb 28, 2024 00:31:26.726346970 CET192.168.2.51.1.1.10x172cStandard query (0)tracker.club-os.comA (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:26.726654053 CET192.168.2.51.1.1.10x54e7Standard query (0)tracker.club-os.com65IN (0x0001)false
                    Feb 28, 2024 00:31:27.260566950 CET192.168.2.51.1.1.10x6bf0Standard query (0)demsaenlinea.mxA (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.260878086 CET192.168.2.51.1.1.10x1925Standard query (0)demsaenlinea.mx65IN (0x0001)false
                    Feb 28, 2024 00:31:27.769382954 CET192.168.2.51.1.1.10x8317Standard query (0)code.jquery.comA (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.769726992 CET192.168.2.51.1.1.10x666aStandard query (0)code.jquery.com65IN (0x0001)false
                    Feb 28, 2024 00:31:27.922045946 CET192.168.2.51.1.1.10x9c57Standard query (0)demsaenlinea.mxA (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.922374010 CET192.168.2.51.1.1.10xaf27Standard query (0)demsaenlinea.mx65IN (0x0001)false
                    Feb 28, 2024 00:31:29.127685070 CET192.168.2.51.1.1.10x61adStandard query (0)www.google.comA (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.128762007 CET192.168.2.51.1.1.10xb647Standard query (0)www.google.com65IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Feb 28, 2024 00:31:26.854675055 CET1.1.1.1192.168.2.50x172cNo error (0)tracker.club-os.com44.206.44.177A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:26.854675055 CET1.1.1.1192.168.2.50x172cNo error (0)tracker.club-os.com3.215.101.173A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:26.854675055 CET1.1.1.1192.168.2.50x172cNo error (0)tracker.club-os.com18.234.14.13A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.441948891 CET1.1.1.1192.168.2.50x6bf0No error (0)demsaenlinea.mx162.241.60.132A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.897255898 CET1.1.1.1192.168.2.50x8317No error (0)code.jquery.com151.101.194.137A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.897255898 CET1.1.1.1192.168.2.50x8317No error (0)code.jquery.com151.101.130.137A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.897255898 CET1.1.1.1192.168.2.50x8317No error (0)code.jquery.com151.101.2.137A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:27.897255898 CET1.1.1.1192.168.2.50x8317No error (0)code.jquery.com151.101.66.137A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:28.084764957 CET1.1.1.1192.168.2.50x9c57No error (0)demsaenlinea.mx162.241.60.132A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.104A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.105A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.103A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.147A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.106A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.252727032 CET1.1.1.1192.168.2.50x61adNo error (0)www.google.com172.253.63.99A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:29.253619909 CET1.1.1.1192.168.2.50xb647No error (0)www.google.com65IN (0x0001)false
                    Feb 28, 2024 00:31:41.032512903 CET1.1.1.1192.168.2.50xc961No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                    Feb 28, 2024 00:31:41.032512903 CET1.1.1.1192.168.2.50xc961No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:41.278167963 CET1.1.1.1192.168.2.50x7fb7No error (0)windowsupdatebg.s.llnwi.net69.164.0.0A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:31:41.278167963 CET1.1.1.1192.168.2.50x7fb7No error (0)windowsupdatebg.s.llnwi.net69.164.0.128A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:32:41.437983036 CET1.1.1.1192.168.2.50x12edNo error (0)windowsupdatebg.s.llnwi.net69.164.0.128A (IP address)IN (0x0001)false
                    Feb 28, 2024 00:32:41.437983036 CET1.1.1.1192.168.2.50x12edNo error (0)windowsupdatebg.s.llnwi.net69.164.0.0A (IP address)IN (0x0001)false

                    HTTP Request Dependency Graph

                    • tracker.club-os.com
                    • fs.microsoft.com
                    • https:
                      • www.bing.com
                    • demsaenlinea.mx
                      • code.jquery.com

                    HTTP Packets

                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.2.549711162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:27.569927931 CET478OUTGET /jahn/00987667839933/utilities@affordablecare.com HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    Upgrade-Insecure-Requests: 1
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:27.700313091 CET1286INHTTP/1.1 404 Not Found
                    Date: Tue, 27 Feb 2024 23:31:27 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:59:45 GMT
                    Accept-Ranges: bytes
                    Vary: Accept-Encoding
                    Content-Encoding: gzip
                    Content-Length: 4677
                    Keep-Alive: timeout=5, max=75
                    Content-Type: text/html
                    Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66 04 25 61 db 90 ef 66 51 6d 42 3c ff 71 d3 a2 7f 4d 5a 71 d4 a1 ce ba 30 26 a4 d2 ef d3 56 1c ef 82 80 96 ab 6b 14 93 95 8e 49 26 3b f9 fa 41 83 05 ea 7d 2a 6d a5 44 33 d4 a4 71 b1 99 49 63 79 2b
                    Data Ascii: RmssgJ&av$NmRmHInM=_cpw~y3(\G(z}[832qQtjEl0;hQoAqK/^zPP`1PP%J^Vyg::<s}k9=v]Ivs8w>;]Np3xyvGe)e,v&FVIJqM3Hhp8(a{8jotEI.6q^>YZQH]rBis_4:Jar!c(j):{{d!5Dh4+k5yUD$wZ}YQO,5I>i6<]2XpCMe^Wh2.|~l'|v,sTWdG'8RFOE>8.V?\~[KJzp=4LB)YyuFMYb;Cd5[&TWRd{/_lyoY'+G;G\?zJL9*~"P,EO$}(OW<2X!SSQrxOx"#DJMAP!3-uH26?<gR;1<]9G$Vp0sBQ=f%afQmB<qMZq0&VkI&;A}*mD3qIcy+
                    Feb 28, 2024 00:31:27.700349092 CET1286INData Raw: 21 45 66 c8 7d ce 7e f9 e5 e0 60 b1 69 91 ef a6 ab dd a3 c9 f3 17 2f 7e 5d ec ba 42 9a b5 cd c3 17 bf 26 87 2f 56 43 53 84 7b 98 88 e4 2e 37 54 eb b4 bf 38 87 cf fd bf 11 0b 31 29 f2 c2 cf d5 1c 2c 29 99 f2 56 8a 87 e9 e1 08 2a 91 a6 52 e7 43 78
                    Data Ascii: !Ef}~`i/~]B&/VCS{.7T81),)V*RCx{k_hT!dnD3bxixqTHr2=-c/7UtoGc-'9_e$'(e66FANz=86CG]__^g^v/o[[iG
                    Feb 28, 2024 00:31:27.700371027 CET1286INData Raw: 42 fb 6a 70 ac 19 d5 3a 7d 50 88 5b 5f d5 a9 30 1e 75 d2 c0 c4 d0 cc a2 d9 07 99 05 e8 94 42 b3 be e6 ec ff c9 54 67 1a 30 2b f3 7c c0 9d 7f 7e 40 28 27 a3 a2 c2 c4 c1 7f 48 9c c1 95 9f 7b a1 33 da 0f 6a 73 72 14 8e bf c3 54 0a b8 15 93 4d 85 8f
                    Data Ascii: Bjp:}P[_0uBTg0+|~@('H{3jsrTMsMDk={j-o|m4aG+.<W6CYkGm^jTRm=9tMj=;74O'y'*22m=3}J'5Ks]lT:_0Y26F8InG
                    Feb 28, 2024 00:31:27.700391054 CET1141INData Raw: 43 59 92 5e 57 90 51 ad 43 80 62 4b ef 7e 00 2b 85 6e 98 a8 91 15 a3 db 3a 29 40 d8 55 cc fb f0 da d4 95 50 fb f0 37 a2 52 89 70 e5 1d 57 4f fb 7e a6 e9 fa a0 ae 62 ab 21 d6 2f 10 97 72 01 9f 08 bd 14 f9 40 e3 85 f3 fd ae 88 fb cd ed 6c 9d f6 05
                    Data Ascii: CY^WQCbK~+n:)@UP7RpWO~b!/r@l-ElQK$gYzKoFfKl]DX>+5Oj<u.K!t[EVdpiJ<8)3~(9szG|o(X\v#S
                    Feb 28, 2024 00:31:27.770251036 CET381OUTGET /cgi-sys/js/simple-expand.min.js HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:27.890181065 CET1286INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:27 GMT
                    Server: Apache
                    Last-Modified: Thu, 29 Sep 2022 22:57:04 GMT
                    Accept-Ranges: bytes
                    Vary: Accept-Encoding
                    Content-Encoding: gzip
                    Content-Length: 1191
                    Keep-Alive: timeout=5, max=74
                    Connection: Keep-Alive
                    Content-Type: application/javascript
                    Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 7f 45 64 1e 89 eb 4a 06 c3 d4 13 c4 f3 78 ac fb 5b a3 54 34 45 f3 5c 81 5e 60 b3 e7 2d bc 4b 2d 51 0a 15 ee 3a ee 0b db 3c d1 b6 84 dc 82 a8 43 9e 36 4e ed 45 8a 14 59 9a 0d cc 94 70 2e 4d 2a a3 94 58 39 a8 13 9e 8b ba 6e a3 91 04 1f f4 7b 1a b3 4d 35 e7 c5 69 ef b1 aa d7 da 1b 48 bd 5e 57 df bb 6f bf 7b 20 f9 ee 48 65 de e9 5f 96 65 df 01 17 18 27 f0 e2 07 b5 f7 c2 c9 2a 19 8d ba ba 7d 8b f7 ff ef 09 57 fe c2 9e 58 e7 f7 54 0d 54 0f 1f 4f 6d f5 d9 02 79 b1 96 7e b9 2b 7b da ca 79 cf 3b f9 77 76 1c 8d 86 79 b4 23 ed 5b 13 ad e4 12 a8 79 b0 33 d3 b0 65 1f ac 35 36 7d 69 d3 82 7d 37 87 99 95 5f c8 2c fc b3 96 16 1c eb c6 32 34 ec 1e 58 3b 38 4f c2 0d de 1d b1 af 0f d5 7b 07 cb ae b1 0f 3b 46 ae c5 12 c8 4c d1 cf 48 78 f5 5a a9 e7 67 ff 95 24 17 bb 7d f1 e7 ed cd b5 77 af f3 ae eb f6 9c ba 34 50 32 f8 19 27 3c ae 18 9c 4f 3d 22 5d 62 2e 10 89 83 4b 32 d7 94 9a f5 0b aa 62 f1 b4 6f fc 38 26 e5 99 2c ed 17 fd 95 ca 07 93 e7 67 9a d7 62 97 c1 2f 62 03 a7 d8 32 fd cb e8 da 85 a7 d8 ec 8f b0 c9 13 6c 53 f9 c5 7e 2d 75 f6 73 ba b3 40 a9 43 4b 71 39 7f 4a 25 cf 76 56 6c 8b c1 24 5b 09 6c 8a ad d4 b5 d9 e6 ca 54 c2 5f 90 fb a0 a6 be 7d a0 1f 83 cd 4f ee eb 88 8a c9 99 73 24 49 47 4c 0f 43 23 6b b8 32 b5 b7 65 32 17 35 dc 85 f2 e4 42 e7 c7 57 7a fe db 84 17 3f 68 ba 17 4e 56 be 3e 2e 4a 79 31 cc a5 fb bd c3 f2 4a 17 1f 8d 5e 89 7a d4 99 e5 7d c5 28 44 81 c1 f9 f1 46 3a e3 78 26 f0 dd e1 9e 46 b8 99 12 74 64 02 8f 2b 41 c2 90 4e 17 e9 a1 2d a6 2a a3 94 58 39 a8 d9 b1 88 c6 f3 e2 b4 b0 4b b3 43 87 2f 9c 04 b2 49 f1 fa 4e d8 05 a0 7b c1 38 41 dd 45 03 7c f9 da b9 37 11 f7 ce a8 35 42 c2 65 39 4c 2d 9f 82 72 c0 ba ac 05 45 72 6e 42 36 0e fe 04 1b 50 37 1a de 93 1b fd f5 d9 69 cb 4a 58 d0 98 c4 55 8e 6c 19 03 e4 b3 da b0 57 a7 b8 30 25 93 b9 02 bd c0 86 86 4c 46 a3 d4 95 ee d0 ca a7 db 46 92 72 2f 4b 5c fb 1a d0 8b ef 5b a2 a5 67 40 d0 cd 1b 92 e7 c4 70 c3 1c 1e 11 74 dd 93 9c c2 54 5f 35 50 3d 7c 24 2c 41 d4 4b 3d 0b b6
                    Data Ascii: RMo8Wa";"Cbm.==0bC^rl'pwHJ.|8o{lfVOV.dwwIm55+W>rln:4vrRp+7Ww@Wpbwx)~#7|+FCKC++L]AwaH7X+t5\d.j3$k lJXxH,1$f{sR/`=nQ \1yVkH^3 9<:=R`F{ZV3wpmP"EdJx[T4E\^`-K-Q:<C6NEYp.M*X9n{M5iH^Wo{ He_e'*}WXTTOmy~+{y;wvy#[y3e56}i}7_,24X;8O{;FLHxZg$}w4P2'<O="]b.K2bo8&,gb/b2lS~-us@CKq9J%vVl$[lT_}Os$IGLC#k2e25BWz?hNV>.Jy1J^z}(DF:x&Ftd+AN-*X9KC/IN{8AE|75Be9L-rErnB6P7iJXUlW0%LFFr/K\[g@ptT_5P=|$,AK=
                    Feb 28, 2024 00:31:27.890213966 CET207INData Raw: ff 6c a1 32 ba 96 7e 80 4b 79 86 39 88 aa 49 0f 33 e3 89 48 b4 61 23 1d cf 34 1d 2b 10 6d 9a d4 02 c5 59 2b 91 3d c3 a0 45 c2 9f 9f 7b a6 aa 61 2e d6 0a a3 4e 99 fd 69 eb 99 03 61 ab e6 f5 09 b7 21 e7 fd 99 75 ec b6 e2 07 79 34 f7 52 f7 89 e3 3b
                    Data Ascii: l2~Ky9I3Ha#4+mY+=E{a.Nia!uy4R;`cF_I{y&N.WZ8k2mZe3/5%T HO[d<|oao0<XzFtadH0<=O^R
                    Feb 28, 2024 00:31:28.222841978 CET438OUTGET /cgi-sys/images/404top_w.jpg HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.350182056 CET1286INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Last-Modified: Thu, 13 Oct 2022 23:32:33 GMT
                    Accept-Ranges: bytes
                    Content-Length: 4335
                    Keep-Alive: timeout=5, max=73
                    Connection: Keep-Alive
                    Content-Type: image/jpeg
                    Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f6 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X
                    Feb 28, 2024 00:31:28.350219011 CET1286INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Data Ascii:
                    Feb 28, 2024 00:31:28.350243092 CET1286INData Raw: 9e 7a 58 48 d1 17 96 e5 67 3b d1 5b 3f 0d 47 1f 4e c1 5b 1b 1c f3 d2 c2 46 8e 32 dc bc e7 7a 2b 7e 9f 86 a1 e5 2b 63 63 9e 7a 58 48 d1 c6 6b 97 9c ef 45 5f 0b 43 c8 56 c5 c7 be 96 12 34 71 9a e5 cf b5 15 b9 6a d4 23 f8 ca b8 b8 2c 24 68 9b cb 72
                    Data Ascii: zXHg;[?GN[F2z+~+cczXHkE_CV4qj#,$hrjellsK&\,$ixrWC?_+bK8s1<52.8r*hOqpXHEqE^z+cczXHqmE^~Bya#G_z*Z}[F/>T|l
                    Feb 28, 2024 00:31:28.350295067 CET720INData Raw: 4e 8f 90 ab 8b 8f b2 c2 46 88 bd 97 2e 27 d6 2c fc 9d 1f 21 57 1b 1f 65 84 8d 1c 6c b9 79 ce f1 e7 e4 e8 f9 0a b8 d8 fb 2c 24 68 e3 65 cb ce 67 68 f3 1f 07 46 3a 0a b8 b8 fb 2c 24 69 66 f6 5c bc f7 ed 1e 7f 28 d4 e8 47 41 57 1b 1f 65 84 8f e5 26
                    Data Ascii: NF.',!Wely,$heghF:,$if\(GAWe&\XFF:,$if\,|!Wel~JB.>N6\b6)Bz,$h]RQxZ+Sch{CNUDkw2%~7?WW;


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    1192.168.2.549713162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:27.770303965 CET431OUTGET /cgi-sys/images/x.png HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:27.891685009 CET1286INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:27 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:57:03 GMT
                    Accept-Ranges: bytes
                    Content-Length: 2672
                    Keep-Alive: timeout=5, max=75
                    Content-Type: image/png
                    Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 61 00 00 00 61 08 03 00 00 00 f1 d8 3f 91 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 60 50 4c 54 45 66 00 00 e7 cf cf 8a 5e 5e 86 37 37 cc 00 00 7a 7a 7c bb 02 02 f9 75 75 e7 2d 26 ef 7b 57 a7 01 01 ff ff ff d9 8f 8f d4 41 2d c6 20 17 cd 33 26 e6 69 48 e8 52 42 fd b4 b2 99 00 00 e1 5c 40 bd 8f 8f bc 2f 2f f4 ef ef dc bf bf e3 15 15 db 00 00 f6 8e 60 9f a1 a3 fe 99 74 c5 5f 5f bd 13 10 33 6a 26 19 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 33 2f 30 34 2f 30 39 d9 8b d2 0e 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 34 06 b2 d3 a0 00 00 09 5d 49 44 41 54 68 81 ad 9a 8d 7a ab ac 12 85 31 a1 48 ac c1 2a 89 88 6d e5 fe ef f2 5b 03 a2 88 9a 74 9f e7 8c c6 36 0a f3 ba 06 18 fc 09 fb fc ab 15 5d 5d d6 53 db b7 53 59 97 43 f7 e7 7a ec 4f ce eb a9 11 9c 16 2e 96 a5 ff aa 8b ff 0f a1 9b 14 e7 1c 67 5e 74 66 de 65 3a 30 5b f0 d4 f4 5e cb 1b 42 31 39 9c 6d 39 c4 ef a6 c0 12 bf 0c 35 28 ee eb 8d 92 97 04 f2 70 af e1 d1 98 a2 fb dd 5a 07 92 31 06 45 c4 7d 11 f7 8f 84 5a 09 51 16 f0 52 fc 1e db 77 d7 d1 d1 d2 89 a6 fe 1f 08 43 e3 1c f9 0f ee bf c3 e7 3b ff 1f 5a 48 88 e2 6a 38 73 74 42 30 ad 80 ff c2 74 df bf ef 96 df 5f 34 4d ed 44 7b 12 aa 63 02 55 80 7f 3a d1 ef ef 77 1f 14 2a 8a e2 26 dc 71 a8 8e 08 66 12 ae 2b 8a ee 46 2e fe 62 bf 37 2a ae c4 e3 48 c6 01 a1 50 a2 1d ba ee 8f de a3 81 d1 0a 75 d0 73 f7 04 44 a8 ee 8a df db 3f 12 6e e8 bf b5 53 fb 48 ed 08 b5 73 75 d7 95 a8 f2 cf 4b d7 21 52 3b 44 4e 98 84 42 41 94 5f d6 f7 4b 2c 07 19 5d 2f a6 d7 04 0f 28 6f 8b 7d af ff 7e b5 ad b4 76 1c 47 6b 65 db 7e dd 36 36 97 2b bb ee 9e 23 36 04 53 57 b2 4e 01 ab 77 39 e6 26 db 7d b9 db 6d 8f d8 10 6a a1 ea ee 6b 57 ab b5 c1 a7 95 30 45 1b 7b 0e a9 81 a8 cf 08 03 00 bf 38 e1 ed d2 8e 21 32 4e 54 a2 82 85 8d b2 41 55 9b 17 2f 7f 6b 55 75 c7 04 83 44 d7 95 5f db 1a 77 ef bf 81 5b d1 d7 f5 d0 15 98 1c 86 ba ee 5d 25 40 a1 63 6d 8e 28 7f 55 55 1c 11 4c 5f 95 25 00 a9 f9 f8 58 57 55 ae cc 33 5b f1 54 a2 0a 8c 6d 1d 20 4a d7 9b 03 c2 54 b5 39 40 ce fe 4f 66 b2 62 02 03 ad f1 b5 43 7c 55 6b 6b 2f 84 a1 52 38 f2 48 0a 3e 70 82 56 c1 ff e9 fc 52 b8 ca 8e f2 91 13 1e 65 d9 88 45 73 24 18 85 18 3d 40 78 cc eb e3 41 02 aa aa 3f 9f 24 0b a7 3d e0 91 ad 84 a8 54 3c af 99 60 6a dd 96 de 6f 34 ea 42 10 f0 62 f2 f2 0a ec e3 c8 da b2 5d e2 14 09 68 cb b6 4d cb 70 02 b8 17 b3 3c 7a 86 3a 01 40 48 e9 2a 93 12 0c 9a 79 03 a0 4e ea aa fe c5 0c 1f 00 f7 13 c2 1d 22 fa 94 30 54 ce 13 a8 82 ff 58 02 9c 37 31 01 34 01 be ee 6b 9d f4 83 24 d6 cf 8d cd 56 09 54 78 5e 08 a0 fb 73 ff 9f 9f 7d e5 c6 31 a9 91 2f f0 37 8b 60 73 2b cc 80 b0 36 00 88 57 21 c2 e0 21 c0 7a 52 e9 1a be cb 56 85 96 f0 84 49 cb f6 4e 16 0a dd 7d 37 7d 09 d0 04 58 2d d4 93 32 54 0f db f6 1e ba 13 0b 12 fa 36 29 8f 56 ae f4 e9 f5 8f 07 88 0d 60 36 2b ed a3 59 be c9 36 74 27 22 d4 55 2f d7 23 3e 46 fa c5 38 30 cf aa 1a c7 26 f7 2f 01 48 dd dc 65 e3 47 13 0b 41 92 f7
                    Data Ascii: PNGIHDRaa?sBITO`PLTEf^^77zz|uu-&{WA- 3&iHRB\@//`t__3j&pHYs~tEXtCreation Time03/04/09tEXtSoftwareAdobe Fireworks CS4]IDAThz1H*m[t6]]SSYCzO.g^tfe:0[^B19m95(pZ1E}ZQRwC;ZHj8stB0t_4MD{cU:w*&qf+F.b7*HPusD?nSHsuK!R;DNBA_K,]/(o}~vGke~66+#6SWNw9&}mjkW0E{8!2NTAU/kUuD_w[]%@cm(UUL_%XWU3[Tm JT9@OfbC|Ukk/R8H>pVReEs$=@xA?$=T<`jo4Bb]hMp<z:@H*yN"0TX714k$VTx^s}1/7`s+6W!!zRVIN}7}X-2T6)V`6+Y6t'"U/#>F80&/HeGA
                    Feb 28, 2024 00:31:27.891705036 CET1286INData Raw: 26 01 8c da bd 88 51 5d 69 00 72 42 63 a5 d8 20 1a 29 7d 67 01 c1 68 67 9b fb bc 34 77 f5 26 46 b5 86 02 b5 54 08 95 1a 38 17 da 5a 9b ee 95 4e 1b 4f a8 89 b0 da 38 f2 57 1d 15 00 3e aa 7b 93 99 b5 42 6b 8d 40 a5 fb 14 05 9b 51 cf 53 c9 fe 37 12
                    Data Ascii: &Q]irBc )}ghg4w&FT8ZNO8W>{Bk@QS73x+'Ou)`3J1pD(T,|y Q *@-YG7Jr)&8GC0UyE;sp}a.6rX9 i1V[9
                    Feb 28, 2024 00:31:27.891722918 CET368INData Raw: eb 8d fe a3 e7 e7 74 fe b1 4c dc 58 5c 0d 6d f3 d7 f6 2d 0d 10 5c ca 31 94 8f f5 68 85 10 f2 39 1b e1 ca bb 7f 01 c1 93 52 1e b0 cb c0 d9 7b 20 7f 99 17 64 d0 ba b2 e6 d7 3f 21 38 ad 9c 5f da f0 fc cd cd 4e c1 fe 5d d6 82 78 6f b9 7b 7a 8b 53 ed
                    Data Ascii: tLX\m-\1h9R{ d?!8_N]xo{zSS}7y8o-?@Y~cwLUTxg]4gf'pU->_"9^_"Pj5K_S9#!1txJMF.%?y/w23|
                    Feb 28, 2024 00:31:28.223917961 CET436OUTGET /cgi-sys/images/404mid.gif HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.352125883 CET361INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Last-Modified: Thu, 29 Sep 2022 22:58:07 GMT
                    Accept-Ranges: bytes
                    Content-Length: 120
                    Keep-Alive: timeout=5, max=74
                    Connection: Keep-Alive
                    Content-Type: image/gif
                    Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b
                    Data Ascii: GIF89ad!,dIHDVL*JTPj-;


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    2192.168.2.549715151.101.194.137804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:28.002803087 CET321OUTGET /jquery-3.3.1.min.js HTTP/1.1
                    Host: code.jquery.com
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Referer: http://demsaenlinea.mx/
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.105357885 CET554INHTTP/1.1 200 OK
                    Connection: keep-alive
                    Content-Length: 30288
                    Server: nginx
                    Content-Type: application/javascript; charset=utf-8
                    Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT
                    ETag: W/"28feccc0-1538f"
                    Cache-Control: public, max-age=31536000, stale-while-revalidate=604800
                    Access-Control-Allow-Origin: *
                    Content-Encoding: gzip
                    Accept-Ranges: bytes
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Via: 1.1 varnish
                    Age: 4730718
                    X-Served-By: cache-lga21953-LGA
                    X-Cache: HIT
                    X-Cache-Hits: 308065
                    X-Timer: S1709076688.053031,VS0,VE0
                    Vary: Accept-Encoding
                    Feb 28, 2024 00:31:28.105494022 CET1286INData Raw: 1f 8b 08 00 00 00 00 00 02 03 bc bd 79 7b db 46 b2 2f fc ff fb 29 44 8c 8f 02 98 2d 4a 72 26 b9 77 40 b5 f9 38 5e 12 67 73 26 76 b6 43 31 79 20 b2 49 21 a6 00 06 00 b5 44 e4 7c f6 5b bf ea 05 0d 10 94 33 73 ee 7d 33 63 11 4b a3 d7 ea ea da eb f8
                    Data Ascii: y{F/)D-Jr&w@8^gs&vC1y I!D|[3s}3cKqUqwp F_=xYRyvdT4"XWyQRX/JuJT}%}6a_BnU>[/u5oJefz'Q\W"9
                    Feb 28, 2024 00:31:28.105520010 CET1286INData Raw: 7c 7a c5 93 d2 c2 83 38 5f 98 68 21 8a e5 04 a7 e9 73 8c e7 1e 0d 64 44 c2 e8 bd 31 2c ce 68 66 34 ac f6 4e f9 64 d7 b3 30 2e 88 d2 11 f8 89 a2 0b 3a a1 df 6f d5 92 a8 21 7c 5d e8 ee 7d f0 0b 0b 25 b4 b7 89 70 b9 7a e8 18 a1 13 37 c4 b9 5b 03 c7
                    Data Ascii: |z8_h!sdD1,hf4Nd0.:o!|]}%pz7[;p{:ORm+JNXEqiHdHn{]N(]4*Lw_YD+B"qOdEs&y\6@hiNu'nBPl% iT,q??t;m5
                    Feb 28, 2024 00:31:28.105542898 CET1286INData Raw: cf 67 2a 2c fa fc 45 14 77 be 7c fa f4 f4 64 f3 c9 27 4f fe f1 a9 38 3d 79 f2 f1 61 b1 f9 e4 d3 8f 9f 80 b3 ae 94 3c a6 2e 13 fa bb 3d 9d 9f df fe af f9 64 f3 eb d1 88 26 9e 7e 1e 19 c4 68 de 1c 9d af 5f d1 7f 98 05 e2 5c 32 d5 7d 22 55 a3 e0 fc
                    Data Ascii: g*,Ew|d'O8=ya<.=d&~h_\2}"UG+|>bDij05{F9YR P>?c*y]3NVsI:ZLZZXcQw_B7=VTIEdkyLQsJ0
                    Feb 28, 2024 00:31:28.105566978 CET1286INData Raw: 1d fa a6 b9 5d 02 08 22 01 03 c6 bb ad 3a ba 45 fe 53 9f e1 b3 7d 14 90 fe 12 04 db 9e 2e 5e 36 ba 48 a0 47 84 dc 85 e8 b5 2a 44 5d 44 04 75 3c 0d 2f da dd 44 63 a3 b0 18 cc d3 65 a5 8a c1 eb 17 5d 70 ef 0e fb ff 26 ee d0 09 7b 3b a7 70 97 54 02
                    Data Ascii: ]":ES}.^6HG*D]Du</Dce]p&{;pTDMdf8@ul61LTO[ml4n>(^q3=~7rov|O#ca*"0Y\0D/w>vhr/1~RVV,'oT5
                    Feb 28, 2024 00:31:28.105591059 CET1286INData Raw: 88 c0 4d 55 04 6a 2f d6 b0 4b 26 ba af 14 53 69 50 ea db 0a 94 0b 0b b3 b5 36 17 24 0c 5e 84 2f 22 31 b7 5c 17 f1 fc e3 1c 5c 17 9f 31 c4 7d b2 cc cb b0 5c 79 14 79 b2 76 65 ac 9f 59 ec 28 08 45 5a 14 c4 42 7c 58 fc a5 90 e1 d1 e4 bf 83 23 44 87
                    Data Ascii: MUj/K&SiP6$^/"1\\1}\yyveY(EZB|X#DwT8|9[B1d#7if`I/l7#X-\=osU-:"YL)=NwZT1R,PKvA}==Nui_
                    Feb 28, 2024 00:31:28.105616093 CET1286INData Raw: 29 84 7d d0 cb df 33 ec 0a f5 30 91 26 76 0c 8c 86 b3 fc 9e 6d a0 16 a3 6a c0 15 b5 6d 06 6f af 96 31 5e a0 fd f6 3b fd dc 9c 06 2c ad 6a 02 bd 36 e6 39 61 55 a1 1b 36 1f d8 5b 0d 15 6d 31 6a db ca 2b aa c5 a8 34 51 55 52 34 9c c7 7d 4b dd 7c 9a
                    Data Ascii: )}30&vmjmo1^;,j69aU6[m1j+4QUR4}K|hn}-yaZmya%~6H2|N8:%ZVlE6Xc_ha3N#au|B]d&bezq?DWVf;WJVGFIOXu
                    Feb 28, 2024 00:31:28.105638981 CET1286INData Raw: 29 48 f0 e5 8b 51 ea 7d de 43 e0 25 28 f7 7b 52 2e b1 29 a0 04 88 6a 48 9b 9a e2 f1 dc 5c d4 d1 aa b4 28 21 dd 4e 86 eb b3 7c b8 36 71 96 9a 63 5d 9b b1 46 d4 01 ea 2a e1 a0 15 1d f4 d1 a4 c6 7b 99 23 6a bc e2 66 9e b5 ee 15 4f cd e9 1a 41 f2 a7
                    Data Ascii: )HQ}C%({R.)jH\(!N|6qc]F*{#jfOAg:zRnnjm~J8Od{_#&Z=Uh+A'Y8BgU|G%-e=e_5Ozn16;+VR.nR<IalMaL]_j.
                    Feb 28, 2024 00:31:28.105720997 CET1286INData Raw: 08 e3 b8 c9 5e 9c df f0 9e 6d 33 3b 03 0b 36 22 18 a7 7c 37 f4 2c 58 6b f3 ad 68 4f 40 67 ec 17 33 73 9e c2 83 e5 e3 44 6a 57 67 05 cb 2d a9 ca 7a b7 87 29 62 f2 72 54 eb 5a b8 65 44 b9 99 6c 35 00 79 88 5f 93 9e 17 68 c6 51 89 e7 63 f9 f4 74 e4
                    Data Ascii: ^m3;6"|7,XkhO@g3sDjWg-z)brTZeDl5y_hQct%je7F?<8mgJp4&4v~[mZ;/g&yx|i,!wS:5|2#lMO^aB(m6t:,2
                    Feb 28, 2024 00:31:28.105742931 CET1286INData Raw: 9b c7 27 9d d5 f5 52 b6 f4 53 3f a5 55 23 2d 48 8d b0 53 86 bd b1 12 56 43 61 4c 7f 46 d6 f6 96 f8 d3 49 0d 50 82 1a f7 96 14 75 77 f4 75 39 b0 8d b6 33 1d 79 df 75 f6 b7 d8 3a bc b1 f4 4c 8f 5e fb 6b 56 eb 26 7f aa bd 83 bd a7 8f ac bd 84 41 b4
                    Data Ascii: 'RS?U#-HSVCaLFIPuwu93yu:L^kV&Ac*UZ?\/Y)YZbWTY]t\x*"/xgSph^ cu<Ow|o@xH14=OL85]ZNhZ90UiJ 'MrWv
                    Feb 28, 2024 00:31:28.105762959 CET1286INData Raw: 25 21 ce 5d 75 9d e3 fc 6a 11 79 c6 21 1b 8d ca c9 d9 c4 57 ec 49 4c 23 4d e8 a0 2c 6c de c8 12 46 df f6 95 67 07 9f 8e 54 bc 1c d9 7e 44 f1 7a a4 83 b2 80 13 23 64 ff 33 21 9f a3 ab f2 e8 58 fc 20 8f 8f b4 8d 40 e4 4b a4 7e 6c ca cd 07 55 fe c3
                    Data Ascii: %!]ujy!WIL#M,lFgT~Dz#d3!X @K~lUj\>gP^H$A?y Nm+p`-SO?3?ZAVBV(c\A:OE $O=Rx6jq[WEsBfQI2v


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    3192.168.2.549716162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:28.224021912 CET288OUTGET /cgi-sys/images/x.png HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.345051050 CET1286INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:57:03 GMT
                    Accept-Ranges: bytes
                    Content-Length: 2672
                    Keep-Alive: timeout=5, max=75
                    Content-Type: image/png
                    Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 61 00 00 00 61 08 03 00 00 00 f1 d8 3f 91 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 60 50 4c 54 45 66 00 00 e7 cf cf 8a 5e 5e 86 37 37 cc 00 00 7a 7a 7c bb 02 02 f9 75 75 e7 2d 26 ef 7b 57 a7 01 01 ff ff ff d9 8f 8f d4 41 2d c6 20 17 cd 33 26 e6 69 48 e8 52 42 fd b4 b2 99 00 00 e1 5c 40 bd 8f 8f bc 2f 2f f4 ef ef dc bf bf e3 15 15 db 00 00 f6 8e 60 9f a1 a3 fe 99 74 c5 5f 5f bd 13 10 33 6a 26 19 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 33 2f 30 34 2f 30 39 d9 8b d2 0e 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 34 06 b2 d3 a0 00 00 09 5d 49 44 41 54 68 81 ad 9a 8d 7a ab ac 12 85 31 a1 48 ac c1 2a 89 88 6d e5 fe ef f2 5b 03 a2 88 9a 74 9f e7 8c c6 36 0a f3 ba 06 18 fc 09 fb fc ab 15 5d 5d d6 53 db b7 53 59 97 43 f7 e7 7a ec 4f ce eb a9 11 9c 16 2e 96 a5 ff aa 8b ff 0f a1 9b 14 e7 1c 67 5e 74 66 de 65 3a 30 5b f0 d4 f4 5e cb 1b 42 31 39 9c 6d 39 c4 ef a6 c0 12 bf 0c 35 28 ee eb 8d 92 97 04 f2 70 af e1 d1 98 a2 fb dd 5a 07 92 31 06 45 c4 7d 11 f7 8f 84 5a 09 51 16 f0 52 fc 1e db 77 d7 d1 d1 d2 89 a6 fe 1f 08 43 e3 1c f9 0f ee bf c3 e7 3b ff 1f 5a 48 88 e2 6a 38 73 74 42 30 ad 80 ff c2 74 df bf ef 96 df 5f 34 4d ed 44 7b 12 aa 63 02 55 80 7f 3a d1 ef ef 77 1f 14 2a 8a e2 26 dc 71 a8 8e 08 66 12 ae 2b 8a ee 46 2e fe 62 bf 37 2a ae c4 e3 48 c6 01 a1 50 a2 1d ba ee 8f de a3 81 d1 0a 75 d0 73 f7 04 44 a8 ee 8a df db 3f 12 6e e8 bf b5 53 fb 48 ed 08 b5 73 75 d7 95 a8 f2 cf 4b d7 21 52 3b 44 4e 98 84 42 41 94 5f d6 f7 4b 2c 07 19 5d 2f a6 d7 04 0f 28 6f 8b 7d af ff 7e b5 ad b4 76 1c 47 6b 65 db 7e dd 36 36 97 2b bb ee 9e 23 36 04 53 57 b2 4e 01 ab 77 39 e6 26 db 7d b9 db 6d 8f d8 10 6a a1 ea ee 6b 57 ab b5 c1 a7 95 30 45 1b 7b 0e a9 81 a8 cf 08 03 00 bf 38 e1 ed d2 8e 21 32 4e 54 a2 82 85 8d b2 41 55 9b 17 2f 7f 6b 55 75 c7 04 83 44 d7 95 5f db 1a 77 ef bf 81 5b d1 d7 f5 d0 15 98 1c 86 ba ee 5d 25 40 a1 63 6d 8e 28 7f 55 55 1c 11 4c 5f 95 25 00 a9 f9 f8 58 57 55 ae cc 33 5b f1 54 a2 0a 8c 6d 1d 20 4a d7 9b 03 c2 54 b5 39 40 ce fe 4f 66 b2 62 02 03 ad f1 b5 43 7c 55 6b 6b 2f 84 a1 52 38 f2 48 0a 3e 70 82 56 c1 ff e9 fc 52 b8 ca 8e f2 91 13 1e 65 d9 88 45 73 24 18 85 18 3d 40 78 cc eb e3 41 02 aa aa 3f 9f 24 0b a7 3d e0 91 ad 84 a8 54 3c af 99 60 6a dd 96 de 6f 34 ea 42 10 f0 62 f2 f2 0a ec e3 c8 da b2 5d e2 14 09 68 cb b6 4d cb 70 02 b8 17 b3 3c 7a 86 3a 01 40 48 e9 2a 93 12 0c 9a 79 03 a0 4e ea aa fe c5 0c 1f 00 f7 13 c2 1d 22 fa 94 30 54 ce 13 a8 82 ff 58 02 9c 37 31 01 34 01 be ee 6b 9d f4 83 24 d6 cf 8d cd 56 09 54 78 5e 08 a0 fb 73 ff 9f 9f 7d e5 c6 31 a9 91 2f f0 37 8b 60 73 2b cc 80 b0 36 00 88 57 21 c2 e0 21 c0 7a 52 e9 1a be cb 56 85 96 f0 84 49 cb f6 4e 16 0a dd 7d 37 7d 09 d0 04 58 2d d4 93 32 54 0f db f6 1e ba 13 0b 12 fa 36 29 8f 56 ae f4 e9 f5 8f 07 88 0d 60 36 2b ed a3 59 be c9 36 74 27 22 d4 55 2f d7 23 3e 46 fa c5 38 30 cf aa 1a c7 26 f7 2f 01 48 dd dc 65 e3 47 13 0b 41 92 f7
                    Data Ascii: PNGIHDRaa?sBITO`PLTEf^^77zz|uu-&{WA- 3&iHRB\@//`t__3j&pHYs~tEXtCreation Time03/04/09tEXtSoftwareAdobe Fireworks CS4]IDAThz1H*m[t6]]SSYCzO.g^tfe:0[^B19m95(pZ1E}ZQRwC;ZHj8stB0t_4MD{cU:w*&qf+F.b7*HPusD?nSHsuK!R;DNBA_K,]/(o}~vGke~66+#6SWNw9&}mjkW0E{8!2NTAU/kUuD_w[]%@cm(UUL_%XWU3[Tm JT9@OfbC|Ukk/R8H>pVReEs$=@xA?$=T<`jo4Bb]hMp<z:@H*yN"0TX714k$VTx^s}1/7`s+6W!!zRVIN}7}X-2T6)V`6+Y6t'"U/#>F80&/HeGA
                    Feb 28, 2024 00:31:28.345086098 CET1286INData Raw: 26 01 8c da bd 88 51 5d 69 00 72 42 63 a5 d8 20 1a 29 7d 67 01 c1 68 67 9b fb bc 34 77 f5 26 46 b5 86 02 b5 54 08 95 1a 38 17 da 5a 9b ee 95 4e 1b 4f a8 89 b0 da 38 f2 57 1d 15 00 3e aa 7b 93 99 b5 42 6b 8d 40 a5 fb 14 05 9b 51 cf 53 c9 fe 37 12
                    Data Ascii: &Q]irBc )}ghg4w&FT8ZNO8W>{Bk@QS73x+'Ou)`3J1pD(T,|y Q *@-YG7Jr)&8GC0UyE;sp}a.6rX9 i1V[9
                    Feb 28, 2024 00:31:28.345109940 CET368INData Raw: eb 8d fe a3 e7 e7 74 fe b1 4c dc 58 5c 0d 6d f3 d7 f6 2d 0d 10 5c ca 31 94 8f f5 68 85 10 f2 39 1b e1 ca bb 7f 01 c1 93 52 1e b0 cb c0 d9 7b 20 7f 99 17 64 d0 ba b2 e6 d7 3f 21 38 ad 9c 5f da f0 fc cd cd 4e c1 fe 5d d6 82 78 6f b9 7b 7a 8b 53 ed
                    Data Ascii: tLX\m-\1h9R{ d?!8_N]xo{zSS}7y8o-?@Y~cwLUTxg]4gf'pU->_"9^_"Pj5K_S9#!1txJMF.%?y/w23|
                    Feb 28, 2024 00:31:28.513509035 CET295OUTGET /cgi-sys/images/404top_w.jpg HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.632116079 CET1286INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Last-Modified: Thu, 13 Oct 2022 23:32:33 GMT
                    Accept-Ranges: bytes
                    Content-Length: 4335
                    Keep-Alive: timeout=5, max=74
                    Connection: Keep-Alive
                    Content-Type: image/jpeg
                    Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f6 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X
                    Feb 28, 2024 00:31:28.632152081 CET1286INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Data Ascii:
                    Feb 28, 2024 00:31:28.632174969 CET1286INData Raw: 9e 7a 58 48 d1 17 96 e5 67 3b d1 5b 3f 0d 47 1f 4e c1 5b 1b 1c f3 d2 c2 46 8e 32 dc bc e7 7a 2b 7e 9f 86 a1 e5 2b 63 63 9e 7a 58 48 d1 c6 6b 97 9c ef 45 5f 0b 43 c8 56 c5 c7 be 96 12 34 71 9a e5 cf b5 15 b9 6a d4 23 f8 ca b8 b8 2c 24 68 9b cb 72
                    Data Ascii: zXHg;[?GN[F2z+~+cczXHkE_CV4qj#,$hrjellsK&\,$ixrWC?_+bK8s1<52.8r*hOqpXHEqE^z+cczXHqmE^~Bya#G_z*Z}[F/>T|l
                    Feb 28, 2024 00:31:28.632196903 CET720INData Raw: 4e 8f 90 ab 8b 8f b2 c2 46 88 bd 97 2e 27 d6 2c fc 9d 1f 21 57 1b 1f 65 84 8d 1c 6c b9 79 ce f1 e7 e4 e8 f9 0a b8 d8 fb 2c 24 68 e3 65 cb ce 67 68 f3 1f 07 46 3a 0a b8 b8 fb 2c 24 69 66 f6 5c bc f7 ed 1e 7f 28 d4 e8 47 41 57 1b 1f 65 84 8f e5 26
                    Data Ascii: NF.',!Wely,$heghF:,$if\(GAWe&\XFF:,$if\,|!Wel~JB.>N6\b6)Bz,$h]RQxZ+Sch{CNUDkw2%~7?WW;


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    4192.168.2.549718162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:28.337342024 CET439OUTGET /cgi-sys/images/404bottom.gif HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.461226940 CET804INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:57:33 GMT
                    Accept-Ranges: bytes
                    Content-Length: 537
                    Keep-Alive: timeout=5, max=75
                    Content-Type: image/gif
                    Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 b9 ba 17 04 10 07 ba c0 c1 c2 c3 c4 c5 c6 66 0c 08 1b 17 01 c7 ce cf d0 d1 d2 d3 a7 01 00 44 14 04 d4 db dc dd de df e0 66 0b bf 12 15 1e e1 e8 e9 ea eb ec d4 05 1c 44 0d 23 70 ed f5 f6 f7 f8 f9 98 02 e4 45 13 d9 1b f4 09 1c 48 b0 a0 c1 32 0d 16 14 a0 80 e0 c8 06 0e 14 12 88 a0 f0 40 81 82 08 18 23 bc d9 c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 36 9f 2a 07 64 8c a0 00 03 85 0b 09 28 70 68 b6 44 43 86 05 1c 38 08 98 5a 01 a8 d5 ab 58 b3 6a dd ca b5 ab d7 af 60 c3 8a 1d 4b b6 ec c6 a9 53 39 58 20 51 22 49 10 00 3b
                    Data Ascii: GIF89ad6e|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;
                    Feb 28, 2024 00:31:28.482839108 CET422OUTGET /favicon.ico HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                    Referer: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.606504917 CET1286INHTTP/1.1 404 Not Found
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Last-Modified: Thu, 29 Sep 2022 22:59:45 GMT
                    Accept-Ranges: bytes
                    Vary: Accept-Encoding
                    Content-Encoding: gzip
                    Content-Length: 4677
                    Keep-Alive: timeout=5, max=74
                    Connection: Keep-Alive
                    Content-Type: text/html
                    Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66 04 25 61 db 90 ef 66 51 6d 42 3c ff 71 d3 a2 7f 4d 5a 71 d4 a1 ce ba 30 26 a4 d2 ef d3 56 1c ef 82 80 96 ab 6b 14 93 95 8e 49 26 3b f9 fa 41 83 05 ea 7d 2a 6d a5 44 33 d4 a4 71 b1 99 49 63 79 2b 21 45 66 c8 7d ce 7e f9 e5 e0 60 b1 69 91 ef a6 ab dd a3 c9 f3 17 2f 7e 5d ec
                    Data Ascii: RmssgJ&av$NmRmHInM=_cpw~y3(\G(z}[832qQtjEl0;hQoAqK/^zPP`1PP%J^Vyg::<s}k9=v]Ivs8w>;]Np3xyvGe)e,v&FVIJqM3Hhp8(a{8jotEI.6q^>YZQH]rBis_4:Jar!c(j):{{d!5Dh4+k5yUD$wZ}YQO,5I>i6<]2XpCMe^Wh2.|~l'|v,sTWdG'8RFOE>8.V?\~[KJzp=4LB)YyuFMYb;Cd5[&TWRd{/_lyoY'+G;G\?zJL9*~"P,EO$}(OW<2X!SSQrxOx"#DJMAP!3-uH26?<gR;1<]9G$Vp0sBQ=f%afQmB<qMZq0&VkI&;A}*mD3qIcy+!Ef}~`i/~]
                    Feb 28, 2024 00:31:28.606539011 CET1286INData Raw: ba 42 9a b5 cd c3 17 bf 26 87 2f 56 43 53 84 7b 98 88 e4 2e 37 54 eb b4 bf 38 87 cf fd bf 11 0b 31 29 f2 c2 cf d5 1c 2c 29 99 f2 56 8a 87 e9 e1 08 2a 91 a6 52 e7 43 78 ce 7b 6b 7f 5f d6 68 0b 54 ea fe 21 64 6e 44 33 da c1 62 a2 78 69 04 dd db ac
                    Data Ascii: B&/VCS{.7T81),)V*RCx{k_hT!dnD3bxixqTHr2=-c/7UtoGc-'9_e$'(e66FANz=86CG]__^g^v/o[[iG^6|h7+*(Dk
                    Feb 28, 2024 00:31:28.606560946 CET1286INData Raw: 99 05 e8 94 42 b3 be e6 ec ff c9 54 67 1a 30 2b f3 7c c0 9d 7f 7e 40 28 27 a3 a2 c2 c4 c1 7f 48 9c c1 95 9f 7b a1 33 da 0f 6a 73 72 14 8e bf c3 54 0a b8 15 93 4d 85 8f e2 89 a2 e4 ee 73 4d dc 93 44 09 6b 3d bb 14 7b e3 c2 b9 6a 18 2d da 1c 9a 9d
                    Data Ascii: BTg0+|~@('H{3jsrTMsMDk={j-o|m4aG+.<W6CYkGm^jTRm=9tMj=;74O'y'*22m=3}J'5Ks]lT:_0Y26F8InG.6_dzUZq4"s5R4=
                    Feb 28, 2024 00:31:28.606584072 CET1115INData Raw: 40 d8 55 cc fb f0 da d4 95 50 fb f0 37 a2 52 89 70 e5 1d 57 4f fb 7e a6 e9 fa a0 ae 62 ab 21 d6 2f 10 97 72 01 9f 08 bd 14 f9 40 e3 85 f3 fd ae 88 fb cd ed 6c 9d f6 05 2d 45 03 1a db 0a fb ea 6c 0d 09 c9 f1 51 4b be d9 24 b5 db 67 c9 06 a6 de f8
                    Data Ascii: @UP7RpWO~b!/r@l-ElQK$gYzKoFfKl]DX>+5Oj<u.K!t[EVdpiJ<8)3~(9szG|o(X\v#S3fuHpi"S)*f


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    5192.168.2.549717162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:28.515775919 CET293OUTGET /cgi-sys/images/404mid.gif HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.635072947 CET387INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:58:07 GMT
                    Accept-Ranges: bytes
                    Content-Length: 120
                    Keep-Alive: timeout=5, max=75
                    Content-Type: image/gif
                    Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b
                    Data Ascii: GIF89ad!,dIHDVL*JTPj-;


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    6192.168.2.549719162.241.60.132804068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    Feb 28, 2024 00:31:28.668786049 CET296OUTGET /cgi-sys/images/404bottom.gif HTTP/1.1
                    Host: demsaenlinea.mx
                    Connection: keep-alive
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    Accept-Language: en-US,en;q=0.9
                    Feb 28, 2024 00:31:28.787635088 CET804INHTTP/1.1 200 OK
                    Date: Tue, 27 Feb 2024 23:31:28 GMT
                    Server: Apache
                    Upgrade: h2,h2c
                    Connection: Upgrade, Keep-Alive
                    Last-Modified: Thu, 29 Sep 2022 22:57:33 GMT
                    Accept-Ranges: bytes
                    Content-Length: 537
                    Keep-Alive: timeout=5, max=75
                    Content-Type: image/gif
                    Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 b9 ba 17 04 10 07 ba c0 c1 c2 c3 c4 c5 c6 66 0c 08 1b 17 01 c7 ce cf d0 d1 d2 d3 a7 01 00 44 14 04 d4 db dc dd de df e0 66 0b bf 12 15 1e e1 e8 e9 ea eb ec d4 05 1c 44 0d 23 70 ed f5 f6 f7 f8 f9 98 02 e4 45 13 d9 1b f4 09 1c 48 b0 a0 c1 32 0d 16 14 a0 80 e0 c8 06 0e 14 12 88 a0 f0 40 81 82 08 18 23 bc d9 c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 36 9f 2a 07 64 8c a0 00 03 85 0b 09 28 70 68 b6 44 43 86 05 1c 38 08 98 5a 01 a8 d5 ab 58 b3 6a dd ca b5 ab d7 af 60 c3 8a 1d 4b b6 ec c6 a9 53 39 58 20 51 22 49 10 00 3b
                    Data Ascii: GIF89ad6e|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;


                    HTTPS Proxied Packets

                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.2.54970944.206.44.1774434068C:\Program Files\Google\Chrome\Application\chrome.exe
                    TimestampBytes transferredDirectionData
                    2024-02-27 23:31:27 UTC811OUTGET /campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com HTTP/1.1
                    Host: tracker.club-os.com
                    Connection: keep-alive
                    sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                    sec-ch-ua-mobile: ?0
                    sec-ch-ua-platform: "Windows"
                    Upgrade-Insecure-Requests: 1
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                    Sec-Fetch-Site: none
                    Sec-Fetch-Mode: navigate
                    Sec-Fetch-User: ?1
                    Sec-Fetch-Dest: document
                    Accept-Encoding: gzip, deflate, br
                    Accept-Language: en-US,en;q=0.9
                    2024-02-27 23:31:27 UTC221INHTTP/1.1 303
                    Date: Tue, 27 Feb 2024 23:31:27 GMT
                    Content-Length: 0
                    Connection: close
                    Server: Apache/2.4.57 () OpenSSL/1.0.2k-fips
                    Location: http://demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    1192.168.2.54972223.221.242.90443
                    TimestampBytes transferredDirectionData
                    2024-02-27 23:31:30 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                    Connection: Keep-Alive
                    Accept: */*
                    Accept-Encoding: identity
                    User-Agent: Microsoft BITS/7.8
                    Host: fs.microsoft.com
                    2024-02-27 23:31:30 UTC466INHTTP/1.1 200 OK
                    Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                    Content-Type: application/octet-stream
                    ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                    Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                    Server: ECAcc (chd/079C)
                    X-CID: 11
                    X-Ms-ApiVersion: Distribute 1.2
                    X-Ms-Region: prod-weu-z1
                    Cache-Control: public, max-age=71638
                    Date: Tue, 27 Feb 2024 23:31:30 GMT
                    Connection: close
                    X-CID: 2


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    2192.168.2.54972323.221.242.90443
                    TimestampBytes transferredDirectionData
                    2024-02-27 23:31:30 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                    Connection: Keep-Alive
                    Accept: */*
                    Accept-Encoding: identity
                    If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                    Range: bytes=0-2147483646
                    User-Agent: Microsoft BITS/7.8
                    Host: fs.microsoft.com
                    2024-02-27 23:31:31 UTC773INHTTP/1.1 200 OK
                    Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                    ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                    ApiVersion: Distribute 1.1
                    Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                    X-CID: 7
                    X-CCC: US
                    X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z
                    X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z
                    Content-Type: application/octet-stream
                    X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
                    Cache-Control: public, max-age=71660
                    Date: Tue, 27 Feb 2024 23:31:31 GMT
                    Content-Length: 55
                    Connection: close
                    X-CID: 2
                    2024-02-27 23:31:31 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                    Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                    Session IDSource IPSource PortDestination IPDestination Port
                    3192.168.2.54972723.1.237.91443
                    TimestampBytes transferredDirectionData
                    2024-02-27 23:31:41 UTC2148OUTPOST /threshold/xls.aspx HTTP/1.1
                    Origin: https://www.bing.com
                    Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
                    Accept: */*
                    Accept-Language: en-CH
                    Content-type: text/xml
                    X-Agent-DeviceId: 01000A410900D492
                    X-BM-CBT: 1696428841
                    X-BM-DateFormat: dd/MM/yyyy
                    X-BM-DeviceDimensions: 784x984
                    X-BM-DeviceDimensionsLogical: 784x984
                    X-BM-DeviceScale: 100
                    X-BM-DTZ: 120
                    X-BM-Market: CH
                    X-BM-Theme: 000000;0078d7
                    X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E
                    X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22
                    X-Device-isOptin: false
                    X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}
                    X-Device-OSSKU: 48
                    X-Device-Touch: false
                    X-DeviceID: 01000A410900D492
                    X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh
                    X-MSEdge-ExternalExpType: JointCoord
                    X-PositionerType: Desktop
                    X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI
                    X-Search-CortanaAvailableCapabilities: None
                    X-Search-SafeSearch: Moderate
                    X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time
                    X-UserAgeClass: Unknown
                    Accept-Encoding: gzip, deflate, br
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
                    Host: www.bing.com
                    Content-Length: 2484
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1709076669819&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
                    2024-02-27 23:31:41 UTC1OUTData Raw: 3c
                    Data Ascii: <
                    2024-02-27 23:31:41 UTC2483OUTData Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49
                    Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
                    2024-02-27 23:31:41 UTC476INHTTP/1.1 204 No Content
                    Access-Control-Allow-Origin: *
                    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    X-MSEdge-Ref: Ref A: BA34D464CB684F848A20E8C9E413B41F Ref B: CO1EDGE1210 Ref C: 2024-02-27T23:31:41Z
                    Date: Tue, 27 Feb 2024 23:31:41 GMT
                    Connection: close
                    Alt-Svc: h3=":443"; ma=93600
                    X-CDN-TraceID: 0.57ed0117.1709076701.1c826a0f


                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:00:31:20
                    Start date:28/02/2024
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false

                    General

                    Target ID:2
                    Start time:00:31:23
                    Start date:28/02/2024
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,12986730996068424384,15838849726941630066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false

                    General

                    Target ID:3
                    Start time:00:31:25
                    Start date:28/02/2024
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:true

                    Disassembly

                    ⊘No disassembly