Edit tour

Windows Analysis Report
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

Overview

General Information

Sample URL:	https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3
Analysis ID:	1424453
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML body contains low number of good links

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1904,i,4635795211928151453,16146864486055887246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

HTTP Parser: Number of links: 0

Source: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8

HTTP Parser: No favicon

Source: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

HTTP Parser: No <meta name="author".. found

Source: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/app-external-survey.hash-c52502.css HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/548.hash-c142c0.js HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/app-external-survey.hash-1366dc.js HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ask/v1/client/sites/offsite-survey-info/acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/favicon.hash-4da5c3.ico HTTP/1.1Host: surveys.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/favicon.hash-4da5c3.ico HTTP/1.1Host: surveys.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/1803156/envelope/?sentry_key=75786e51fd834ac5a70737db81a4b9d8&sentry_version=7 HTTP/1.1Host: sentry.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ask/v1/client/sites/offsite-survey-info/acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1Host: surveys.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-3929335.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.429236d560f51d186b8b.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /survey-v2.d837311e92d8b0333fd2.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjowLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /hit?id=1009411&device=desktop HTTP/1.1Host: surveystats.hotjar.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://surveys.hotjar.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a HTTP/1.1Host: survey-images.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t HTTP/1.1Host: survey-images.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /hit?id=1009411&device=desktop HTTP/1.1Host: surveystats.hotjar.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a HTTP/1.1Host: survey-images.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t HTTP/1.1Host: survey-images.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8 HTTP/1.1Host: survey-images.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: survey-images.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=

Source: unknown

DNS traffic detected: queries for: surveys.hotjar.com

Source: unknown

HTTP traffic detected: POST /api/1803156/envelope/?sentry_key=75786e51fd834ac5a70737db81a4b9d8&sentry_version=7 HTTP/1.1Host: sentry.ioConnection: keep-aliveContent-Length: 477sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://surveys.hotjar.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://surveys.hotjar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 11 Apr 2024 13:17:13 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 b33e91c066f49dc7c18162b9a344e266.cloudfront.net (CloudFront)X-Amz-Cf-Pop: JFK50-P6X-Amz-Cf-Id: sGfro5vUvE4y-ylrWLJQT8m9rUwXCmKy53YQ_uXF_-NMLrnhZLEpew==Vary: Origin

Source: chromecache_53.2.dr	String found in binary or memory: https://insights.hotjar.com/static/opengraph/surveys.jpg
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_079c7313cdfb483ea445
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_24e14239202a40539e1c
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_3fb4ea21c7da46f29c70
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_42881654ede443d1b326
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4b93dbe32a7246248e99
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4baaeed77fca4e84a6f0
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4efdbf6a37634449b481
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_74500707f6334ce68440
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_7b5efbcf7d224c6a8434
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_7ca47433da024b6fbbbd
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_9840aef0a6ec4169a062
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_a080a2c5ef2f4112862e
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_b51615befc524c9fa5fc
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_bc95077af1b141bbada0
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_bc957bb8f6d340e2b939
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_d263ea025b6f4097a442
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_d9a0e901c47542019c95
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_e088587b21b245769e6f
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_f291ccaa77784db69fc6
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_f89f73c8d9f94fdeb867
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_19f7f17afefb4505b75d
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_2f05dd0c0867485cbbac
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_3b81e63453444a8ca173
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f1
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_764af843ed74498d8f3a
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_7ddab16346414adaa6d3
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_959b4a7e8f6945bfb2a8
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_cf16135ec4b94ec38ead
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_f05cc51ce58a46499ede
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_ffe6183b3d644cae87cc
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_305092142f284683a36c
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_364d4e34490e44a4bdbf
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_45d57e014a984a2da84b
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_572774314cd644a69a3d
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbeb
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_a49523795aed447c8d7e
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_bc500596ec8545bd9cb1
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_cb5646dd0fe243b393c8
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_d0372c41cfcb43858345
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_ea57b175b2a14d858e3c
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_269c5ba7ea3f4032abbc
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_33eda569d24948f49322
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_3d60f76b4d874d058491
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_6f5ac4462ea24e90b7e0
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_8ba383de9bea4573b554
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_97fcada4e4664ab1b883
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_a6d68b8c6cec4ab88f24
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_acecf613d6124a6eb563
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_aec64ceb09fb473ea339
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_b09716bc494a4c61a340
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_b31cc1c67df4481c8551
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_c48afaf1e1254070b745
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_c5944e3478054f7faa70
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_d6aa4fb066d44ddca68c
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_e65eeff31cc044b082dc
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_eea0159b32894ac9a35d
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f08e7bfc53834186a480
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f301ce922abe42e49f1a
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f30c479b63bb47a8b1e7
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f7e53f58499d4a378024
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/12e8d14d5ddd4a87ac40283988495caa
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/18c1a890c0d146e6a0280174cc69bfda
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/2b5333e8edc24212b710841b7936520f
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/65ce727e78634d829c76a00348989f0a
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/7e72a212f915425e80c24d879d59ab14
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/80104e4c42724083a64328edfbf62464
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/cb929f6bef1e4701a97fb44947555e95
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/ce4dad6b328b429083735f05bae02022
Source: chromecache_54.2.dr	String found in binary or memory: https://survey-images.hotjar.com/surveys/logo/e7b91e86cf494365bd5739c0e2afdd54
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/de.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/el.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/es.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/fi.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/fr.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/it.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/nl.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/pl.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/pt.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/pt_br.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/ru.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/sq.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/sv.html
Source: chromecache_62.2.dr	String found in binary or memory: https://www.hotjarconsent.com/zh.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@17/29@22/13

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1904,i,4635795211928151453,16146864486055887246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1904,i,4635795211928151453,16146864486055887246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3	0%	Avira URL Cloud	safe
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3	0%	Virustotal		Browse
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/sv.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/pt.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/de.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/pl.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/ru.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/fr.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/pt.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/el.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/de.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/sv.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/zh.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/pl.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/fi.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/sq.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/ru.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/el.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/fi.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/it.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/sq.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/pt_br.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/fr.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/es.html	0%	Avira URL Cloud	safe
https://surveystats.hotjar.io/hit?id=1009411&device=desktop	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com/nl.html	0%	Avira URL Cloud	safe
https://www.hotjarconsent.com	0%	Virustotal		Browse
https://www.hotjarconsent.com/zh.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/pt_br.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/es.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/it.html	0%	Virustotal		Browse
https://www.hotjarconsent.com/nl.html	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
script.hotjar.com	18.164.96.90	true	false	high
sentry.io	35.186.247.156	true	false	high
d3q2a7r13qyoht.cloudfront.net	18.164.116.101	true	false	high
www.google.com	142.250.65.164	true	false	high
surveystats.hotjar.io	13.226.34.111	true	false	unknown
surveys.hotjar.com	18.238.49.45	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
static-cdn.hotjar.com	108.138.106.124	true	false	high
static.hotjar.com	unknown	unknown	false	high
survey-images.hotjar.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t	false		high
https://survey-images.hotjar.com/surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a	false		high
about:blank	false	Avira URL Cloud: safe	low
https://static.hotjar.com/c/hotjar-3929335.js?sv=6	false		high
https://script.hotjar.com/modules.429236d560f51d186b8b.js	false		high
https://surveys.hotjar.com/static/app-external-survey.hash-c52502.css	false		high
https://surveys.hotjar.com/static/app-external-survey.hash-1366dc.js	false		high
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3	false		high
https://sentry.io/api/1803156/envelope/?sentry_key=75786e51fd834ac5a70737db81a4b9d8&sentry_version=7	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8	false		high
https://surveys.hotjar.com/static/548.hash-c142c0.js	false		high
https://surveys.hotjar.com/api/ask/v1/client/sites/offsite-survey-info/acb47b15-657f-4926-ae9c-3678736cffb3	false		high
https://script.hotjar.com/survey-v2.d837311e92d8b0333fd2.js	false		high
https://surveystats.hotjar.io/hit?id=1009411&device=desktop	false	Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/favicon.ico	false		high
https://surveys.hotjar.com/static/favicon.hash-4da5c3.ico	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.hotjarconsent.com/sv.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_19f7f17afefb4505b75d	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_9840aef0a6ec4169a062	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_c5944e3478054f7faa70	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_a49523795aed447c8d7e	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_959b4a7e8f6945bfb2a8	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_acecf613d6124a6eb563	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbeb	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/pt.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_7ddab16346414adaa6d3	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/de.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/surveys/logo/ce4dad6b328b429083735f05bae02022	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_e65eeff31cc044b082dc	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_f291ccaa77784db69fc6	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_f89f73c8d9f94fdeb867	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f08e7bfc53834186a480	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/pl.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/surveys/logo/2b5333e8edc24212b710841b7936520f	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/fr.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.hotjarconsent.com/ru.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_ea57b175b2a14d858e3c	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_cf16135ec4b94ec38ead	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f7e53f58499d4a378024	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_6f5ac4462ea24e90b7e0	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_079c7313cdfb483ea445	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_d6aa4fb066d44ddca68c	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_eea0159b32894ac9a35d	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/el.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_3fb4ea21c7da46f29c70	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_b31cc1c67df4481c8551	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/surveys/logo/7e72a212f915425e80c24d879d59ab14	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/surveys/logo/e7b91e86cf494365bd5739c0e2afdd54	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_572774314cd644a69a3d	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/surveys/logo/80104e4c42724083a64328edfbf62464	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_74500707f6334ce68440	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_764af843ed74498d8f3a	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/zh.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://insights.hotjar.com/static/opengraph/surveys.jpg	chromecache_53.2.dr	false		high
https://www.hotjarconsent.com/fi.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4b93dbe32a7246248e99	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_bc500596ec8545bd9cb1	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_d263ea025b6f4097a442	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_305092142f284683a36c	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_bc95077af1b141bbada0	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_42881654ede443d1b326	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_a080a2c5ef2f4112862e	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_aec64ceb09fb473ea339	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_c48afaf1e1254070b745	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_3d60f76b4d874d058491	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4efdbf6a37634449b481	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/sq.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f1	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_2f05dd0c0867485cbbac	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/it.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_3b81e63453444a8ca173	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/surveys/logo/18c1a890c0d146e6a0280174cc69bfda	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_33eda569d24948f49322	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_8ba383de9bea4573b554	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_f05cc51ce58a46499ede	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/pt_br.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_e088587b21b245769e6f	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_a6d68b8c6cec4ab88f24	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_24e14239202a40539e1c	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/surveys/logo/cb929f6bef1e4701a97fb44947555e95	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_7ca47433da024b6fbbbd	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_cb5646dd0fe243b393c8	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_d0372c41cfcb43858345	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_4baaeed77fca4e84a6f0	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_269c5ba7ea3f4032abbc	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/es.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_f30c479b63bb47a8b1e7	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_45d57e014a984a2da84b	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_d9a0e901c47542019c95	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_364d4e34490e44a4bdbf	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_7b5efbcf7d224c6a8434	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_b09716bc494a4c61a340	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_b51615befc524c9fa5fc	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/dbe576ab9312d961d4f75137df7894ee_97fcada4e4664ab1b883	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/surveys/logo/65ce727e78634d829c76a00348989f0a	chromecache_54.2.dr	false		high
https://www.hotjarconsent.com/nl.html	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://survey-images.hotjar.com/surveys/logo/12e8d14d5ddd4a87ac40283988495caa	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/1249d1578c826dee5ef93ad13d5f137a_bc957bb8f6d340e2b939	chromecache_54.2.dr	false		high
https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_ffe6183b3d644cae87cc	chromecache_54.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.238.49.8	unknown	United States	16509	AMAZON-02US	false
108.138.106.124	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
35.186.247.156	sentry.io	United States	15169	GOOGLEUS	false
18.238.49.45	surveys.hotjar.com	United States	16509	AMAZON-02US	false
18.164.96.90	script.hotjar.com	United States	3	MIT-GATEWAYSUS	false
18.164.116.101	d3q2a7r13qyoht.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.226.34.40	unknown	United States	16509	AMAZON-02US	false
13.226.34.111	surveystats.hotjar.io	United States	16509	AMAZON-02US	false
142.250.65.164	www.google.com	United States	15169	GOOGLEUS	false
18.164.116.92	unknown	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1424453
Start date and time:	2024-04-11 15:15:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@17/29@22/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.32.99, 142.251.35.174, 142.251.167.84, 34.104.35.123, 142.250.80.74, 142.251.35.170, 142.251.40.234, 142.250.80.42, 142.250.72.106, 142.251.40.138, 142.250.176.202, 142.251.40.202, 142.250.65.202, 172.217.165.138, 142.251.40.170, 142.251.40.106, 142.250.65.170, 142.250.80.10, 142.250.64.106, 142.250.80.106, 20.114.59.183, 199.232.214.172, 20.3.187.198, 192.229.211.108, 20.166.126.56, 142.250.65.163
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4291
Entropy (8bit):	7.886695390088759
Encrypted:	false
SSDEEP:	96:DVB3CFAdOghvJfDiu6tOJ6qfYV4Ek1vrj6leDvG2eX87jFsVVaHnW+:DVBSghTTlEUn6lerG2eSFkaHW+
MD5:	594D8872C97432B782C80AA50C38C91F
SHA1:	02EA5C1D00A8F563C974C52FBAA89CA5F9ED56F7
SHA-256:	A422E15083D3EAC1A52BE6D1B1F300D85965D5A63CC1C6B3846242E15AEFC7C6
SHA-512:	FE90208CC2003E0DB4ECD65FFD2ECAF3FC3D91AECECF4B34381A801B85290E19B0E28DC591C6A4CD267C7B098621E2E03074024A46C80AC375D3D0469F01C813
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......k........L....sRGB.........gAMA......a.....pHYs..........+.....XIDATx^...TE.....EE..].....kb...(j.5.h.Dc.......&.....,.b.A..^Q...E,...g.....9.{....I6....s...;.}.\|.......k.@......&u....SL....-!..t.......H..'DB$8!.".....N..hY@......3m.4.........t...t.........j.Q.!.-@>..s..W_.._.,..r.^.w...6.'N4---...a......m.G...#.<b...}.c.%....~......f{..O>1.<.@.....r.-.=......;.0S.N5.....9w.i'..{fG......an..V.W..e.].>..m.G....z.-..s.g.y...>F4:.kAly.~....J...;e.3g....{+...AhEb........B.e.*..........s..:u.>.@p!s..m..Ec....b....c.=.......+d..={.y.7....o....lo.E)3....Z.K/.d..ZYe.U.O..).Bp..o..J,.....c...>....jE......k.<.Ls.E..;......^..B}.....`....[o.m..~.....m...A,...F..^.ze[%:t.`}=....O./.....k..>\|.....O?.g.}6..7.\|..L.s....2'.\|.9..#.)..b.j.%..B.Yi...O...(y...^\|...bF8.X..@\k....t.M..^..D..x......5....RKU.M.\|....k.S..Q.u.Y'.T.&.K....2E.../..y..wm..-.....k..cf'h.s....?.....3...Y.feG...Z...w,.z.G....~.<...O......#...~.....!.j..+.0

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	7.91500423201005
Encrypted:	false
SSDEEP:	96:DGJH4AJr9NI+yPO6lQWp6Lgh2fuRbv4Jat+nNhtDK:DLernwBp3h2fo4kONDm
MD5:	69261AF69086FD829A6EAF6819400AC7
SHA1:	790C3BF9D3E5A1DA4F8C2FB628AE83339C9D6ACF
SHA-256:	C61EF296B4AB94BFAD58355D27AE6DA4047997F07DF50582DA0BCA39578C580E
SHA-512:	31C65E28C239E692C0D2FA23E919A34A57A499C99A3671C165FF06DF5143BD990615C138129262D3348A3C72BD8745C93ED02AF62DE074630C1B3B58227F66B9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......k........L....IDATx..[P.W...=.s.&w...\...E$.I.....R.R.$....S...zu.S&...U.....K.h...F.../....&.e.....[..j...{....;..{1.......^k..;.w.8L...~....K..h.....QQ...6AL...=...I...BBHp.!!$8.....AH... $.}.. ..T....>\|.......@.T"$$.K.,Azz...$..@.z=...........=..../..?.......q$.@.\|.2t:.d2.%.t:.h."...L....n\.pA.m.F..+V...v;N.>...j.l6(.J.[.....S.......N....}.a..fF......s...>...A.PL.....@...S(.<........V+.;..F....O.."8\.\|.....T.Q...f...N.Cnn..5..x.....r...wKK....q..t$....h..[ll,JKK.......$%%...B.....EEE~..%8...vh..).....###..;w.h...$............H\|..HNNv.q.......[.nA.......a...~.Ga..&+.`\.....:'??.eee...^{.....T;Dp....8~..AA.Ol..0.....9.........8.T.....p..L&...a...........I..P(..{...CCC...Azz:.... "v....\|........z.Z.*..YSS...a..[R..L....).....f'o.._]...f..bbb.R.....e.......(.........rss....p......x..X,........N'..AHH."##1k......d2.......h......l6..g0..Z.......EDD."""...'6..O.<..h...L&s...7::..O..b.`ll.2..aaa.....&.\.F&...t..;.....s..

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1399), with no line terminators
Category:	downloaded
Size (bytes):	1399
Entropy (8bit):	4.857858462265073
Encrypted:	false
SSDEEP:	24:0VZpt7OhGVj7bPGZ/U+JAurP741sTJ0Oh:0VZpIyj7b6/9rP74mz
MD5:	E3FF40D3D999F500C0DF8E5DA02CB9DF
SHA1:	4DA21059B4F6C703642E81165E4224D4CF9294EA
SHA-256:	D54D91E17B6CA2B9142AA7857F61DFDFEE99009EA5B2CFE860C0C516ECB89221
SHA-512:	A7631FDE7C75D5EE8579F4BE45C05EA386DB01F7AAF1C8C265BB4B955542DDBB054B6883D5E6E3F5360A6DB618AA96A1C3B64066DE554ED2382437B5689DE575
Malicious:	false
Reputation:	low
URL:	https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3
Preview:	<!doctype html> <html lang=en> <head> <link href=/static/favicon.hash-4da5c3.ico rel="shortcut icon"/> <meta content="text/html; charset=utf-8" http-equiv=content-type /> <meta content="width=device-width,initial-scale=1" name=viewport /> <meta content="Hotjar Survey" property=og:title /> <meta content="Survey powered by Hotjar.com. Create your own Survey now - it's free, quick & easy!" property=og:description /> <meta content=website property=og:type /> <meta content=https://insights.hotjar.com/static/opengraph/surveys.jpg property=og:image /> <meta content=1200 property=og:image:width /> <meta content=630 property=og:image:height /> <meta content="Hotjar Survey" property=twitter:title /> <meta content="Survey powered by Hotjar.com. Create your own Survey now - it's free, quick & easy!" property=twitter:description /> <meta content=https://insights.hotjar.com/static/opengraph/surveys.jpg property=twitter:image /> <meta content=Hotjar property=twitter:site /> <meta charset=UTF-8 /> <ti

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (28217)
Category:	downloaded
Size (bytes):	36039
Entropy (8bit):	5.498657635054047
Encrypted:	false
SSDEEP:	384:S9TYQjYwlYaRMYcwmNYmS10YIQYxKYsffYITYu+bnBbseSelvzgbrB5Nd:2TYaYWYHYchYWYbYgYafYSYMfehzgbfb
MD5:	50D18C8C10A2D001979D0D35377B0869
SHA1:	FB507D34DF76F87E2887D20FB23AAF40248EEB75
SHA-256:	8A7BFB25185A6C5429CEDD8F8C6EA1458704E2957C651F5959F4EA09F3DAC43D
SHA-512:	929E4845E9C732414A477017F4B97CE843D3848A9B40AF91D48DA37B3AA76FD15B84B0518048E11B4D2FBC54E78C069554B1A7A0316933E64736D8E9C0CC12DC
Malicious:	false
Reputation:	low
URL:	https://static.hotjar.com/c/hotjar-3929335.js?sv=6
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":3929335,"rec_value":1,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":true,"session_capture_console_consent":true,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":false,"suppress_location":false,"user_attributes_enabled":true,"legal_name":null,"privacy_policy_url":null,"deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[],"heatmaps":[],"polls":[{"id":1009735,"created_epoch_time":1712747129,"skin":"dark","background":"#1e0b0b","effective_show_branding":false,"position":"right","content":{"version":2,"questions":[{"uuid":"da3dac68-41a5-4dd4-92ae-377bc34b1b21","type":"email","text":"SIGN IN TO TRANSCRIBE VOICEMAIL ENTER EMAIL","required":true,"next":"byOrder","image_url":"https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_f05cc51ce58a464

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	137552
Entropy (8bit):	5.302822026429638
Encrypted:	false
SSDEEP:	1536:h1EiYY7z39kda+lMnWJCopfvCTPM4+kYj3CyQ4:fs7UWJbfvCTPn+jN9
MD5:	2774A306E5FFC03F75BAB753ECDDFAD7
SHA1:	98E38971D8AB7C0918F0944DD34D4FD9FEF1F51C
SHA-256:	C64C04D72578BEFC2779FB7DAD0E0505051503B7FC616063A7AD1ABBDB64B2E5
SHA-512:	ED6FAEFAD0B9123576BEBEE7D6EFBD5D04F13690E1163D96656BC469A3CB194ED1D009B42679E2A2E6D678D92EE393E35F9D5AF2CB4A60337C336914FD95B901
Malicious:	false
Reputation:	low
URL:	https://surveys.hotjar.com/static/548.hash-c142c0.js
Preview:	/! For license information please see 548.hash-c142c0.js.LICENSE.txt /.(self.webpackChunk_hotjar_app_external_survey=self.webpackChunk_hotjar_app_external_survey\|\|[]).push([[548],{748:function(t,e,n){"use strict";var r,o;function i(t){return i="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},i(t)}function s(t,e,n){return(e=function(t){var e=function(t,e){if("object"!==i(t)\|\|null===t)return t;var n=t[Symbol.toPrimitive];if(void 0!==n){var r=n.call(t,"string");if("object"!==i(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(t)}(t);return"symbol"===i(e)?e:String(e)}(e))in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}n.d(e,{Wg:function(){return f},h$:function(){return u},ju:function(){return a},uc:function(){return m}}),n(35),n(3487),n(1577),n(444),

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15406
Entropy (8bit):	2.9977353393445316
Encrypted:	false
SSDEEP:	96:5rsS2QvUjg0s3qgpvRk0l/904h6eWDMozY3nZw6r1SZJnJtHd+7idg4OHFwXP4:5rktg0sbk0l/9ROMogdQ7nJtLtOlYP4
MD5:	AFE9DEB25BE988F82F8454AE9E46D6D2
SHA1:	8FE85874BF11A46CEF49B230A549CD786A669550
SHA-256:	5E85B13525BF3FDAEE8725BCEAA820D9D5DE5B807D2E9791163D3057898D0D17
SHA-512:	368697E75E7B82CF965DC200348713CEE4CF4FE19BBDC7DDDDA05154E6E8B96AB16A86BF1A6FACD49B7FD21BECB5EE8EF0A00E23CD253284E604B0F5943BFFC8
Malicious:	false
Reputation:	low
URL:	https://surveys.hotjar.com/static/favicon.hash-4da5c3.ico
Preview:	............ .h...6... .... .(.......00.... .h&......(....... ..... ..........................5...;...;...<...<...<...<...<...<...<...<...<...<...<...<...5...<...<...<...<...<...=...@...@...<...<...<...<...<...<...<...;...<...<...<...<...<..\...........D...<...<...<...<...<...<...;...<...<...<...<...<..(Z..........An...<...<...<...<...<...<...<...<...<...<...<...<...C..............Gr...A...<...<...<...<...<...<...<...<...@...@...=..2b..................!U...<...<...<...<...<...<...K...........T...<..1a..................$X...<...<...<...<...<...I..........`....=...<...C..U}...............@...<...<...<...<...@..............U}...C...<...=..`............I...<...<...<...<...<..'Z..................0`...<...T...........K...<...<...<...<...<...<..!U..................1a...=...@...@...<...<...<...<...<...<...<...<...A..Gr...............C...<...<...<...<...<...<...<...<...<...<...<...<..Bn..........'Z...<...<...<...<...<...<...<...<...<...<...<...<...D..........\...<...<...<...<...<...;...<...<

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 107, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4291
Entropy (8bit):	7.886695390088759
Encrypted:	false
SSDEEP:	96:DVB3CFAdOghvJfDiu6tOJ6qfYV4Ek1vrj6leDvG2eX87jFsVVaHnW+:DVBSghTTlEUn6lerG2eSFkaHW+
MD5:	594D8872C97432B782C80AA50C38C91F
SHA1:	02EA5C1D00A8F563C974C52FBAA89CA5F9ED56F7
SHA-256:	A422E15083D3EAC1A52BE6D1B1F300D85965D5A63CC1C6B3846242E15AEFC7C6
SHA-512:	FE90208CC2003E0DB4ECD65FFD2ECAF3FC3D91AECECF4B34381A801B85290E19B0E28DC591C6A4CD267C7B098621E2E03074024A46C80AC375D3D0469F01C813
Malicious:	false
Reputation:	low
URL:	https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8
Preview:	.PNG........IHDR.......k........L....sRGB.........gAMA......a.....pHYs..........+.....XIDATx^...TE.....EE..].....kb...(j.5.h.Dc.......&.....,.b.A..^Q...E,...g.....9.{....I6....s...;.}.\|.......k.@......&u....SL....-!..t.......H..'DB$8!.".....N..hY@......3m.4.........t...t.........j.Q.!.-@>..s..W_.._.,..r.^.w...6.'N4---...a......m.G...#.<b...}.c.%....~......f{..O>1.<.@.....r.-.=......;.0S.N5.....9w.i'..{fG......an..V.W..e.].>..m.G....z.-..s.g.y...>F4:.kAly.~....J...;e.3g....{+...AhEb........B.e.*..........s..:u.>.@p!s..m..Ec....b....c.=.......+d..={.y.7....o....lo.E)3....Z.K/.d..ZYe.U.O..).Bp..o..J,.....c...>....jE......k.<.Ls.E..;......^..B}.....`....[o.m..~.....m...A,...F..^.ze[%:t.`}=....O./.....k..>\|.....O?.g.}6..7.\|..L.s....2'.\|.9..#.)..b.j.%..B.Yi...O...(y...^\|...bF8.X..@\k....t.M..^..D..x......5....RKU.M.\|....k.S..Q.u.Y'.T.&.K....2E.../..y..wm..-.....k..cf'h.s....?.....3...Y.feG...Z...w,.z.G....~.<...O......#...~.....!.j..+.0

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4438)
Category:	downloaded
Size (bytes):	4502
Entropy (8bit):	5.342666478540798
Encrypted:	false
SSDEEP:	48:s/PJBt73uMdt9M88Gnht04x+ThthQAzSBSzGSlStgXGxyjc32H712xNLd5+Il:mtLltmaht0pthS4lEkcy8ThcIl
MD5:	8F2B2E283282CCBB0F004C077CCEBE0A
SHA1:	0A6EE6EE21912EF93165179FE3A7305A8BC7A259
SHA-256:	0E8E626E1C16E9FA927017C7985B07E4F5FD9F68E6D0ADED83ED02DC53C90D8A
SHA-512:	E1A7932DA44774548F308F4973C9F51FEE6456E018ADB03E804DCB997BF353420D0C8860C882ECBB984EF528655D9D7A180E5A22CE67E0DBDD83B1F57F54FD80
Malicious:	false
Reputation:	low
URL:	https://surveys.hotjar.com/static/app-external-survey.hash-c52502.css
Preview:	@font-face{font-family:"Ambit";src:url(/static/df0c17e9afd351ea83d8.woff2) format("woff2"), url(/static/230b89ca9ccd11075231.woff) format("woff");font-weight:600;font-style:normal}@font-face{font-family:"Open Sans";src:url(/static/4900389b61d2a6bba56b.eot);src:url(/static/4900389b61d2a6bba56b.eot?#iefix) format("embedded-opentype"), url(/static/4c4f25fa006bc5d9ab2d.woff2) format("woff2"), url(/static/c0aa4130d9615e61666b.woff) format("woff"), url(/static/fc10ccf11a61bac919b9.ttf) format("truetype"), url(/static/a5650f5312c870346cae.svg#OpenSans-Bold) format("svg");font-weight:700;font-style:normal}@font-face{font-family:"Open Sans";src:url(/static/787f0332413f7c123ebc.eot);src:url(/static/787f0332413f7c123ebc.eot?#iefix) format("embedded-opentype"), url(/static/7e2add23a18c1525c01a.woff2) format("woff2"), url(/static/9b1ed45839c95bed559e.woff) format("woff"), url(/static/ec993defe70da9dbbc3f.ttf) format("truetype"), url(/static/23b493b3c539e82724a2.svg#OpenSans-Light) format("svg");fon

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:HfTORnYn:qRnY
MD5:	9B5719B531993D7EEF5EB4C692F2238C
SHA1:	9C9A21624C975F0741B743348DE85A09FDA7E669
SHA-256:	27008C4818CC0695B1496B0E8026DDFB7999C7FA066F78C61A76AF0FFECEF4BF
SHA-512:	39CC9DC2E4DACFA6D1D7E23759ED7FB13C3111992BCA5DAA97CE1ADB37205056118FC1105D85E38B8E902A2F8CD68656AD36D53642DE60368E054BE86942BBA8
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmeiXbFHmgstBIFDVALr7A=?alt=proto
Preview:	CgkKBw1QC6+wGgA=

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15406
Entropy (8bit):	2.9977353393445316
Encrypted:	false
SSDEEP:	96:5rsS2QvUjg0s3qgpvRk0l/904h6eWDMozY3nZw6r1SZJnJtHd+7idg4OHFwXP4:5rktg0sbk0l/9ROMogdQ7nJtLtOlYP4
MD5:	AFE9DEB25BE988F82F8454AE9E46D6D2
SHA1:	8FE85874BF11A46CEF49B230A549CD786A669550
SHA-256:	5E85B13525BF3FDAEE8725BCEAA820D9D5DE5B807D2E9791163D3057898D0D17
SHA-512:	368697E75E7B82CF965DC200348713CEE4CF4FE19BBDC7DDDDA05154E6E8B96AB16A86BF1A6FACD49B7FD21BECB5EE8EF0A00E23CD253284E604B0F5943BFFC8
Malicious:	false
Reputation:	low
Preview:	............ .h...6... .... .(.......00.... .h&......(....... ..... ..........................5...;...;...<...<...<...<...<...<...<...<...<...<...<...<...5...<...<...<...<...<...=...@...@...<...<...<...<...<...<...<...;...<...<...<...<...<..\...........D...<...<...<...<...<...<...;...<...<...<...<...<..(Z..........An...<...<...<...<...<...<...<...<...<...<...<...<...C..............Gr...A...<...<...<...<...<...<...<...<...@...@...=..2b..................!U...<...<...<...<...<...<...K...........T...<..1a..................$X...<...<...<...<...<...I..........`....=...<...C..U}...............@...<...<...<...<...@..............U}...C...<...=..`............I...<...<...<...<...<..'Z..................0`...<...T...........K...<...<...<...<...<...<..!U..................1a...=...@...@...<...<...<...<...<...<...<...<...A..Gr...............C...<...<...<...<...<...<...<...<...<...<...<...<..Bn..........'Z...<...<...<...<...<...<...<...<...<...<...<...<...D..........\...<...<...<...<...<...;...<...<

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	226211
Entropy (8bit):	5.379232357747267
Encrypted:	false
SSDEEP:	3072:nhwvwD82w8dix0Dvz6FkvYPUa3FmBRDYi:nhwvwi8ExwrokbaQbDYi
MD5:	82C928EB184B2CE235902634D808A4FC
SHA1:	7297E763CB394CE3889828DB4589AB5DB5735459
SHA-256:	FA8CABE3021C19BA54E07D28A7722CD4BFDEF39DEA07207518113F7E161166BB
SHA-512:	A7DE53B8B22B4942B3A7C26FC1DB2FE5B6438931A5300C2F9834D81D1C5FF0944785666402BDC382EB555F4E2658591D1807C51097064F2E9C5AD083383B4D4E
Malicious:	false
Reputation:	low
URL:	https://script.hotjar.com/modules.429236d560f51d186b8b.js
Preview:	/! For license information please see modules.429236d560f51d186b8b.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65448)
Category:	downloaded
Size (bytes):	292145
Entropy (8bit):	5.697014559680464
Encrypted:	false
SSDEEP:	3072:ODOPtMePtMKw+MAKZypw7tvPiqssFwKIzIexqwhEFaa/jjSIz57UpyIVC:ODCwZymPjfFwJzIexqwhI9z57UpyIC
MD5:	A7BA8380BBFA314DA0A00F378492219E
SHA1:	6FF8F4C2F0E886CADCB2B9669AC537FD12999A73
SHA-256:	28850B5DF0AE27E5F64CFF6ABFE07D7AA2A27F327640772D20F44839134298C2
SHA-512:	94FD9505979725532BE95F8128709C3D7DEF9BF4DB7EC8667519AA2D0B39499D67C577B5508060256D709419B0F444C09403631759364C0331F7681DA9A0A44E
Malicious:	false
Reputation:	low
URL:	https://script.hotjar.com/survey-v2.d837311e92d8b0333fd2.js
Preview:	/! For license information please see survey-v2.d837311e92d8b0333fd2.js.LICENSE.txt /.!function(){var e={62:function(e,t,n){n.p=hj.scriptDomain},3270:function(e,t,n){"use strict";n.r(t);var r=n(5933),o=n.n(r)()((function(e){return e[1]}));o.push([e.id,"._hj-widget-container ._hj-cK\\+L-__styles__consentMessage,._hj_feedback_container ._hj-cK\\+L-__styles__consentMessage{color:#7c7c7c !important}._hj-widget-container ._hj-cK\\+L-__styles__consentMessage._hj-RTq8B__styles__dark,._hj_feedback_container ._hj-cK\\+L-__styles__consentMessage._hj-RTq8B__styles__dark{color:rgba(255,255,255,0.6) !important}._hj-widget-container ._hj-cK\\+L-__styles__consentMessage._hj-N21Xh__styles__light,._hj_feedback_container ._hj-cK\\+L-__styles__consentMessage._hj-N21Xh__styles__light{color:rgba(0,0,0,0.6) !important}._hj-widget-container ._hj-cK\\+L-__styles__consentMessage a,._hj_feedback_container ._hj-cK\\+L-__styles__consentMessage a{color:inherit !important}._hj-widget-container ._hj-B\\+0X3__style

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17624)
Category:	downloaded
Size (bytes):	17773
Entropy (8bit):	5.320911620939325
Encrypted:	false
SSDEEP:	384:5XczVOKwNbcxfHfzSmuBPqPn7HvXpC/kRr2:it+bcxf7SmuRqP7HxCMB2
MD5:	AB766B9B3972AAD6F2E660225D227ECA
SHA1:	0151BB5ADA788292E011935C4A0D35980D9F5FA2
SHA-256:	93623B438C10D66DD84836DCDEE455C739FB8FB041C265F7CD6176F3CDDF1D3C
SHA-512:	A0640ABECF26B1E7C891C41EC10EE2CC0C40242B2BB75BC8D58F9EC5D289CCAE478D0B162620642E1D57E6A8FC08B807CD93B27D043DF651B29926CE7DA1A482
Malicious:	false
Reputation:	low
URL:	https://surveys.hotjar.com/static/app-external-survey.hash-1366dc.js
Preview:	/! For license information please see app-external-survey.hash-1366dc.js.LICENSE.txt /.!function(){var t,e={8147:function(t,e,r){"use strict";r.r(e),r(35),r(3487),r(424),r(5818),r(444),r(636),r(1931),r(143),r(9627),r(6276),r(8496),r(7408),r(115),r(6740),r(3798),r(1755),r(8504),r(780),r(7537),r(3044),r(3077),r(7667),r(1159),r(1059),r(4866),r(9878);var n,o,i,a=r(7837),s=r.n(a),c=r(748),u=r(1251);function l(t){return l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},l(t)}function h(){h=function(){return e};var t,e={},r=Object.prototype,n=r.hasOwnProperty,o=Object.defineProperty\|\|function(t,e,r){t[e]=r.value},i="function"==typeof Symbol?Symbol:{},a=i.iterator\|\|"@@iterator",s=i.asyncIterator\|\|"@@asyncIterator",c=i.toStringTag\|\|"@@toStringTag";function u(t,e,r){return Object.defineProperty(t,e,{value:r,enumerable:!0,configurable:!0,writab

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 107, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4827
Entropy (8bit):	7.91500423201005
Encrypted:	false
SSDEEP:	96:DGJH4AJr9NI+yPO6lQWp6Lgh2fuRbv4Jat+nNhtDK:DLernwBp3h2fo4kONDm
MD5:	69261AF69086FD829A6EAF6819400AC7
SHA1:	790C3BF9D3E5A1DA4F8C2FB628AE83339C9D6ACF
SHA-256:	C61EF296B4AB94BFAD58355D27AE6DA4047997F07DF50582DA0BCA39578C580E
SHA-512:	31C65E28C239E692C0D2FA23E919A34A57A499C99A3671C165FF06DF5143BD990615C138129262D3348A3C72BD8745C93ED02AF62DE074630C1B3B58227F66B9
Malicious:	false
Reputation:	low
URL:	https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t
Preview:	.PNG........IHDR.......k........L....IDATx..[P.W...=.s.&w...\...E$.I.....R.R.$....S...zu.S&...U.....K.h...F.../....&.e.....[..j...{....;..{1.......^k..;.w.8L...~....K..h.....QQ...6AL...=...I...BBHp.!!$8.....AH... $.}.. ..T....>\|.......@.T"$$.K.,Azz...$..@.z=...........=..../..?.......q$.@.\|.2t:.d2.%.t:.h."...L....n\.pA.m.F..+V...v;N.>...j.l6(.J.[.....S.......N....}.a..fF......s...>...A.PL.....@...S(.<........V+.;..F....O.."8\.\|.....T.Q...f...N.Cnn..5..x.....r...wKK....q..t$....h..[ll,JKK.......$%%...B.....EEE~..%8...vh..).....###..;w.h...$............H\|..HNNv.q.......[.nA.......a...~.Ga..&+.`\.....:'??.eee...^{.....T;Dp....8~..AA.Ol..0.....9.........8.T.....p..L&...a...........I..P(..{...CCC...Azz:.... "v....\|........z.Z.*..YSS...a..[R..L....).....f'o.._]...f..bbb.R.....e.......(.........rss....p......x..X,........N'..AHH."##1k......d2.......h......l6..g0..Z.......EDD."""...'6..O.<..h...L&s...7::..O..b.`ll.2..aaa.....&.\.F&...t..;.....s..

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 107, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4291
Entropy (8bit):	7.886695390088759
Encrypted:	false
SSDEEP:	96:DVB3CFAdOghvJfDiu6tOJ6qfYV4Ek1vrj6leDvG2eX87jFsVVaHnW+:DVBSghTTlEUn6lerG2eSFkaHW+
MD5:	594D8872C97432B782C80AA50C38C91F
SHA1:	02EA5C1D00A8F563C974C52FBAA89CA5F9ED56F7
SHA-256:	A422E15083D3EAC1A52BE6D1B1F300D85965D5A63CC1C6B3846242E15AEFC7C6
SHA-512:	FE90208CC2003E0DB4ECD65FFD2ECAF3FC3D91AECECF4B34381A801B85290E19B0E28DC591C6A4CD267C7B098621E2E03074024A46C80AC375D3D0469F01C813
Malicious:	false
Reputation:	low
URL:	https://survey-images.hotjar.com/surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a
Preview:	.PNG........IHDR.......k........L....sRGB.........gAMA......a.....pHYs..........+.....XIDATx^...TE.....EE..].....kb...(j.5.h.Dc.......&.....,.b.A..^Q...E,...g.....9.{....I6....s...;.}.\|.......k.@......&u....SL....-!..t.......H..'DB$8!.".....N..hY@......3m.4.........t...t.........j.Q.!.-@>..s..W_.._.,..r.^.w...6.'N4---...a......m.G...#.<b...}.c.%....~......f{..O>1.<.@.....r.-.=......;.0S.N5.....9w.i'..{fG......an..V.W..e.].>..m.G....z.-..s.g.y...>F4:.kAly.~....J...;e.3g....{+...AhEb........B.e.*..........s..:u.>.@p!s..m..Ec....b....c.=.......+d..={.y.7....o....lo.E)3....Z.K/.d..ZYe.U.O..).Bp..o..J,.....c...>....jE......k.<.Ls.E..;......^..B}.....`....[o.m..~.....m...A,...F..^.ze[%:t.`}=....O./.....k..>\|.....O?.g.}6..7.\|..L.s....2'.\|.9..#.)..b.j.%..B.Yi...O...(y...^\|...bF8.X..@\k....t.M..^..D..x......5....RKU.M.\|....k.S..Q.u.Y'.T.&.K....2E.../..y..wm..-.....k..cf'h.s....?.....3...Y.feG...Z...w,.z.G....~.<...O......#...~.....!.j..+.0

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text
Category:	downloaded
Size (bytes):	255
Entropy (8bit):	5.651458554041971
Encrypted:	false
SSDEEP:	6:TMVBd/ZbZjZvKtWRVzjI03RQH4Wmp5aPxYZltih6ian:TMHd9BZKtWRV3+VWaPyntwa
MD5:	18D2D564A71C84F203A71A61E90F44EA
SHA1:	92B01F7BEBD87C662CCDA1DF1C59DC7755350DCC
SHA-256:	FB4C8CE28F5B3131B7E8B20AE0D1F267B840E2C4A15432752CC9EED50615096A
SHA-512:	010B524DC39B4AA92299502C6D92E2645C9A60AFB507895706D6138978D2058C79838BB6630FB5324E8F11ACC75689C77B5690E01C842789A3F09EE99A1CBB92
Malicious:	false
Reputation:	low
URL:	https://survey-images.hotjar.com/favicon.ico
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>ZGXJ8MRHEDK3ZV4B</RequestId><HostId>hVAUdbnQ1FS9/czw+9xuSaPhSXpLyrOnfbLr5elcw5jjfqZ4gJt1bnNl/JNiAsHqcluaRokxP8oJsBOfHWChmw==</HostId></Error>

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 11, 2024 15:16:44.395597935 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 11, 2024 15:16:52.703214884 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.703263044 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.703342915 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.703736067 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.703819036 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.703888893 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.703947067 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.703969002 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.704309940 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.704382896 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.944799900 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.944802999 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.945291996 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.945312023 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.945431948 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.945455074 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.946810961 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.946893930 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.946902990 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.946966887 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.949139118 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.949228048 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.949726105 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.949737072 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.950213909 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.950293064 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:52.991728067 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.991738081 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:52.991758108 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.038734913 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.305954933 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.306055069 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.306313992 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.307235003 CEST	49735	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.307260036 CEST	443	49735	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.329895020 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.329916000 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.329965115 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.329997063 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.330477953 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.330530882 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.330594063 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.330842018 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.330854893 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.331109047 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.331126928 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.372227907 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.522346020 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.524019957 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.524045944 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.524401903 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.524563074 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.525417089 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.525480986 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.525608063 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.525619984 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.525830984 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.526117086 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.526580095 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.526679039 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.526698112 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.568243027 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.568258047 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.570420980 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.701803923 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.703691006 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.714004993 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.714025021 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.714267969 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.714292049 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.714442968 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.715749025 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715766907 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715790987 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715842009 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.715863943 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715881109 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.715884924 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715899944 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.715940952 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.715970039 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.716589928 CEST	49739	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.716599941 CEST	443	49739	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721045017 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721071005 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721138954 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721147060 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.721179008 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721213102 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.721241951 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.721296072 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.724447012 CEST	49736	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.724482059 CEST	443	49736	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.728547096 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.728564024 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.728682041 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.728702068 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.772547960 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.795092106 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.795185089 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.795341969 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.795342922 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.795365095 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.795414925 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.812005043 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.812021017 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.812150955 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.812165022 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.812308073 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.822002888 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.822021961 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.822132111 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.822143078 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.822207928 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.824522972 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.871417999 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.871438980 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.871622086 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.871644020 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.883601904 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.883620977 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.883817911 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.883827925 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.896765947 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.896780968 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.897001028 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.897026062 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.901710033 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.901774883 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.901809931 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.901861906 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.902194023 CEST	49740	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.902213097 CEST	443	49740	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.951416016 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.951510906 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.951651096 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.951945066 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.951984882 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.979867935 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.979931116 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:53.980037928 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.980418921 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:53.980433941 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.008274078 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 11, 2024 15:16:54.030966997 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.030992985 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.031083107 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.031378031 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.031388998 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.125401974 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.125776052 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.125798941 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.126279116 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.126732111 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.126821995 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.126897097 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.151617050 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.151925087 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.151964903 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.152276993 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.152657986 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.152724028 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.152834892 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.168253899 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.200233936 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.211968899 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.213258028 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.213265896 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.214183092 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.214267969 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.216265917 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.216325045 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.216895103 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.216901064 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.267191887 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.339379072 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.339409113 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.339420080 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.339557886 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.339586973 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.339735985 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.341865063 CEST	49742	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.341897011 CEST	443	49742	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.411390066 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.411576986 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.411648989 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.413050890 CEST	49743	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.413064957 CEST	443	49743	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.460419893 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.460450888 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.460546017 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.460980892 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.460995913 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.492590904 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.492878914 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.492960930 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.496201992 CEST	49741	443	192.168.2.4	18.238.49.45
Apr 11, 2024 15:16:54.496228933 CEST	443	49741	18.238.49.45	192.168.2.4
Apr 11, 2024 15:16:54.506251097 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.506298065 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.506483078 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.506916046 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.506947994 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.512192965 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.512279034 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.512376070 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.522034883 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.522072077 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.590521097 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.590591908 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.590694904 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.591202021 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.591213942 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.640439034 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.641244888 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.641267061 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.642334938 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.642415047 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.643627882 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.643692017 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.644037008 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.644047022 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.682226896 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.682909012 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.682945013 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.686525106 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.686630011 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.688007116 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.688178062 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.688179016 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.691137075 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.692883968 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.702526093 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.702583075 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.703689098 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.703779936 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.723169088 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.723278999 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.732244015 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.738111973 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.738145113 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.769279003 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.769305944 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.776748896 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.784943104 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.804613113 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:54.804653883 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:54.804738045 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:54.804982901 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.805022001 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.805147886 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.805449963 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:54.805488110 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:54.809248924 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.809360981 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.811069012 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.811249971 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.811485052 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.811502934 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:54.817282915 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817363024 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817383051 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817421913 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817454100 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.817465067 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817495108 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817516088 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.817545891 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.817615032 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.817667961 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.819075108 CEST	49744	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.819087029 CEST	443	49744	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.848258972 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.863123894 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:54.881247997 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.881405115 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.881567001 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.884891033 CEST	49745	443	192.168.2.4	35.186.247.156
Apr 11, 2024 15:16:54.884907961 CEST	443	49745	35.186.247.156	192.168.2.4
Apr 11, 2024 15:16:54.973496914 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.973706007 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.973788023 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.981085062 CEST	49746	443	192.168.2.4	18.238.49.8
Apr 11, 2024 15:16:54.981122017 CEST	443	49746	18.238.49.8	192.168.2.4
Apr 11, 2024 15:16:54.998085976 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:54.998889923 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:54.998927116 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:55.000515938 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:55.000586033 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:55.003747940 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:55.003842115 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:55.016571045 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.016593933 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.016659975 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.016685009 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.016746998 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.050509930 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:55.050570011 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:16:55.097378969 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:16:55.098750114 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098782063 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098798990 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098828077 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.098850965 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098870993 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098881960 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.098906040 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.098907948 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.098944902 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.098970890 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.113096952 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.113151073 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.113184929 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.113194942 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.113229036 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.113265038 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.113290071 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.203286886 CEST	49747	443	192.168.2.4	108.138.106.124
Apr 11, 2024 15:16:55.203305006 CEST	443	49747	108.138.106.124	192.168.2.4
Apr 11, 2024 15:16:55.326117039 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.326199055 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.326272964 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.327043056 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.327080965 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.508635998 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.560929060 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.583827972 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.583858013 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.585433960 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.585453987 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.585529089 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.590145111 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.590318918 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.590984106 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.591000080 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.639033079 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.685327053 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685354948 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685370922 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685380936 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685400963 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685411930 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685425043 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.685493946 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.685534954 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.685534954 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.685568094 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.699322939 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.699378014 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.699434042 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.699457884 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.699496984 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.699568033 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.766489983 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.766518116 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.766568899 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.766602993 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.766613960 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.766679049 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.782793999 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.782813072 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.782872915 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.782886028 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.783060074 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.783379078 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.798059940 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.798105001 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.798155069 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.798178911 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.798203945 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.798333883 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.812038898 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.812081099 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.812114954 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.812125921 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.812153101 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.812172890 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.832068920 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:55.832104921 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:55.832185030 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:55.834290981 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:55.834306002 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:55.850817919 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.850882053 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.850919008 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.850984097 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.851023912 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.851079941 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.861737967 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.861761093 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.861812115 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.861824989 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.861854076 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.861963987 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.873724937 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.873748064 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.873795986 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.873806953 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.873833895 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.873852968 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.886884928 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.886912107 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.886955023 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.886966944 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.887001991 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.887023926 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.897975922 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.898008108 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.898049116 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.898065090 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.898099899 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.898121119 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.907354116 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.907377005 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.907459974 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.907473087 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.907500982 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.907521963 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.917341948 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.917363882 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.917414904 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.917427063 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.917455912 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.917695045 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.925055981 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.925129890 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.925129890 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.925177097 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:55.925210953 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.925235987 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.925532103 CEST	49751	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:55.925561905 CEST	443	49751	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.024734020 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.024812937 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.028711081 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.028734922 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.029138088 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.074942112 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.120234966 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.183834076 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.183984995 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.184061050 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.255867958 CEST	49752	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.255892038 CEST	443	49752	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.257155895 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.257255077 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.257342100 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.257602930 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.257656097 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.357553005 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.357594013 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.357665062 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.358298063 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.358314037 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.430826902 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.431425095 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.431490898 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.431993961 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.432538986 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.432638884 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.433018923 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.480236053 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.540668011 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.540755987 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.542188883 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.542201996 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.542730093 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.545510054 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.588243008 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.597527027 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.609250069 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.609275103 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.609338045 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.609405041 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.609437943 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.609460115 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.623239040 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.623265028 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.623337984 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.623361111 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.623389959 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.675723076 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.689099073 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.689165115 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.689193010 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.689223051 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.689244032 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.689301014 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.705281973 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.705327034 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.705374956 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.705403090 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.705431938 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.705446005 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.707962036 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.708112955 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.708183050 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.710114956 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.710156918 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.710192919 CEST	49754	443	192.168.2.4	23.51.58.94
Apr 11, 2024 15:16:56.710210085 CEST	443	49754	23.51.58.94	192.168.2.4
Apr 11, 2024 15:16:56.720523119 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.720546007 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.720597982 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.720611095 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.720628977 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.720654011 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.766896963 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.766931057 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.766977072 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.767016888 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.767030001 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.767065048 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.778939009 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.778990984 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.779048920 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.779061079 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.779094934 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.779161930 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.788214922 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.788300037 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.788314104 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.788326025 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.788341045 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.788367033 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.789967060 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.790030956 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.798245907 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.798307896 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.798325062 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.798352003 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.798382044 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.798401117 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.803751945 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.803823948 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.812202930 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.812283993 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.812305927 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.812346935 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.812378883 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.814934969 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.814990997 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.815004110 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.815078974 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.822756052 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.822789907 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.822822094 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.822833061 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.822854042 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.822870970 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.826944113 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.827025890 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.829834938 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.829910994 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.834000111 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.834090948 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.849008083 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.849077940 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.855526924 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.855592966 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.855616093 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.855632067 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.855676889 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.855676889 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.861874104 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.861932039 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.861955881 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.861970901 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.861995935 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.862016916 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.864979982 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.865071058 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.867404938 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.867499113 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.873425007 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.873476028 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.873496056 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.873506069 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.873536110 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.873553991 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.876945972 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.877026081 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.879796028 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.879867077 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.885520935 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.885586023 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.885605097 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.885621071 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.885652065 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.885684967 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.887687922 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.887780905 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.888859987 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.888920069 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.888927937 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.888967991 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:56.889012098 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.889235020 CEST	49753	443	192.168.2.4	18.164.96.90
Apr 11, 2024 15:16:56.889251947 CEST	443	49753	18.164.96.90	192.168.2.4
Apr 11, 2024 15:16:57.036420107 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.036463976 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.036593914 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.037097931 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.037117958 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.066622019 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.066704035 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.066780090 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.066874027 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.066904068 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.067095995 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.067408085 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.067426920 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.067666054 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.067679882 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.224040985 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.224420071 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.224450111 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.225699902 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.225785971 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.233676910 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.233747005 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.233963966 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.278665066 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.279032946 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.279093027 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.279102087 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.279268980 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.279280901 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.280144930 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.280214071 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.280230999 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.280242920 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.280735970 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.280791044 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.331581116 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.409692049 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.409868956 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.409936905 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.410609007 CEST	49755	443	192.168.2.4	13.226.34.111
Apr 11, 2024 15:16:57.410631895 CEST	443	49755	13.226.34.111	192.168.2.4
Apr 11, 2024 15:16:57.777764082 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.777925014 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.777977943 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.778290987 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.778326035 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.778415918 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.778498888 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.818969965 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.818983078 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:57.847352982 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:57.862854958 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.162688971 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.162719965 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.162934065 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.163352013 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.163368940 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.188652039 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.188715935 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.188776016 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.188791037 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.188853979 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.190391064 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.190525055 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.190597057 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.197407007 CEST	49757	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.197422028 CEST	443	49757	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273391962 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273407936 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273469925 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273503065 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.273571014 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273605108 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.273699999 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.273756027 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.274528980 CEST	49756	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:16:58.274558067 CEST	443	49756	18.164.116.101	192.168.2.4
Apr 11, 2024 15:16:58.327300072 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.327353954 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.327441931 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.328092098 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.328118086 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.339508057 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.339530945 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.339922905 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.340343952 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.340359926 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.340460062 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.340816021 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.340874910 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.342344046 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.342541933 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.343019009 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.343094110 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.343149900 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.384244919 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.409559011 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.409573078 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.456429005 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.500020981 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.500298977 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.500323057 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.501188993 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.501257896 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.502361059 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.502425909 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.502819061 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.502830982 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.507420063 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.507611036 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.507678986 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.508230925 CEST	49759	443	192.168.2.4	13.226.34.40
Apr 11, 2024 15:16:58.508241892 CEST	443	49759	13.226.34.40	192.168.2.4
Apr 11, 2024 15:16:58.513490915 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.513684988 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.513703108 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.515153885 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.515218019 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.515588045 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.515666962 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.516073942 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.516081095 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.550198078 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.565900087 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.676305056 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.676336050 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.676409960 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.676439047 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.676533937 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.677578926 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.677628040 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.677712917 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.677943945 CEST	49760	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.677963018 CEST	443	49760	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.690905094 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.690932035 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.690943003 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.691010952 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:16:58.691014051 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.691052914 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.692866087 CEST	49761	443	192.168.2.4	18.164.116.92
Apr 11, 2024 15:16:58.692878962 CEST	443	49761	18.164.116.92	192.168.2.4
Apr 11, 2024 15:17:04.980885983 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:04.980961084 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:04.981018066 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:05.283853054 CEST	49748	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:05.283922911 CEST	443	49748	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:06.110610008 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 11, 2024 15:17:06.110651016 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 11, 2024 15:17:13.177316904 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.177406073 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.177469015 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.177506924 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.177567005 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.177637100 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.179183006 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.179228067 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.179513931 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.179553986 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.372057915 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.372328997 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.372354984 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.372657061 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.373040915 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.373100042 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.373188019 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.416282892 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.427656889 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.879101038 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.879118919 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.879199028 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.879237890 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.879302025 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.880371094 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:13.880417109 CEST	443	49767	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:13.880494118 CEST	49767	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.077984095 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.078351974 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.078422070 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.079173088 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.079545021 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.079647064 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.079747915 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.120239019 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.549868107 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.591661930 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:14.591747046 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.592072010 CEST	49768	443	192.168.2.4	18.164.116.101
Apr 11, 2024 15:17:14.592119932 CEST	443	49768	18.164.116.101	192.168.2.4
Apr 11, 2024 15:17:54.702294111 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:54.702328920 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.702637911 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:54.705153942 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:54.705168009 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.882102013 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.882380009 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:54.882401943 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.882760048 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.883079052 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:17:54.883152008 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:17:54.925889015 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:18:04.896274090 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:18:04.896332026 CEST	443	49771	142.250.65.164	192.168.2.4
Apr 11, 2024 15:18:04.896385908 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:18:05.155390978 CEST	49771	443	192.168.2.4	142.250.65.164
Apr 11, 2024 15:18:05.155421972 CEST	443	49771	142.250.65.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 11, 2024 15:16:50.745286942 CEST	53	50229	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:50.752307892 CEST	53	53304	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:51.428836107 CEST	53	56937	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:52.589066029 CEST	50430	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:52.589190006 CEST	52842	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:52.692280054 CEST	53	52842	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:52.702629089 CEST	53	50430	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:53.946646929 CEST	57988	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:53.946932077 CEST	61211	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.030112982 CEST	53	57988	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.030164957 CEST	53	61211	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.349282980 CEST	50011	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.349528074 CEST	51978	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.421536922 CEST	50056	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.421761036 CEST	65431	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.433368921 CEST	53	51978	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.459769011 CEST	53	50011	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.505167961 CEST	53	65431	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.505187035 CEST	53	50056	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.505259991 CEST	63619	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.505548000 CEST	50217	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.589209080 CEST	53	63619	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.589262009 CEST	53	50217	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.635376930 CEST	58140	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.635961056 CEST	59608	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:54.719202995 CEST	53	58140	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:54.720000029 CEST	53	59608	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:55.229228020 CEST	60840	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:55.229932070 CEST	64097	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:55.313570976 CEST	53	60840	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:55.314218044 CEST	53	64097	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:56.950798035 CEST	55075	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:56.950839996 CEST	54530	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:56.952270031 CEST	56273	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:56.952723026 CEST	60051	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:57.034925938 CEST	53	55075	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:57.035032034 CEST	53	54530	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:57.045985937 CEST	53	60051	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:57.065802097 CEST	53	56273	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:57.911058903 CEST	53	52676	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:58.076646090 CEST	61958	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:58.077279091 CEST	60925	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:58.160504103 CEST	53	61958	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:58.161410093 CEST	53	60925	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:58.207101107 CEST	49252	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:58.208728075 CEST	53534	53	192.168.2.4	1.1.1.1
Apr 11, 2024 15:16:58.312470913 CEST	53	53534	1.1.1.1	192.168.2.4
Apr 11, 2024 15:16:58.321482897 CEST	53	49252	1.1.1.1	192.168.2.4
Apr 11, 2024 15:17:02.038371086 CEST	138	138	192.168.2.4	192.168.2.255
Apr 11, 2024 15:17:08.768910885 CEST	53	60390	1.1.1.1	192.168.2.4
Apr 11, 2024 15:17:27.772411108 CEST	53	49755	1.1.1.1	192.168.2.4
Apr 11, 2024 15:17:50.263221025 CEST	53	63074	1.1.1.1	192.168.2.4
Apr 11, 2024 15:17:51.141845942 CEST	53	62157	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 11, 2024 15:16:52.589066029 CEST	192.168.2.4	1.1.1.1	0x8186	Standard query (0)	surveys.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:52.589190006 CEST	192.168.2.4	1.1.1.1	0xf4c9	Standard query (0)	surveys.hotjar.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:53.946646929 CEST	192.168.2.4	1.1.1.1	0xc3af	Standard query (0)	sentry.io	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:53.946932077 CEST	192.168.2.4	1.1.1.1	0x84f5	Standard query (0)	sentry.io	65	IN (0x0001)	false
Apr 11, 2024 15:16:54.349282980 CEST	192.168.2.4	1.1.1.1	0xf9a4	Standard query (0)	surveys.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.349528074 CEST	192.168.2.4	1.1.1.1	0x99a5	Standard query (0)	surveys.hotjar.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:54.421536922 CEST	192.168.2.4	1.1.1.1	0x42c6	Standard query (0)	sentry.io	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.421761036 CEST	192.168.2.4	1.1.1.1	0xc0b5	Standard query (0)	sentry.io	65	IN (0x0001)	false
Apr 11, 2024 15:16:54.505259991 CEST	192.168.2.4	1.1.1.1	0xd342	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.505548000 CEST	192.168.2.4	1.1.1.1	0x4af8	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:54.635376930 CEST	192.168.2.4	1.1.1.1	0x4b4c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.635961056 CEST	192.168.2.4	1.1.1.1	0x48c0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:55.229228020 CEST	192.168.2.4	1.1.1.1	0x63aa	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:55.229932070 CEST	192.168.2.4	1.1.1.1	0x1229	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:56.950798035 CEST	192.168.2.4	1.1.1.1	0x85a	Standard query (0)	surveystats.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:56.950839996 CEST	192.168.2.4	1.1.1.1	0xc4a2	Standard query (0)	surveystats.hotjar.io	65	IN (0x0001)	false
Apr 11, 2024 15:16:56.952270031 CEST	192.168.2.4	1.1.1.1	0xe567	Standard query (0)	survey-images.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:56.952723026 CEST	192.168.2.4	1.1.1.1	0x4dba	Standard query (0)	survey-images.hotjar.com	65	IN (0x0001)	false
Apr 11, 2024 15:16:58.076646090 CEST	192.168.2.4	1.1.1.1	0xd0a5	Standard query (0)	surveystats.hotjar.io	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.077279091 CEST	192.168.2.4	1.1.1.1	0xabb3	Standard query (0)	surveystats.hotjar.io	65	IN (0x0001)	false
Apr 11, 2024 15:16:58.207101107 CEST	192.168.2.4	1.1.1.1	0x1831	Standard query (0)	survey-images.hotjar.com	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.208728075 CEST	192.168.2.4	1.1.1.1	0x5dbb	Standard query (0)	survey-images.hotjar.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 11, 2024 15:16:52.702629089 CEST	1.1.1.1	192.168.2.4	0x8186	No error (0)	surveys.hotjar.com		18.238.49.45	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:52.702629089 CEST	1.1.1.1	192.168.2.4	0x8186	No error (0)	surveys.hotjar.com		18.238.49.8	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:52.702629089 CEST	1.1.1.1	192.168.2.4	0x8186	No error (0)	surveys.hotjar.com		18.238.49.7	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:52.702629089 CEST	1.1.1.1	192.168.2.4	0x8186	No error (0)	surveys.hotjar.com		18.238.49.118	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.030112982 CEST	1.1.1.1	192.168.2.4	0xc3af	No error (0)	sentry.io		35.186.247.156	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.459769011 CEST	1.1.1.1	192.168.2.4	0xf9a4	No error (0)	surveys.hotjar.com		18.238.49.8	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.459769011 CEST	1.1.1.1	192.168.2.4	0xf9a4	No error (0)	surveys.hotjar.com		18.238.49.45	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.459769011 CEST	1.1.1.1	192.168.2.4	0xf9a4	No error (0)	surveys.hotjar.com		18.238.49.7	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.459769011 CEST	1.1.1.1	192.168.2.4	0xf9a4	No error (0)	surveys.hotjar.com		18.238.49.118	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.505187035 CEST	1.1.1.1	192.168.2.4	0x42c6	No error (0)	sentry.io		35.186.247.156	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589209080 CEST	1.1.1.1	192.168.2.4	0xd342	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589209080 CEST	1.1.1.1	192.168.2.4	0xd342	No error (0)	static-cdn.hotjar.com		108.138.106.124	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589209080 CEST	1.1.1.1	192.168.2.4	0xd342	No error (0)	static-cdn.hotjar.com		108.138.106.126	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589209080 CEST	1.1.1.1	192.168.2.4	0xd342	No error (0)	static-cdn.hotjar.com		108.138.106.101	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589209080 CEST	1.1.1.1	192.168.2.4	0xd342	No error (0)	static-cdn.hotjar.com		108.138.106.49	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.589262009 CEST	1.1.1.1	192.168.2.4	0x4af8	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:54.719202995 CEST	1.1.1.1	192.168.2.4	0x4b4c	No error (0)	www.google.com		142.250.65.164	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:54.720000029 CEST	1.1.1.1	192.168.2.4	0x48c0	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 11, 2024 15:16:55.313570976 CEST	1.1.1.1	192.168.2.4	0x63aa	No error (0)	script.hotjar.com		18.164.96.90	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:55.313570976 CEST	1.1.1.1	192.168.2.4	0x63aa	No error (0)	script.hotjar.com		18.164.96.77	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:55.313570976 CEST	1.1.1.1	192.168.2.4	0x63aa	No error (0)	script.hotjar.com		18.164.96.46	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:55.313570976 CEST	1.1.1.1	192.168.2.4	0x63aa	No error (0)	script.hotjar.com		18.164.96.87	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.034925938 CEST	1.1.1.1	192.168.2.4	0x85a	No error (0)	surveystats.hotjar.io		13.226.34.111	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.034925938 CEST	1.1.1.1	192.168.2.4	0x85a	No error (0)	surveystats.hotjar.io		13.226.34.108	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.034925938 CEST	1.1.1.1	192.168.2.4	0x85a	No error (0)	surveystats.hotjar.io		13.226.34.7	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.034925938 CEST	1.1.1.1	192.168.2.4	0x85a	No error (0)	surveystats.hotjar.io		13.226.34.40	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.045985937 CEST	1.1.1.1	192.168.2.4	0x4dba	No error (0)	survey-images.hotjar.com	d3q2a7r13qyoht.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:57.065802097 CEST	1.1.1.1	192.168.2.4	0xe567	No error (0)	survey-images.hotjar.com	d3q2a7r13qyoht.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:57.065802097 CEST	1.1.1.1	192.168.2.4	0xe567	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.101	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.065802097 CEST	1.1.1.1	192.168.2.4	0xe567	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.89	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.065802097 CEST	1.1.1.1	192.168.2.4	0xe567	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.119	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:57.065802097 CEST	1.1.1.1	192.168.2.4	0xe567	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.92	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.160504103 CEST	1.1.1.1	192.168.2.4	0xd0a5	No error (0)	surveystats.hotjar.io		13.226.34.40	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.160504103 CEST	1.1.1.1	192.168.2.4	0xd0a5	No error (0)	surveystats.hotjar.io		13.226.34.108	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.160504103 CEST	1.1.1.1	192.168.2.4	0xd0a5	No error (0)	surveystats.hotjar.io		13.226.34.111	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.160504103 CEST	1.1.1.1	192.168.2.4	0xd0a5	No error (0)	surveystats.hotjar.io		13.226.34.7	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.312470913 CEST	1.1.1.1	192.168.2.4	0x5dbb	No error (0)	survey-images.hotjar.com	d3q2a7r13qyoht.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:58.321482897 CEST	1.1.1.1	192.168.2.4	0x1831	No error (0)	survey-images.hotjar.com	d3q2a7r13qyoht.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:16:58.321482897 CEST	1.1.1.1	192.168.2.4	0x1831	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.92	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.321482897 CEST	1.1.1.1	192.168.2.4	0x1831	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.101	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.321482897 CEST	1.1.1.1	192.168.2.4	0x1831	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.119	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:16:58.321482897 CEST	1.1.1.1	192.168.2.4	0x1831	No error (0)	d3q2a7r13qyoht.cloudfront.net		18.164.116.89	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:17:08.286119938 CEST	1.1.1.1	192.168.2.4	0xec96	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:17:08.286119938 CEST	1.1.1.1	192.168.2.4	0xec96	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:17:09.206170082 CEST	1.1.1.1	192.168.2.4	0x482b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:17:09.206170082 CEST	1.1.1.1	192.168.2.4	0x482b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:17:23.870018959 CEST	1.1.1.1	192.168.2.4	0x7326	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:17:23.870018959 CEST	1.1.1.1	192.168.2.4	0x7326	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:17:43.197735071 CEST	1.1.1.1	192.168.2.4	0x1178	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:17:43.197735071 CEST	1.1.1.1	192.168.2.4	0x1178	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 11, 2024 15:18:02.870821953 CEST	1.1.1.1	192.168.2.4	0x7617	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 15:18:02.870821953 CEST	1.1.1.1	192.168.2.4	0x7617	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

surveys.hotjar.com

https:

sentry.io

static.hotjar.com

script.hotjar.com

surveystats.hotjar.io

survey-images.hotjar.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:52 UTC	697	OUT	GET /acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:53 UTC	730	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 1399 Connection: close Date: Thu, 11 Apr 2024 13:16:53 GMT Accept-Ranges: bytes Cache-Control: max-age=60 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "e3ff40d3d999f500c0df8e5da02cb9df" Last-Modified: Thu, 11 Apr 2024 13:16:28 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 932eefec422d884c28f3c110319f29fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: wrNPMncOwBOxIB1-KIIHQVgqxGQaqv6OLkqDv_v8qYM-lOPAjTvfTA==
2024-04-11 13:16:53 UTC	1399	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 20 3c 68 65 61 64 3e 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 2f 73 74 61 74 69 63 2f 66 61 76 69 63 6f 6e 2e 68 61 73 68 2d 34 64 61 35 63 33 2e 69 63 6f 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 2f 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 20 2f 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 2f 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 48 Data Ascii: <!doctype html> <html lang=en> <head> <link href=/static/favicon.hash-4da5c3.ico rel="shortcut icon"/> <meta content="text/html; charset=utf-8" http-equiv=content-type /> <meta content="width=device-width,initial-scale=1" name=viewport /> <meta content="H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:53 UTC	613	OUT	GET /static/app-external-survey.hash-c52502.css HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:53 UTC	768	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Content-Length: 4502 Connection: close Date: Thu, 11 Apr 2024 13:16:53 GMT Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "8f2b2e283282ccbb0f004c077ccebe0a" Last-Modified: Thu, 11 Apr 2024 13:16:19 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 38d213e81ab517fd857234c4eccd4632.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: Mth46sRLumoESx9U-WW9XjVynXvYFrNUw2bg4f3kuW-Nk35ZK01fYA==
2024-04-11 13:16:53 UTC	4502	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 41 6d 62 69 74 22 3b 73 72 63 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 64 66 30 63 31 37 65 39 61 66 64 33 35 31 65 61 38 33 64 38 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 2c 20 75 72 6c 28 2f 73 74 61 74 69 63 2f 32 33 30 62 38 39 63 61 39 63 63 64 31 31 30 37 35 32 33 31 2e 77 6f 66 66 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 3b 73 72 63 3a 75 72 6c 28 2f 73 74 61 74 69 63 2f 34 39 30 30 33 38 39 62 36 31 64 32 61 36 62 62 61 35 36 62 2e 65 6f 74 Data Ascii: @font-face{font-family:"Ambit";src:url(/static/df0c17e9afd351ea83d8.woff2) format("woff2"), url(/static/230b89ca9ccd11075231.woff) format("woff");font-weight:600;font-style:normal}@font-face{font-family:"Open Sans";src:url(/static/4900389b61d2a6bba56b.eot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:53 UTC	582	OUT	GET /static/548.hash-c142c0.js HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:53 UTC	796	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 137552 Connection: close Date: Tue, 09 Apr 2024 21:09:27 GMT Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "2774a306e5ffc03f75bab753ecddfad7" Last-Modified: Tue, 09 Apr 2024 15:28:21 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 79edbcc14c21322a469003752cc30af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: Af51RmgYLaQtVDx1Mt_B1gWSxH2QNXUkz_8xy7jRx5mTKsxy3R2jdg== Age: 144446
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 35 34 38 2e 68 61 73 68 2d 63 31 34 32 63 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 68 6f 74 6a 61 72 5f 61 70 70 5f 65 78 74 65 72 6e 61 6c 5f 73 75 72 76 65 79 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 68 6f 74 6a 61 72 5f 61 70 70 5f 65 78 74 65 72 6e 61 6c 5f 73 75 72 76 65 79 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 34 38 5d 2c 7b 37 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 6f 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 72 65 74 75 72 6e 20 69 3d 22 66 75 6e 63 74 69 6f 6e Data Ascii: /! For license information please see 548.hash-c142c0.js.LICENSE.txt /(self.webpackChunk_hotjar_app_external_survey=self.webpackChunk_hotjar_app_external_survey\|\|[]).push([[548],{748:function(t,e,n){"use strict";var r,o;function i(t){return i="function
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 61 73 28 74 29 7c 7c 28 74 68 69 73 2e 5f 69 6e 6e 65 72 2e 61 64 64 28 74 29 2c 21 31 29 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 74 68 69 73 2e 5f 69 6e 6e 65 72 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 69 66 28 74 68 69 73 2e 5f 69 6e 6e 65 72 5b 65 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 6e 6e 65 72 2e 70 75 73 68 28 74 29 2c 21 31 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 6d 65 6d 6f 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 5f 68 61 73 57 65 61 6b 53 65 74 29 74 68 69 73 2e 5f 69 6e 6e 65 72 2e 64 65 6c 65 74 65 28 74 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 74 68 69 73 2e 5f 69 6e 6e 65 72 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 69 66 28 74 68 69 73 Data Ascii: as(t)\|\|(this._inner.add(t),!1);for(var e=0;e<this._inner.length;e++)if(this._inner[e]===t)return!0;return this._inner.push(t),!1},t.prototype.unmemoize=function(t){if(this._hasWeakSet)this._inner.delete(t);else for(var e=0;e<this._inner.length;e++)if(this
2024-04-11 13:16:53 UTC	15990	IN	Data Raw: 26 28 69 2e 5f 5f 73 65 6e 74 72 79 5f 78 68 72 5f 5f 2e 73 74 61 74 75 73 5f 63 6f 64 65 3d 69 2e 73 74 61 74 75 73 29 7d 63 61 74 63 68 28 74 29 7b 7d 74 72 79 7b 76 61 72 20 6e 3d 74 2e 69 6e 64 65 78 4f 66 28 69 29 3b 69 66 28 2d 31 21 3d 3d 6e 29 7b 74 2e 73 70 6c 69 63 65 28 6e 29 3b 76 61 72 20 6f 3d 65 2e 73 70 6c 69 63 65 28 6e 29 5b 30 5d 3b 69 2e 5f 5f 73 65 6e 74 72 79 5f 78 68 72 5f 5f 26 26 76 6f 69 64 20 30 21 3d 3d 6f 5b 30 5d 26 26 28 69 2e 5f 5f 73 65 6e 74 72 79 5f 78 68 72 5f 5f 2e 62 6f 64 79 3d 6f 5b 30 5d 29 7d 7d 63 61 74 63 68 28 74 29 7b 7d 78 74 28 22 78 68 72 22 2c 7b 61 72 67 73 3a 72 2c 65 6e 64 54 69 6d 65 73 74 61 6d 70 3a 44 61 74 65 2e 6e 6f 77 28 29 2c 73 74 61 72 74 54 69 6d 65 73 74 61 6d 70 3a 44 61 74 65 2e 6e 6f 77 Data Ascii: &(i.__sentry_xhr__.status_code=i.status)}catch(t){}try{var n=t.indexOf(i);if(-1!==n){t.splice(n);var o=e.splice(n)[0];i.__sentry_xhr__&&void 0!==o[0]&&(i.__sentry_xhr__.body=o[0])}}catch(t){}xt("xhr",{args:r,endTimestamp:Date.now(),startTimestamp:Date.now
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 3d 6e 2e 65 78 65 63 28 6f 5b 73 5d 29 29 3f 61 3d 7b 75 72 6c 3a 65 5b 32 5d 2c 66 75 6e 63 3a 65 5b 33 5d 2c 61 72 67 73 3a 5b 5d 2c 6c 69 6e 65 3a 2b 65 5b 31 5d 2c 63 6f 6c 75 6d 6e 3a 6e 75 6c 6c 7d 3a 28 65 3d 72 2e 65 78 65 63 28 6f 5b 73 5d 29 29 26 26 28 61 3d 7b 75 72 6c 3a 65 5b 36 5d 2c 66 75 6e 63 3a 65 5b 33 5d 7c 7c 65 5b 34 5d 2c 61 72 67 73 3a 65 5b 35 5d 3f 65 5b 35 5d 2e 73 70 6c 69 74 28 22 2c 22 29 3a 5b 5d 2c 6c 69 6e 65 3a 2b 65 5b 31 5d 2c 63 6f 6c 75 6d 6e 3a 2b 65 5b 32 5d 7d 29 2c 61 26 26 28 21 61 2e 66 75 6e 63 26 26 61 2e 6c 69 6e 65 26 26 28 61 2e 66 75 6e 63 3d 47 74 29 2c 69 2e 70 75 73 68 28 61 29 29 7d 72 65 74 75 72 6e 20 69 2e 6c 65 6e 67 74 68 3f 7b 6d 65 73 73 61 67 65 3a 65 65 28 74 29 2c 6e 61 6d 65 3a 74 2e 6e 61 Data Ascii: =n.exec(o[s]))?a={url:e[2],func:e[3],args:[],line:+e[1],column:null}:(e=r.exec(o[s]))&&(a={url:e[6],func:e[3]\|\|e[4],args:e[5]?e[5].split(","):[],line:+e[1],column:+e[2]}),a&&(!a.func&&a.line&&(a.func=Gt),i.push(a))}return i.length?{message:ee(t),name:t.na
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 65 29 7b 74 68 69 73 2e 6e 61 6d 65 3d 74 2e 69 64 2c 74 68 69 73 2e 5f 6f 70 74 69 6f 6e 73 3d 69 28 7b 63 6f 6e 73 6f 6c 65 3a 21 30 2c 64 6f 6d 3a 21 30 2c 66 65 74 63 68 3a 21 30 2c 68 69 73 74 6f 72 79 3a 21 30 2c 73 65 6e 74 72 79 3a 21 30 2c 78 68 72 3a 21 30 7d 2c 65 29 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 53 65 6e 74 72 79 42 72 65 61 64 63 72 75 6d 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 5f 6f 70 74 69 6f 6e 73 2e 73 65 6e 74 72 79 26 26 73 74 28 29 2e 61 64 64 42 72 65 61 64 63 72 75 6d 62 28 7b 63 61 74 65 67 6f 72 79 3a 22 73 65 6e 74 72 79 2e 22 2b 28 22 74 72 61 6e 73 61 63 74 69 6f 6e 22 3d 3d 3d 74 2e 74 79 70 65 3f 22 74 72 61 6e 73 61 63 74 69 6f 6e 22 3a 22 65 76 65 6e 74 22 29 2c 65 76 Data Ascii: e){this.name=t.id,this._options=i({console:!0,dom:!0,fetch:!0,history:!0,sentry:!0,xhr:!0},e)}return t.prototype.addSentryBreadcrumb=function(t){this._options.sentry&&st().addBreadcrumb({category:"sentry."+("transaction"===t.type?"transaction":"event"),ev
2024-04-11 13:16:53 UTC	776	IN	Data Raw: 65 6f 66 20 74 2e 6f 6e 55 70 6c 6f 61 64 50 72 6f 67 72 65 73 73 26 26 6c 2e 75 70 6c 6f 61 64 26 26 6c 2e 75 70 6c 6f 61 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 72 6f 67 72 65 73 73 22 2c 74 2e 6f 6e 55 70 6c 6f 61 64 50 72 6f 67 72 65 73 73 29 2c 74 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 26 26 74 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 2e 70 72 6f 6d 69 73 65 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6c 26 26 28 6c 2e 61 62 6f 72 74 28 29 2c 63 28 74 29 2c 6c 3d 6e 75 6c 6c 29 7d 29 29 2c 76 6f 69 64 20 30 3d 3d 3d 66 26 26 28 66 3d 6e 75 6c 6c 29 2c 6c 2e 73 65 6e 64 28 66 29 7d 29 29 7d 7d 2c 36 32 35 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 37 Data Ascii: eof t.onUploadProgress&&l.upload&&l.upload.addEventListener("progress",t.onUploadProgress),t.cancelToken&&t.cancelToken.promise.then((function(t){l&&(l.abort(),c(t),l=null)})),void 0===f&&(f=null),l.send(f)}))}},6259:function(t,e,n){"use strict";var r=n(7
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 41 4e 43 45 4c 5f 5f 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 3d 65 7d 2c 38 38 35 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 37 34 38 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 65 78 65 63 75 74 6f 72 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 2e 22 29 3b 76 61 72 20 65 3b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 3d 74 7d 29 29 3b 76 61 72 20 6e 3d 74 68 69 73 3b 74 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 2e 72 65 61 73 6f 6e 7c 7c 28 6e 2e 72 65 61 Data Ascii: ANCEL__=!0,t.exports=e},8851:function(t,e,n){"use strict";var r=n(8748);function o(t){if("function"!=typeof t)throw new TypeError("executor must be a function.");var e;this.promise=new Promise((function(t){e=t}));var n=this;t((function(t){n.reason\|\|(n.rea
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 2e 49 74 65 72 61 74 6f 72 50 72 6f 74 6f 74 79 70 65 2c 76 3d 68 2e 42 55 47 47 59 5f 53 41 46 41 52 49 5f 49 54 45 52 41 54 4f 52 53 2c 79 3d 66 28 22 69 74 65 72 61 74 6f 72 22 29 2c 67 3d 22 6b 65 79 73 22 2c 6d 3d 22 76 61 6c 75 65 73 22 2c 5f 3d 22 65 6e 74 72 69 65 73 22 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 66 2c 68 2c 45 2c 78 29 7b 6f 28 6e 2c 65 2c 66 29 3b 76 61 72 20 53 2c 77 2c 4f 2c 6a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 3d 3d 3d 68 26 26 41 29 72 65 74 75 72 6e 20 41 3b 69 66 28 21 76 26 26 74 20 69 6e 20 52 29 72 65 74 75 72 6e 20 52 5b 74 5d 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 67 3a 63 61 73 65 Data Ascii: .IteratorPrototype,v=h.BUGGY_SAFARI_ITERATORS,y=f("iterator"),g="keys",m="values",_="entries",b=function(){return this};t.exports=function(t,e,n,f,h,E,x){o(n,e,f);var S,w,O,j=function(t){if(t===h&&A)return A;if(!v&&t in R)return R[t];switch(t){case g:case
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 72 28 22 43 61 6e 27 74 20 63 61 6c 6c 20 6d 65 74 68 6f 64 20 6f 6e 20 22 2b 74 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 30 32 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 36 30 36 37 29 2c 6f 3d 6e 28 37 35 37 31 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 72 79 7b 6f 28 72 2c 74 2c 65 29 7d 63 61 74 63 68 28 6e 29 7b 72 5b 74 5d 3d 65 7d 72 65 74 75 72 6e 20 65 7d 7d 2c 33 34 31 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 35 37 35 29 2c 6f 3d 6e 28 39 35 36 31 29 2c 69 3d 6e 28 33 34 33 35 29 2c 73 3d 6e 28 37 37 39 36 29 2c 61 3d 69 28 22 73 70 65 63 69 65 73 22 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e Data Ascii: r("Can't call method on "+t);return t}},8028:function(t,e,n){var r=n(6067),o=n(7571);t.exports=function(t,e){try{o(r,t,e)}catch(n){r[t]=e}return e}},3417:function(t,e,n){"use strict";var r=n(8575),o=n(9561),i=n(3435),s=n(7796),a=i("species");t.exports=fun
2024-04-11 13:16:53 UTC	6098	IN	Data Raw: 75 2c 68 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 78 29 62 72 65 61 6b 3b 69 66 28 45 2e 70 75 73 68 28 78 29 2c 21 76 29 62 72 65 61 6b 3b 22 22 3d 3d 3d 53 74 72 69 6e 67 28 78 5b 30 5d 29 26 26 28 75 2e 6c 61 73 74 49 6e 64 65 78 3d 63 28 68 2c 73 28 75 2e 6c 61 73 74 49 6e 64 65 78 29 2c 62 29 29 7d 66 6f 72 28 76 61 72 20 53 2c 77 3d 22 22 2c 4f 3d 30 2c 6a 3d 30 3b 6a 3c 45 2e 6c 65 6e 67 74 68 3b 6a 2b 2b 29 7b 78 3d 45 5b 6a 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 53 74 72 69 6e 67 28 78 5b 30 5d 29 2c 54 3d 70 28 6c 28 61 28 78 2e 69 6e 64 65 78 29 2c 68 2e 6c 65 6e 67 74 68 29 2c 30 29 2c 52 3d 5b 5d 2c 49 3d 31 3b 49 3c 78 2e 6c 65 6e 67 74 68 3b 49 2b 2b 29 52 2e 70 75 73 68 28 76 6f 69 64 20 30 3d 3d 3d 28 53 3d 78 5b 49 5d 29 3f 53 3a 53 74 72 69 6e Data Ascii: u,h);if(null===x)break;if(E.push(x),!v)break;""===String(x[0])&&(u.lastIndex=c(h,s(u.lastIndex),b))}for(var S,w="",O=0,j=0;j<E.length;j++){x=E[j];for(var k=String(x[0]),T=p(l(a(x.index),h.length),0),R=[],I=1;I<x.length;I++)R.push(void 0===(S=x[I])?S:Strin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:53 UTC	598	OUT	GET /static/app-external-survey.hash-1366dc.js HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:53 UTC	794	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 17773 Connection: close Date: Wed, 10 Apr 2024 15:18:29 GMT Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "ab766b9b3972aad6f2e660225d227eca" Last-Modified: Wed, 10 Apr 2024 15:17:33 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 0b703f88574c6bad454306eb64dd50a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: OmdcBMUKnbBwOkQHTfeE3ZcNnJ0yNqgrN8AS3DYvzAftZYN7c3Baxg== Age: 79104
2024-04-11 13:16:53 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 61 70 70 2d 65 78 74 65 72 6e 61 6c 2d 73 75 72 76 65 79 2e 68 61 73 68 2d 31 33 36 36 64 63 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3d 7b 38 31 34 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 72 28 65 29 2c 72 28 33 35 29 2c 72 28 33 34 38 37 29 2c 72 28 34 32 34 29 2c 72 28 35 38 31 38 29 2c 72 28 34 34 34 29 2c 72 28 36 33 36 29 2c 72 28 31 39 33 31 29 2c 72 28 31 34 33 29 2c 72 28 39 36 32 37 29 2c 72 28 36 32 37 36 29 2c 72 28 38 34 39 36 29 2c 72 28 37 34 30 38 29 2c 72 28 31 31 35 29 2c 72 28 36 37 34 30 29 Data Ascii: /! For license information please see app-external-survey.hash-1366dc.js.LICENSE.txt /!function(){var t,e={8147:function(t,e,r){"use strict";r.r(e),r(35),r(3487),r(424),r(5818),r(444),r(636),r(1931),r(143),r(9627),r(6276),r(8496),r(7408),r(115),r(6740)
2024-04-11 13:16:53 UTC	1389	IN	Data Raw: 6f 28 74 2c 72 29 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 72 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 65 5b 72 5d 7d 29 7d 2c 6e 2e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 54 68 69 73 3b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 68 6d 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 3d 4f 62 Data Ascii: o(t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:e[r]})},n.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.hmd=function(t){return(t=Ob

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	663	OUT	GET /api/ask/v1/client/sites/offsite-survey-info/acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	498	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close Date: Thu, 11 Apr 2024 13:16:54 GMT Cache-Control: no-cache, no-store Com-Hotjar-Srvid: ask-backend Strict-Transport-Security: max-age=2592000; includeSubDomains Vary: Accept-Encoding Vary: Origin X-Cache: Miss from cloudfront Via: 1.1 e3d2c542026df7b9357e3b591c889f64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: DDsJPqZ2U6uhkhsXdvghtIUDBcjeqrw_JUcJR20wW-PUOql5LNHanw==
2024-04-11 13:16:54 UTC	72	IN	Data Raw: 34 32 0d 0a 7b 22 73 69 74 65 5f 69 64 22 3a 33 39 32 39 33 33 35 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 65 66 66 65 63 74 69 76 65 5f 73 68 6f 77 5f 62 72 61 6e 64 69 6e 67 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 42{"site_id":3929335,"enabled":true,"effective_show_branding":false}
2024-04-11 13:16:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	18.238.49.45	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	647	OUT	GET /static/favicon.hash-4da5c3.ico HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	782	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 15406 Connection: close Date: Sat, 06 Apr 2024 15:22:01 GMT Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "afe9deb25be988f82f8454ae9e46d6d2" Last-Modified: Fri, 05 Apr 2024 15:36:59 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7933995c46b01504206ecd6d3dfa5d10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: wMq_CJjgp2uUUWBxfuEmfXVkc6fb2kJrlVrwc5LUNzvzlH2ODRdpIQ== Age: 424493
2024-04-11 13:16:54 UTC	15406	IN	Data Raw: 00 00 01 00 03 00 10 10 00 00 01 00 20 00 68 04 00 00 36 00 00 00 20 20 00 00 01 00 20 00 28 11 00 00 9e 04 00 00 30 30 00 00 01 00 20 00 68 26 00 00 c6 15 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 ff 18 00 3b ff a3 00 3b ff f1 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff f3 00 3c ff 9c 00 35 ff 18 00 3c ff 9c 00 3c ff fc 00 3c ff ff 00 3c ff ff 00 3c ff ff 01 3d ff ff 06 40 ff ff 05 40 ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff fc 00 3b ff a3 00 3c ff f3 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 2a 5c ff ff a3 b8 ff ff 9c b2 ff ff 0b Data Ascii: h6 (00 h&( 5;;<<<<<<<<<<<<5<<<<<=@@<<<<<<<;<<<<<*\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	35.186.247.156	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	687	OUT	POST /api/1803156/envelope/?sentry_key=75786e51fd834ac5a70737db81a4b9d8&sentry_version=7 HTTP/1.1 Host: sentry.io Connection: keep-alive Content-Length: 477 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://surveys.hotjar.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	477	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 30 34 2d 31 31 54 31 33 3a 31 36 3a 35 32 2e 38 39 38 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 62 72 6f 77 73 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 36 2e 31 36 2e 31 22 7d 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 65 62 37 31 34 30 64 62 39 61 32 35 34 34 33 65 61 63 65 64 34 33 35 38 62 62 34 64 39 37 36 34 22 2c 22 69 6e 69 74 22 3a 74 72 75 65 2c 22 73 74 61 72 74 65 64 22 3a 22 32 30 32 34 2d 30 34 2d 31 31 54 31 33 3a 31 36 3a 35 32 2e 38 39 38 5a 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 30 34 2d 31 31 54 31 33 3a 31 36 3a 35 32 2e 38 39 38 5a 22 2c 22 73 74 61 74 Data Ascii: {"sent_at":"2024-04-11T13:16:52.898Z","sdk":{"name":"sentry.javascript.browser","version":"6.16.1"}}{"type":"session"}{"sid":"eb7140db9a25443eaced4358bb4d9764","init":true,"started":"2024-04-11T13:16:52.898Z","timestamp":"2024-04-11T13:16:52.898Z","stat
2024-04-11 13:16:54 UTC	553	IN	HTTP/1.1 200 OK server: nginx date: Thu, 11 Apr 2024 13:16:54 GMT content-type: application/json Content-Length: 2 access-control-allow-origin: * vary: origin,access-control-request-method,access-control-request-headers access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin x-envoy-upstream-service-time: 6 strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-11 13:16:54 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	18.238.49.8	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	372	OUT	GET /static/favicon.hash-4da5c3.ico HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	782	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 15406 Connection: close Date: Sat, 06 Apr 2024 15:22:01 GMT Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Security-Policy: frame-ancestors 'self' https://hotjar.com https://www-staging.hotjar.com https://*.hotjar.com ETag: "afe9deb25be988f82f8454ae9e46d6d2" Last-Modified: Fri, 05 Apr 2024 15:36:59 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none X-Xss-Protection: 1; mode=block Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a363b826ba48f4e79f7e95839a3bcf3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: LC07Fny0vPPsfYZoMYA0NnNaYONF_VWJ6FIelKACw63olD9bRnKT_A== Age: 424493
2024-04-11 13:16:54 UTC	15406	IN	Data Raw: 00 00 01 00 03 00 10 10 00 00 01 00 20 00 68 04 00 00 36 00 00 00 20 20 00 00 01 00 20 00 28 11 00 00 9e 04 00 00 30 30 00 00 01 00 20 00 68 26 00 00 c6 15 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 ff 18 00 3b ff a3 00 3b ff f1 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff f3 00 3c ff 9c 00 35 ff 18 00 3c ff 9c 00 3c ff fc 00 3c ff ff 00 3c ff ff 00 3c ff ff 01 3d ff ff 06 40 ff ff 05 40 ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff fc 00 3b ff a3 00 3c ff f3 00 3c ff ff 00 3c ff ff 00 3c ff ff 00 3c ff ff 2a 5c ff ff a3 b8 ff ff 9c b2 ff ff 0b Data Ascii: h6 (00 h&( 5;;<<<<<<<<<<<<5<<<<<=@@<<<<<<<;<<<<<*\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	35.186.247.156	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	415	OUT	GET /api/1803156/envelope/?sentry_key=75786e51fd834ac5a70737db81a4b9d8&sentry_version=7 HTTP/1.1 Host: sentry.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	550	IN	HTTP/1.1 405 Method Not Allowed server: nginx date: Thu, 11 Apr 2024 13:16:54 GMT Content-Length: 0 access-control-allow-origin: * vary: origin,access-control-request-method,access-control-request-headers access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin allow: POST x-envoy-upstream-service-time: 0 strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	18.238.49.8	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	422	OUT	GET /api/ask/v1/client/sites/offsite-survey-info/acb47b15-657f-4926-ae9c-3678736cffb3 HTTP/1.1 Host: surveys.hotjar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:54 UTC	498	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close Date: Thu, 11 Apr 2024 13:16:54 GMT Cache-Control: no-cache, no-store Com-Hotjar-Srvid: ask-backend Strict-Transport-Security: max-age=2592000; includeSubDomains Vary: Accept-Encoding Vary: Origin X-Cache: Miss from cloudfront Via: 1.1 8ca7450d970f904109dac7e068234b78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: dvFOqm2SvH8lGSeLBEMd7ZLwV_TjgiwoF2zouaaupNeYhpnQmz6tug==
2024-04-11 13:16:54 UTC	72	IN	Data Raw: 34 32 0d 0a 7b 22 73 69 74 65 5f 69 64 22 3a 33 39 32 39 33 33 35 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 65 66 66 65 63 74 69 76 65 5f 73 68 6f 77 5f 62 72 61 6e 64 69 6e 67 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 42{"site_id":3929335,"enabled":true,"effective_show_branding":false}
2024-04-11 13:16:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	108.138.106.124	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:54 UTC	542	OUT	GET /c/hotjar-3929335.js?sv=6 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:55 UTC	633	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Thu, 11 Apr 2024 13:16:54 GMT Access-Control-Allow-Origin: * Cache-Control: max-age=60 Cross-Origin-Resource-Policy: cross-origin ETag: W/50d18c8c10a2d001979d0d35377b0869 Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 84eb14fd35e56c52f969c1decfba148c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: zsPMxQWtEd8YQnWC1hdxYiugn4U_EyxLq0Rey48RD2MBqf1KCm4F2A==
2024-04-11 13:16:55 UTC	3680	IN	Data Raw: 65 35 39 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 33 39 32 39 33 33 35 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 31 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 61 75 74 6f 6d 61 74 69 63 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 74 72 75 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f 6e 73 65 6e 74 22 3a 74 72 75 65 2c 22 61 6e 6f 6e 79 Data Ascii: e59window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":3929335,"rec_value":1,"state_change_listen_mode":"automatic","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":true,"session_capture_console_consent":true,"anony
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 37 65 36 65 0d 0a 32 63 39 37 34 33 32 62 37 38 32 63 38 30 61 61 35 30 63 33 38 63 39 31 66 5f 32 66 30 35 64 64 30 63 30 38 36 37 34 38 35 63 62 62 61 63 32 33 62 63 65 61 36 32 36 37 34 64 22 2c 22 69 6d 61 67 65 5f 74 68 75 6d 62 6e 61 69 6c 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 75 72 76 65 79 2d 69 6d 61 67 65 73 2e 68 6f 74 6a 61 72 2e 63 6f 6d 2f 73 75 72 76 65 79 2d 69 6d 61 67 65 73 2f 36 39 32 36 31 61 66 36 39 30 38 36 66 64 38 32 39 61 36 65 61 66 36 38 31 39 34 30 30 61 63 37 5f 62 63 35 30 30 35 39 36 65 63 38 35 34 35 62 64 39 63 62 31 31 35 38 31 65 39 35 63 61 32 33 31 5f 74 22 7d 2c 7b 22 75 75 69 64 22 3a 22 34 63 32 65 66 30 37 36 2d 35 36 62 66 2d 34 34 63 38 2d 38 38 62 39 2d 64 33 62 34 37 33 39 31 39 64 32 30 22 2c 22 74 Data Ascii: 7e6e2c97432b782c80aa50c38c91f_2f05dd0c0867485cbbac23bcea62674d","image_thumbnail_url":"https://survey-images.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_bc500596ec8545bd9cb11581e95ca231_t"},{"uuid":"4c2ef076-56bf-44c8-88b9-d3b473919d20","t
2024-04-11 13:16:55 UTC	15990	IN	Data Raw: 67 65 73 2e 68 6f 74 6a 61 72 2e 63 6f 6d 2f 73 75 72 76 65 79 2d 69 6d 61 67 65 73 2f 36 39 32 36 31 61 66 36 39 30 38 36 66 64 38 32 39 61 36 65 61 66 36 38 31 39 34 30 30 61 63 37 5f 34 35 64 35 37 65 30 31 34 61 39 38 34 61 32 64 61 38 34 62 31 32 36 63 32 37 37 30 64 33 32 65 5f 74 22 7d 2c 7b 22 75 75 69 64 22 3a 22 34 63 32 65 66 30 37 36 2d 35 36 62 66 2d 34 34 63 38 2d 38 38 62 39 2d 64 33 62 34 37 33 39 31 39 64 32 30 22 2c 22 74 79 70 65 22 3a 22 73 69 6e 67 6c 65 2d 6f 70 65 6e 2d 65 6e 64 65 64 2d 73 69 6e 67 6c 65 2d 6c 69 6e 65 22 2c 22 74 65 78 74 22 3a 22 42 45 43 41 55 53 45 20 59 4f 55 e2 80 99 52 45 20 41 43 43 45 53 53 49 4e 47 20 53 45 4e 53 49 54 49 56 45 20 49 4e 46 4f 2c 59 4f 55 20 4e 45 45 44 20 54 4f 20 56 45 52 49 46 59 20 54 Data Ascii: ges.hotjar.com/survey-images/69261af69086fd829a6eaf6819400ac7_45d57e014a984a2da84b126c2770d32e_t"},{"uuid":"4c2ef076-56bf-44c8-88b9-d3b473919d20","type":"single-open-ended-single-line","text":"BECAUSE YOURE ACCESSING SENSITIVE INFO,YOU NEED TO VERIFY T
2024-04-11 13:16:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	18.164.96.90	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:55 UTC	549	OUT	GET /modules.429236d560f51d186b8b.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:55 UTC	719	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 226211 Connection: close Date: Fri, 05 Apr 2024 10:18:22 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "82c928eb184b2ce235902634d808a4fc" Last-Modified: Fri, 05 Apr 2024 10:17:11 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a1546fc751225809c39b89ba9e8d715c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: FHtTR2Ys1b4ZwkRSBHPqiIfiaglHCd_jTSHFkbrJ58sh7M7cHhQvNg== Age: 529113
2024-04-11 13:16:55 UTC	15665	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 34 32 39 32 33 36 64 35 36 30 66 35 31 64 31 38 36 62 38 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.429236d560f51d186b8b.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 6f 6e 28 29 7b 65 2e 72 75 6e 43 61 6c 6c 62 61 63 6b 28 29 2c 74 2e 61 63 74 69 76 65 57 69 64 67 65 74 3d 65 7d 29 29 7d 2c 74 2e 73 65 74 4c 61 6e 67 75 61 67 65 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 75 2e 69 6e 63 6c 75 64 65 73 28 74 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 27 49 6e 76 61 6c 69 64 20 6c 61 6e 67 75 61 67 65 20 22 27 2b 74 2b 27 22 27 29 3b 65 3d 74 2c 68 6a 2e 77 69 64 67 65 74 2e 61 63 74 69 76 65 4c 61 6e 67 75 61 67 65 44 69 72 65 63 74 69 6f 6e 3d 6e 2e 69 6e 64 65 78 4f 66 28 74 29 3e 2d 31 3f 22 72 74 6c 22 3a 22 6c 74 72 22 2c 68 6a 2e 77 69 64 67 65 74 2e 69 73 41 63 74 69 76 65 4c 61 6e 67 75 61 67 65 44 69 72 65 63 74 69 6f 6e 52 74 6c 3d 22 72 74 6c 22 3d 3d Data Ascii: on(){e.runCallback(),t.activeWidget=e}))},t.setLanguage=hj.tryCatch((function(t){if(!u.includes(t))throw new Error('Invalid language "'+t+'"');e=t,hj.widget.activeLanguageDirection=n.indexOf(t)>-1?"rtl":"ltr",hj.widget.isActiveLanguageDirectionRtl="rtl"==
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 5c 73 40 22 5d 2b 29 2a 29 7c 28 22 2e 2b 22 29 29 40 28 28 5c 5b 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 5d 29 7c 28 28 5b 61 2d 7a 41 2d 5a 5c 2d 30 2d 39 5d 2b 5c 2e 29 2b 5b 61 2d 7a 41 2d 5a 5d 7b 32 2c 7d 29 29 24 2f 2e 74 65 73 74 28 65 29 7d 29 2c 22 75 74 69 6c 73 2e 76 61 6c 69 64 61 74 65 45 6d 61 69 6c 22 29 2c 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 6a 2e 75 73 65 72 44 65 76 69 63 65 54 79 70 65 7c 7c 28 68 6a 2e 75 73 65 72 44 65 76 69 63 65 54 79 70 65 3d 28 30 2c 72 2e 4b 29 28 29 2c 22 6d 6f 62 69 6c 65 22 3d 3d 3d 68 6a 2e 75 73 65 72 44 65 76 69 63 65 54 79 70 65 26 26 28 68 6a 2e 75 Data Ascii: \s@"]+)*)\|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])\|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(e)}),"utils.validateEmail"),hj.tryCatch((function(){return hj.userDeviceType\|\|(hj.userDeviceType=(0,r.K)(),"mobile"===hj.userDeviceType&&(hj.u
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 6e 67 74 68 7d 7d 29 2c 6e 2e 6c 65 6e 67 74 68 3e 30 26 26 63 28 29 29 7d 2c 68 6a 2e 69 6e 69 74 69 61 6c 56 69 73 69 74 44 61 74 61 53 65 6e 74 26 26 65 2e 61 63 74 69 76 61 74 65 28 29 2c 65 7d 28 29 2c 21 30 29 7d 29 2c 22 63 6f 6d 6d 61 6e 64 22 29 28 29 7d 2c 31 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 34 37 38 38 29 2c 6f 3d 6e 28 36 39 33 39 29 2c 69 3d 6e 28 35 36 35 38 29 2c 61 3d 6e 28 36 38 34 39 29 2c 73 3d 6e 28 36 37 34 32 29 2c 63 3d 6e 28 37 36 39 38 29 2c 75 3d 6e 28 37 32 34 29 2c 6c 3d 6e 28 33 38 38 33 29 2c 68 3d 6e 28 35 31 34 38 29 3b 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 Data Ascii: ngth}}),n.length>0&&c())},hj.initialVisitDataSent&&e.activate(),e}(),!0)}),"command")()},1229:function(e,t,n){"use strict";n.r(t);var r=n(4788),o=n(6939),i=n(5658),a=n(6849),s=n(6742),c=n(7698),u=n(724),l=n(3883),h=n(5148);hj.tryCatch((function(){return h
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 65 72 72 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 29 7d 2c 64 65 62 75 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 74 26 26 75 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 22 23 32 61 39 64 38 66 22 3b 63 21 3d 65 26 26 73 26 26 28 63 6f 6e 73 6f 6c 65 2e 67 72 6f 75 70 45 6e 64 28 29 2c 73 3d 21 31 29 2c 63 3d 65 2c 76 6f 69 64 20 30 21 3d 3d 68 6a 2e 64 65 62 75 67 26 26 68 6a 2e 64 65 62 75 67 2e 69 73 4f 6e 28 29 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 61 28 65 29 3f 68 6a 2e 68 71 2e 65 61 63 68 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 68 6a 2e 6c 6f 67 2e 64 65 62 75 67 28 65 2b 22 3a 20 22 2b 6e 2c 74 2c 6e 75 6c 6c 29 7d 29 29 3a 28 65 3d 74 Data Ascii: n:function(){},error:function(){}})},debug:function(e,t,n){var r=t&&u[t.toLowerCase()]\|\|"#2a9d8f";c!=e&&s&&(console.groupEnd(),s=!1),c=e,void 0!==hj.debug&&hj.debug.isOn()&&("object"===a(e)?hj.hq.each(e,(function(e,n){hj.log.debug(e+": "+n,t,null)})):(e=t
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 2c 74 68 69 73 2e 6f 62 73 65 72 76 65 72 43 61 6c 6c 62 61 63 6b 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 26 26 65 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 74 3d 6e 65 77 20 56 28 6e 2e 72 6f 6f 74 2c 65 2c 6e 2e 6f 70 74 69 6f 6e 73 2e 6f 6c 64 50 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 29 2c 72 3d 6e 65 77 20 71 28 74 29 3b 6e 2e 63 68 61 6e 67 65 73 54 6f 52 65 70 6f 72 74 28 72 29 26 26 6e 2e 63 61 6c 6c 62 61 63 6b 28 72 29 7d 7d 29 2c 22 4d 75 74 61 74 69 6f 6e 53 75 6d 6d 61 72 79 2e 6f 62 73 65 72 76 65 72 43 61 6c 6c 62 61 63 6b 22 29 2c 74 68 69 73 2e 72 65 63 6f 6e 6e 65 63 74 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 69 66 28 6e 2e 63 6f 6e 6e Data Ascii: ,this.observerCallback=hj.tryCatch((function(e){if(e&&e.length){var t=new V(n.root,e,n.options.oldPreviousSibling),r=new q(t);n.changesToReport(r)&&n.callback(r)}}),"MutationSummary.observerCallback"),this.reconnect=hj.tryCatch((function(){var e;if(n.conn
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 26 22 63 6c 61 73 73 22 21 3d 3d 61 5b 75 5d 2e 6e 61 6d 65 7c 7c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 61 5b 75 5d 2e 6e 61 6d 65 2c 61 5b 75 5d 2e 76 61 6c 75 65 29 2c 69 5b 65 2e 70 61 72 65 6e 74 53 65 6c 65 63 74 6f 72 5d 2b 3d 61 5b 75 5d 2e 6e 61 6d 65 2b 27 3d 22 27 2b 61 5b 75 5d 2e 76 61 6c 75 65 2b 27 22 20 27 3b 69 5b 65 2e 70 61 72 65 6e 74 53 65 6c 65 63 74 6f 72 5d 2b 3d 22 3e 20 2a 2f 22 2c 63 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 62 6c 6f 62 2d 68 61 73 68 2d 22 2b 73 29 2c 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 63 2c 6f 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 7d 6f 3d 63 7d 69 5b 65 2e 70 61 72 65 6e 74 53 65 6c 65 63 74 6f 72 5d 3d 69 5b 65 2e 70 61 72 65 6e 74 53 65 6c 65 63 74 6f Data Ascii: &"class"!==a[u].name\|\|c.setAttribute(a[u].name,a[u].value),i[e.parentSelector]+=a[u].name+'="'+a[u].value+'" ';i[e.parentSelector]+="> */",c.classList.add("blob-hash-"+s),o.parentNode.insertBefore(c,o.nextSibling)}o=c}i[e.parentSelector]=i[e.parentSelecto
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 61 67 65 43 6f 6e 74 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 68 6a 2e 6c 6f 67 2e 77 61 72 6e 49 66 45 6d 70 74 79 28 74 2c 22 74 72 79 53 74 6f 72 65 50 61 67 65 43 6f 6e 74 65 6e 74 3a 20 63 6f 6e 74 65 6e 74 22 29 2c 68 6a 2e 6c 6f 67 2e 77 61 72 6e 49 66 45 6d 70 74 79 28 6e 2c 22 74 72 79 53 74 6f 72 65 50 61 67 65 43 6f 6e 74 65 6e 74 3a 20 75 72 6c 4d 44 35 22 29 2c 65 2e 73 74 6f 72 65 50 61 67 65 43 6f 6e 74 65 6e 74 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 63 6f 6e 74 65 6e 74 5f 75 75 69 64 3b 74 3f 28 79 3d 21 30 2c 75 2e 79 2e 73 65 74 28 22 70 61 67 65 43 6f 6e 74 65 6e 74 22 2c 7b 75 75 69 64 3a 74 2c 6d 64 35 3a 6e 7d 29 29 3a 68 6a 2e 6c 6f 67 2e 77 61 72 6e 28 22 45 78 70 65 63 74 69 6e 67 20 Data Ascii: ageContent=function(t,n){hj.log.warnIfEmpty(t,"tryStorePageContent: content"),hj.log.warnIfEmpty(n,"tryStorePageContent: urlMD5"),e.storePageContent(t,(function(e){var t=e.content_uuid;t?(y=!0,u.y.set("pageContent",{uuid:t,md5:n})):hj.log.warn("Expecting
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 2c 5f 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 74 5b 6e 5d 3b 72 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 72 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 72 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 Data Ascii: ction(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},_(e)}function C(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"i
2024-04-11 13:16:55 UTC	16384	IN	Data Raw: 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 69 6e 53 61 6d 70 6c 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 64 26 26 64 2c 43 3d 6e 75 6c 6c 21 3d 3d 28 70 3d 28 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 72 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 29 26 26 5f 29 26 26 76 6f 69 64 20 30 21 3d 3d 70 26 26 70 2c 7b 69 64 3a 77 2c 63 72 65 61 74 65 64 3a 53 2c 69 6e 53 61 6d 70 6c 65 3a 5f 2c 73 65 73 73 69 6f 6e 69 7a 65 72 42 65 74 61 45 6e 61 62 6c 65 64 3a 6e 75 6c 6c 21 3d 3d 28 76 3d 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 73 65 73 73 69 6f 6e 69 7a 65 72 42 65 74 61 45 6e 61 62 6c 65 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 76 26 26 76 2c 72 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 3a 43 2c 73 65 73 73 69 6f 6e 52 65 6a 65 Data Ascii: null==i?void 0:i.inSample)&&void 0!==d&&d,C=null!==(p=(null==i?void 0:i.recordingEnabled)&&_)&&void 0!==p&&p,{id:w,created:S,inSample:_,sessionizerBetaEnabled:null!==(v=null==i?void 0:i.sessionizerBetaEnabled)&&void 0!==v&&v,recordingEnabled:C,sessionReje

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:56 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-11 13:16:56 UTC	435	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=64008 Date: Thu, 11 Apr 2024 13:16:56 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	18.164.96.90	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:56 UTC	869	OUT	GET /survey-v2.d837311e92d8b0333fd2.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjowLCJzcCI6MH0=
2024-04-11 13:16:56 UTC	719	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 292145 Connection: close Date: Wed, 03 Apr 2024 09:41:19 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "a7ba8380bbfa314da0a00f378492219e" Last-Modified: Wed, 03 Apr 2024 07:56:16 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 98bc8180e0431e8f05afc9802305f1d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: yV0dhvpTfI4aSq1-zCAuWKQoTSQdA8mIq_mCpLFss0PmcBZpkyFApA== Age: 704137
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 73 75 72 76 65 79 2d 76 32 2e 64 38 33 37 33 31 31 65 39 32 64 38 62 30 33 33 33 66 64 32 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 70 3d 68 6a 2e 73 63 72 69 70 74 44 6f 6d 61 69 6e 7d 2c 33 32 37 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 35 39 33 33 29 2c 6f 3d 6e 2e 6e 28 72 29 28 29 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 31 5d 7d 29 29 3b 6f 2e 70 75 73 68 28 5b 65 2e 69 64 2c 22 Data Ascii: /! For license information please see survey-v2.d837311e92d8b0333fd2.js.LICENSE.txt /!function(){var e={62:function(e,t,n){n.p=hj.scriptDomain},3270:function(e,t,n){"use strict";n.r(t);var r=n(5933),o=n.n(r)()((function(e){return e[1]}));o.push([e.id,"
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 6e 75 70 42 75 74 74 6f 6e 7b 68 65 69 67 68 74 3a 33 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 5c 6e 22 2c 22 22 5d 29 2c 61 2e 6c 6f 63 61 6c 73 3d 7b 73 75 72 76 65 79 48 6f 74 6a 61 72 55 70 73 65 6c 6c 3a 22 5f 68 6a 2d 6d 62 38 57 36 5f 5f 73 74 79 6c 65 73 5f 5f 73 75 72 76 65 79 48 6f 74 6a 61 72 55 70 73 65 6c 6c 22 2c 68 6f 74 6a 61 72 6c 6f 67 6f 43 6f 6e 74 61 69 6e 65 72 3a 22 5f 68 6a 2d 43 65 4a 70 2b 5f 5f 73 74 79 6c 65 73 5f 5f 68 6f 74 6a 61 72 6c 6f 67 6f 43 6f 6e 74 61 69 6e 65 72 22 2c 73 75 72 76 65 79 53 69 67 6e 75 70 42 75 74 74 6f 6e 3a 22 5f 68 6a 2d 70 6b 58 74 76 5f 5f 73 74 79 6c 65 73 5f 5f 73 75 72 76 65 79 53 69 67 6e 75 70 42 75 74 74 6f 6e 20 22 2b 69 2e 64 65 66 61 75 6c 74 2e 6c 6f 63 61 6c 73 2e 73 75 72 76 65 79 Data Ascii: nupButton{height:32px !important}\n",""]),a.locals={surveyHotjarUpsell:"_hj-mb8W6__styles__surveyHotjarUpsell",hotjarlogoContainer:"_hj-CeJp+__styles__hotjarlogoContainer",surveySignupButton:"_hj-pkXtv__styles__surveySignupButton "+i.default.locals.survey
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 5f 5f 6d 6f 64 61 6c 20 2e 5f 68 6a 2d 49 6e 6c 69 4c 5f 5f 73 74 79 6c 65 73 5f 5f 63 6c 6f 73 65 45 6e 64 65 64 4f 70 74 69 6f 6e 54 65 78 74 2c 2e 5f 68 6a 2d 77 69 64 67 65 74 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 5f 68 6a 2d 42 56 32 52 6c 5f 5f 73 74 79 6c 65 73 5f 5f 65 78 74 65 72 6e 61 6c 20 2e 5f 68 6a 2d 49 6e 6c 69 4c 5f 5f 73 74 79 6c 65 73 5f 5f 63 6c 6f 73 65 45 6e 64 65 64 4f 70 74 69 6f 6e 54 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 36 32 35 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 34 30 70 78 29 7b 2e 5f 68 6a 2d 77 69 64 67 65 74 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 5f 68 6a 2d 44 57 62 33 46 5f 5f 73 74 79 6c 65 73 5f 5f 6d 6f 64 61 6c Data Ascii: __modal ._hj-InliL__styles__closeEndedOptionText,._hj-widget-container ._hj-BV2Rl__styles__external ._hj-InliL__styles__closeEndedOptionText{font-size:1.0625em !important}@media screen and (min-width: 440px){._hj-widget-container ._hj-DWb3F__styles__modal
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 61 75 6c 74 3d 73 7d 2c 31 30 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 35 39 33 33 29 2c 6f 3d 6e 2e 6e 28 72 29 2c 69 3d 6e 28 35 33 34 30 29 2c 61 3d 6e 28 32 33 38 34 29 2c 73 3d 6e 2e 6e 28 61 29 2c 6c 3d 6e 28 36 32 32 38 29 2c 5f 3d 6e 2e 6e 28 6c 29 2c 63 3d 6e 28 35 31 30 34 29 2c 75 3d 6e 2e 6e 28 63 29 2c 64 3d 6e 28 38 35 38 35 29 2c 70 3d 6e 2e 6e 28 64 29 2c 68 3d 6e 28 33 33 39 39 29 2c 66 3d 6e 2e 6e 28 68 29 2c 79 3d 6f 28 29 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 31 5d 7d 29 29 3b 79 2e 69 28 69 2e 64 65 66 61 75 6c 74 2c 22 22 2c 21 30 29 3b 76 61 72 20 6d 3d 73 28 29 28 5f 28 29 29 2c 67 3d 73 28 29 28 75 28 Data Ascii: ault=s},1057:function(e,t,n){"use strict";n.r(t);var r=n(5933),o=n.n(r),i=n(5340),a=n(2384),s=n.n(a),l=n(6228),_=n.n(l),c=n(5104),u=n.n(c),d=n(8585),p=n.n(d),h=n(3399),f=n.n(h),y=o()((function(e){return e[1]}));y.i(i.default,"",!0);var m=s()(_()),g=s()(u(
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 5f 6d 69 6e 69 6d 69 7a 65 64 42 75 74 74 6f 6e 22 2c 6f 70 65 6e 53 74 61 74 65 42 75 74 74 6f 6e 54 6f 67 67 6c 65 49 63 6f 6e 43 68 65 76 72 6f 6e 3a 22 5f 68 6a 2d 75 63 4a 5a 2d 5f 5f 73 74 79 6c 65 73 5f 5f 6f 70 65 6e 53 74 61 74 65 42 75 74 74 6f 6e 54 6f 67 67 6c 65 49 63 6f 6e 43 68 65 76 72 6f 6e 22 2c 63 6c 6f 73 65 64 3a 22 5f 68 6a 2d 77 34 54 55 2d 5f 5f 73 74 79 6c 65 73 5f 5f 63 6c 6f 73 65 64 22 2c 6f 70 65 6e 69 6e 67 41 6e 69 6d 61 74 69 6f 6e 3a 22 5f 68 6a 2d 73 65 30 4f 77 5f 5f 73 74 79 6c 65 73 5f 5f 6f 70 65 6e 69 6e 67 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 73 6c 69 64 65 2d 74 6f 2d 74 6f 70 22 3a 22 5f 68 6a 2d 48 67 4b 71 65 5f 5f 73 74 79 6c 65 73 5f 5f 73 6c 69 64 65 2d 74 6f 2d 74 6f 70 22 2c 62 75 74 74 6f 6e 54 72 61 6e 73 Data Ascii: _minimizedButton",openStateButtonToggleIconChevron:"_hj-ucJZ-__styles__openStateButtonToggleIconChevron",closed:"_hj-w4TU-__styles__closed",openingAnimation:"_hj-se0Ow__styles__openingAnimation","slide-to-top":"_hj-HgKqe__styles__slide-to-top",buttonTrans
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 55 70 70 65 72 43 61 73 65 28 29 5d 28 69 2e 76 61 6c 75 65 73 2e 63 6f 6e 63 61 74 28 5b 69 2e 61 6c 70 68 61 5d 29 29 7d 2c 50 3d 7b 68 65 78 3a 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 3b 72 65 74 75 72 6e 20 50 2e 68 65 78 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 68 65 78 53 74 72 69 6e 67 28 29 2e 72 65 70 6c 61 63 65 28 2f 5e 23 2f 2c 22 22 29 7d 2c 4d 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 43 6f 6c 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 43 28 65 29 3b 72 65 74 75 72 6e 20 74 3f 74 68 69 73 5b 22 5f 73 65 74 46 72 6f 6d 22 2b 74 2e 74 79 70 65 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 5d 28 74 2e 76 61 6c 75 65 73 2e 63 6f 6e 63 61 74 28 5b 74 2e 61 6c 70 68 61 5d 29 Data Ascii: UpperCase()](i.values.concat([i.alpha]))},P={hex:{configurable:!0}};return P.hex.get=function(){return this.hexString().replace(/^#/,"")},M.prototype.setColor=function(e){var t=C(e);return t?this["_setFrom"+t.type.toUpperCase()](t.values.concat([t.alpha])
2024-04-11 13:16:56 UTC	16384	IN	Data Raw: 20 6a 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 6f 3d 65 2e 68 61 73 49 6e 74 65 72 61 63 74 65 64 2c 69 3d 65 2e 69 73 43 6c 6f 73 65 64 2c 61 3d 65 2e 6f 6e 43 6c 6f 73 65 2c 73 3d 65 2e 72 65 66 2c 6c 3d 6d 65 28 65 2c 66 65 29 2c 5f 3d 61 65 28 29 3b 72 65 74 75 72 6e 20 58 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 6a 2e 68 71 28 64 6f 63 75 6d 65 6e 74 29 2e 6f 6e 28 22 6b 65 79 64 6f 77 6e 2e 73 75 72 76 65 79 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 45 73 63 61 70 65 22 3d 3d 3d 65 2e 6b 65 79 26 26 28 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 61 28 29 2c 67 65 28 29 29 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 28 29 7d 7d 29 2c 5b Data Ascii: je=function(e){var t,n,r=e.children,o=e.hasInteracted,i=e.isClosed,a=e.onClose,s=e.ref,l=me(e,fe),_=ae();return X((function(){return hj.hq(document).on("keydown.survey",(function(e){"Escape"===e.key&&(e.stopPropagation(),a(),ge())})),function(){ge()}}),[
2024-04-11 13:16:56 UTC	13232	IN	Data Raw: 7c 53 41 4d 53 55 4e 47 5c 2d 47 54 5c 2d 69 38 30 30 30 7c 53 41 4d 53 55 4e 47 5c 2d 53 47 48 5c 2d 69 39 2f 69 29 3f 22 6d 6f 62 69 6c 65 22 3a 74 28 2f 57 69 6e 64 6f 77 73 2e 28 4e 54 7c 58 50 7c 4d 45 7c 39 29 2f 29 26 26 21 74 28 2f 50 68 6f 6e 65 2f 69 29 7c 7c 74 28 2f 57 69 6e 28 39 7c 2e 39 7c 4e 54 29 2f 69 29 7c 7c 74 28 2f 4d 61 63 69 6e 74 6f 73 68 7c 50 6f 77 65 72 50 43 2f 69 29 26 26 21 74 28 2f 53 69 6c 6b 2f 69 29 7c 7c 74 28 2f 4c 69 6e 75 78 2f 69 29 26 26 74 28 2f 58 31 31 2f 69 29 7c 7c 74 28 2f 53 6f 6c 61 72 69 73 7c 53 75 6e 4f 53 7c 42 53 44 2f 69 29 7c 7c 74 28 2f 42 6f 74 7c 43 72 61 77 6c 65 72 7c 53 70 69 64 65 72 7c 59 61 68 6f 6f 7c 69 61 5f 61 72 63 68 69 76 65 72 7c 43 6f 76 61 72 69 6f 2d 49 44 53 7c 66 69 6e 64 6c 69 Data Ascii: \|SAMSUNG\-GT\-i8000\|SAMSUNG\-SGH\-i9/i)?"mobile":t(/Windows.(NT\|XP\|ME\|9)/)&&!t(/Phone/i)\|\|t(/Win(9\|.9\|NT)/i)\|\|t(/Macintosh\|PowerPC/i)&&!t(/Silk/i)\|\|t(/Linux/i)&&t(/X11/i)\|\|t(/Solaris\|SunOS\|BSD/i)\|\|t(/Bot\|Crawler\|Spider\|Yahoo\|ia_archiver\|Covario-IDS\|findli
2024-04-11 13:16:56 UTC	1977	IN	Data Raw: 6e 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 67 6e 28 65 2c 74 2c 6e 2c 72 2c 6f 2c 69 2c 61 29 7b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 65 2c 72 6f 6f 74 3a 74 2c 70 61 72 65 6e 74 3a 6e 2c 74 79 70 65 3a 72 2c 70 72 6f 70 73 3a 6f 2c 63 68 69 6c 64 72 65 6e 3a 69 2c 6c 69 6e 65 3a 64 6e 2c 63 6f 6c 75 6d 6e 3a 70 6e 2c 6c 65 6e 67 74 68 3a 61 2c 72 65 74 75 72 6e 3a 22 22 7d 7d 66 75 6e 63 74 69 6f 6e 20 62 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 6e 28 67 6e 28 22 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 29 2c 65 2c 7b 6c 65 6e 67 74 68 3a 2d 65 2e 6c 65 6e 67 74 68 7d 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 76 6e 28 29 7b 72 65 74 75 72 6e 20 79 6e 3d 66 6e 3e 30 3f 73 6e 28 6d 6e 2c 2d 2d 66 6e 29 3a 30 2c 70 6e Data Ascii: n="";function gn(e,t,n,r,o,i,a){return{value:e,root:t,parent:n,type:r,props:o,children:i,line:dn,column:pn,length:a,return:""}}function bn(e,t){return nn(gn("",null,null,"",null,null,0),e,{length:-e.length},t)}function vn(){return yn=fn>0?sn(mn,--fn):0,pn
2024-04-11 13:16:56 UTC	12792	IN	Data Raw: 69 2c 77 3d 72 2c 78 3d 62 3b 79 3b 29 73 77 69 74 63 68 28 68 3d 67 2c 67 3d 6a 6e 28 29 29 7b 63 61 73 65 20 34 30 3a 69 66 28 31 30 38 21 3d 68 26 26 35 38 3d 3d 73 6e 28 78 2c 75 2d 31 29 29 7b 2d 31 21 3d 61 6e 28 78 2b 3d 6f 6e 28 49 6e 28 67 29 2c 22 26 22 2c 22 26 5c 66 22 29 2c 22 26 5c 66 22 29 26 26 28 6d 3d 2d 31 29 3b 62 72 65 61 6b 7d 63 61 73 65 20 33 34 3a 63 61 73 65 20 33 39 3a 63 61 73 65 20 39 31 3a 78 2b 3d 49 6e 28 67 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 39 3a 63 61 73 65 20 31 30 3a 63 61 73 65 20 31 33 3a 63 61 73 65 20 33 32 3a 78 2b 3d 45 6e 28 68 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 39 32 3a 78 2b 3d 41 6e 28 78 6e 28 29 2d 31 2c 37 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 20 34 37 3a 73 77 69 74 63 68 28 77 6e 28 29 29 Data Ascii: i,w=r,x=b;y;)switch(h=g,g=jn()){case 40:if(108!=h&&58==sn(x,u-1)){-1!=an(x+=on(In(g),"&","&\f"),"&\f")&&(m=-1);break}case 34:case 39:case 91:x+=In(g);break;case 9:case 10:case 13:case 32:x+=En(h);break;case 92:x+=An(xn()-1,7);continue;case 47:switch(wn())

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:56 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-11 13:16:56 UTC	455	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=64008 Date: Thu, 11 Apr 2024 13:16:56 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-11 13:16:56 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	13.226.34.111	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:57 UTC	584	OUT	GET /hit?id=1009411&device=desktop HTTP/1.1 Host: surveystats.hotjar.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://surveys.hotjar.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:57 UTC	698	IN	HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 0 Connection: close Date: Tue, 09 Apr 2024 14:05:22 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Max-Age: 0 Last-Modified: Wed, 27 Jan 2021 15:23:17 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" Cache-Control: public,max-age=0 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method X-Cache: Hit from cloudfront Via: 1.1 081adfb0526af4d4162283117d917418.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR53-C2 X-Amz-Cf-Id: pj_iffcWnCdW0vVg-h9vnL_RVoKLJ5QUQ2jKxhGKn-JwbW-2Hpy1Kg== Age: 169896

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	18.164.116.101	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:57 UTC	948	OUT	GET /surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:16:58 UTC	594	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4291 Connection: close Date: Thu, 11 Apr 2024 13:16:59 GMT Last-Modified: Tue, 09 Apr 2024 17:18:12 GMT ETag: "594d8872c97432b782c80aa50c38c91f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=0, must-revalidate x-amz-version-id: JLe30dcFvDyVHFnzbpLyighVNK.bsVJN Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: IP-bLEyySpMbmUyBOEPYP4s6CQa1ceg-rEtRKlk8pJfE7TD0B2iKsg== Vary: Origin
2024-04-11 13:16:58 UTC	4291	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 6b 08 06 00 00 00 1c 95 ec 4c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 10 58 49 44 41 54 78 5e ed 9d 07 ac 54 45 1b 86 07 10 10 45 45 b1 82 5d b1 a0 d8 10 11 6b 62 af b1 a0 28 6a 04 35 9a 68 c4 44 63 f9 c5 fc 09 f9 05 8d 26 f6 16 8d 15 15 2c d8 62 17 41 b0 f7 5e 51 c1 de cb 45 2c 88 85 9f 67 f6 0c ce ce ce 39 bb 7b ef ee a0 de f7 49 36 bb e7 ec d9 73 e6 cc cc 3b f3 7d df 7c e7 de 0e b3 06 f7 99 6b 9a 40 f7 09 d3 ec fb ff 26 75 b5 ef 8d e6 b8 fe 53 4c 8f 1e 83 b2 2d 21 fe 19 74 cc de 85 10 09 90 e0 84 48 88 04 27 44 42 24 38 21 12 22 c1 09 91 10 09 4e 88 84 68 59 40 88 1c be Data Ascii: PNGIHDRkLsRGBgAMAapHYs+XIDATx^TEEE]kb(j5hDc&,bA^QE,g9{I6s;}\|k@&uSL-!tH'DB$8!"NhY@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49756	18.164.116.101	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:57 UTC	984	OUT	GET /survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://surveys.hotjar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:16:58 UTC	594	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4827 Connection: close Date: Thu, 11 Apr 2024 13:16:59 GMT Last-Modified: Tue, 09 Apr 2024 17:18:12 GMT ETag: "69261af69086fd829a6eaf6819400ac7" x-amz-server-side-encryption: AES256 Cache-Control: max-age=0, must-revalidate x-amz-version-id: doRbeR9uRPTyzMpOnPk20ojiHtOmZe4M Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 578ec28f8e6f7c6503e2a4d2ab7532a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: BJxn2g-wxkrW1IWbc_leDRmYgvGgHiNaEwQQQspCfnPpmLN9YJyJmQ== Vary: Origin
2024-04-11 13:16:58 UTC	4827	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 6b 08 06 00 00 00 1c 95 ec 4c 00 00 12 a2 49 44 41 54 78 9c ed 9d 5b 50 14 57 b7 c7 ff 3d d3 73 e1 26 77 b9 ab 80 5c 06 15 01 45 24 8a 49 8c 97 c4 88 d1 c4 52 13 52 c6 24 15 ab b4 92 53 15 ab f2 7a 2a 75 9e 53 26 c6 07 cb 94 55 1a bf c4 c4 f2 4b d4 aa 68 0c d1 08 46 14 19 05 2f 88 a0 0c e1 26 c3 65 10 1c 99 19 98 5b 9f 07 6a a6 a6 a7 7b 86 01 87 f6 3b 87 f5 7b 31 ec de bd f7 9e ee fe f7 5e 6b af b5 3b cc b3 77 b2 38 4c 03 e1 ff 7e 08 00 f8 9f 4b aa e9 68 1e ff b5 a4 0a 51 51 a5 d3 d2 36 41 4c 17 b2 17 3d 00 82 98 49 90 e0 08 42 42 48 70 04 21 21 24 38 82 90 10 12 1c 41 48 08 09 8e 20 24 84 7d d1 03 20 88 ff 54 0c 06 03 1e 3e 7c 88 ae ae 2e 8c 8c 8c 40 a9 54 22 24 24 04 4b 96 2c 41 7a 7a Data Ascii: PNGIHDRkLIDATx[PW=s&w\E$IRR$Sz*uS&UKhF/&e[j{;{1^k;w8L~KhQQ6AL=IBBHp!!$8AH $} T>\|.@T"$$K,Azz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	13.226.34.40	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:58 UTC	374	OUT	GET /hit?id=1009411&device=desktop HTTP/1.1 Host: surveystats.hotjar.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-11 13:16:58 UTC	523	IN	HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 0 Connection: close Date: Fri, 05 Apr 2024 07:20:58 GMT Last-Modified: Wed, 27 Jan 2021 15:23:17 GMT ETag: "d41d8cd98f00b204e9800998ecf8427e" Cache-Control: public,max-age=0 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 0f37773e2cce4ff7a5301ebabb04538a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR53-C2 X-Amz-Cf-Id: _rAtbinkmW23qe-6ET1D3XkbFt70CYWvlmFz6XQ7Brxdw6_IEvz6Jg== Age: 539761

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	18.164.116.92	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:58 UTC	711	OUT	GET /surveys/logo/57b1c4f0feec45f49a2d0b30bd13d05a HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:16:58 UTC	593	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4291 Connection: close Date: Thu, 11 Apr 2024 13:16:59 GMT Last-Modified: Tue, 09 Apr 2024 17:18:12 GMT ETag: "594d8872c97432b782c80aa50c38c91f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=0, must-revalidate x-amz-version-id: JLe30dcFvDyVHFnzbpLyighVNK.bsVJN Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 05b3bdb53d1146d1176c185d2da0d530.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: jfjkFN8wpe_VccS1o7SrhIAoCV1yjOMt5zf0dgIbd8oP36FcZDHGRw== Vary: Origin
2024-04-11 13:16:58 UTC	4291	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 6b 08 06 00 00 00 1c 95 ec 4c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 10 58 49 44 41 54 78 5e ed 9d 07 ac 54 45 1b 86 07 10 10 45 45 b1 82 5d b1 a0 d8 10 11 6b 62 af b1 a0 28 6a 04 35 9a 68 c4 44 63 f9 c5 fc 09 f9 05 8d 26 f6 16 8d 15 15 2c d8 62 17 41 b0 f7 5e 51 c1 de cb 45 2c 88 85 9f 67 f6 0c ce ce ce 39 bb 7b ef ee a0 de f7 49 36 bb e7 ec d9 73 e6 cc cc 3b f3 7d df 7c e7 de 0e b3 06 f7 99 6b 9a 40 f7 09 d3 ec fb ff 26 75 b5 ef 8d e6 b8 fe 53 4c 8f 1e 83 b2 2d 21 fe 19 74 cc de 85 10 09 90 e0 84 48 88 04 27 44 42 24 38 21 12 22 c1 09 91 10 09 4e 88 84 68 59 40 88 1c be Data Ascii: PNGIHDRkLsRGBgAMAapHYs+XIDATx^TEEE]kb(j5hDc&,bA^QE,g9{I6s;}\|k@&uSL-!tH'DB$8!"NhY@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	18.164.116.92	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:16:58 UTC	747	OUT	GET /survey-images/69261af69086fd829a6eaf6819400ac7_81723c1211704601bbebcd46fbb8c55b_t HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:16:58 UTC	593	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4827 Connection: close Date: Thu, 11 Apr 2024 13:16:59 GMT Last-Modified: Tue, 09 Apr 2024 17:18:12 GMT ETag: "69261af69086fd829a6eaf6819400ac7" x-amz-server-side-encryption: AES256 Cache-Control: max-age=0, must-revalidate x-amz-version-id: doRbeR9uRPTyzMpOnPk20ojiHtOmZe4M Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 578ec28f8e6f7c6503e2a4d2ab7532a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: z-IJb7gC04XrOssYNzmOpTTHN2kt58AQSRfVHl-W72g4mBwrzcumow== Vary: Origin
2024-04-11 13:16:58 UTC	4827	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 6b 08 06 00 00 00 1c 95 ec 4c 00 00 12 a2 49 44 41 54 78 9c ed 9d 5b 50 14 57 b7 c7 ff 3d d3 73 e1 26 77 b9 ab 80 5c 06 15 01 45 24 8a 49 8c 97 c4 88 d1 c4 52 13 52 c6 24 15 ab b4 92 53 15 ab f2 7a 2a 75 9e 53 26 c6 07 cb 94 55 1a bf c4 c4 f2 4b d4 aa 68 0c d1 08 46 14 19 05 2f 88 a0 0c e1 26 c3 65 10 1c 99 19 98 5b 9f 07 6a a6 a6 a7 7b 86 01 87 f6 3b 87 f5 7b 31 ec de bd f7 9e ee fe f7 5e 6b af b5 3b cc b3 77 b2 38 4c 03 e1 ff 7e 08 00 f8 9f 4b aa e9 68 1e ff b5 a4 0a 51 51 a5 d3 d2 36 41 4c 17 b2 17 3d 00 82 98 49 90 e0 08 42 42 48 70 04 21 21 24 38 82 90 10 12 1c 41 48 08 09 8e 20 24 84 7d d1 03 20 88 ff 54 0c 06 03 1e 3e 7c 88 ae ae 2e 8c 8c 8c 40 a9 54 22 24 24 04 4b 96 2c 41 7a 7a Data Ascii: PNGIHDRkLIDATx[PW=s&w\E$IRR$Sz*uS&UKhF/&e[j{;{1^k;w8L~KhQQ6AL=IBBHp!!$8AH $} T>\|.@T"$$K,Azz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49767	18.164.116.101	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:17:13 UTC	1044	OUT	GET /survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8 HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:17:13 UTC	594	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4291 Connection: close Date: Thu, 11 Apr 2024 13:17:14 GMT Last-Modified: Tue, 09 Apr 2024 17:18:11 GMT ETag: "594d8872c97432b782c80aa50c38c91f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=0, must-revalidate x-amz-version-id: 0TgvjJ30ydVO1zB.FFBlNkO441ix025a Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 6e810acc9d798bdf126180508d1b511e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: 34fabRkFP5f32hKBQJmCXveyo0iPG7wmyIJ__Gz9tyNnQXVxGq-rzw== Vary: Origin
2024-04-11 13:17:13 UTC	4291	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 6b 08 06 00 00 00 1c 95 ec 4c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 10 58 49 44 41 54 78 5e ed 9d 07 ac 54 45 1b 86 07 10 10 45 45 b1 82 5d b1 a0 d8 10 11 6b 62 af b1 a0 28 6a 04 35 9a 68 c4 44 63 f9 c5 fc 09 f9 05 8d 26 f6 16 8d 15 15 2c d8 62 17 41 b0 f7 5e 51 c1 de cb 45 2c 88 85 9f 67 f6 0c ce ce ce 39 bb 7b ef ee a0 de f7 49 36 bb e7 ec d9 73 e6 cc cc 3b f3 7d df 7c e7 de 0e b3 06 f7 99 6b 9a 40 f7 09 d3 ec fb ff 26 75 b5 ef 8d e6 b8 fe 53 4c 8f 1e 83 b2 2d 21 fe 19 74 cc de 85 10 09 90 e0 84 48 88 04 27 44 42 24 38 21 12 22 c1 09 91 10 09 4e 88 84 68 59 40 88 1c be Data Ascii: PNGIHDRkLsRGBgAMAapHYs+XIDATx^TEEE]kb(j5hDc&,bA^QE,g9{I6s;}\|k@&uSL-!tH'DB$8!"NhY@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49768	18.164.116.101	443	5444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 13:17:14 UTC	1001	OUT	GET /favicon.ico HTTP/1.1 Host: survey-images.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://survey-images.hotjar.com/survey-images/594d8872c97432b782c80aa50c38c91f_6b6aa22d399f405cb7f15e9e011c4fb8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _hjSessionUser_3929335=eyJpZCI6IjgwMmFhYzJkLTZkNTgtNTk3YS1iYTNiLTc5OTdhMWRlMTViOCIsImNyZWF0ZWQiOjE3MTI4NDE0MTUxODIsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_3929335=eyJpZCI6ImQ4NTUxNzA2LWM1ZDgtNGE2Ny1iODJhLTU0NDM1MzkyZDdhMyIsImMiOjE3MTI4NDE0MTUxODYsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
2024-04-11 13:17:14 UTC	371	IN	HTTP/1.1 403 Forbidden Content-Type: application/xml Transfer-Encoding: chunked Connection: close Date: Thu, 11 Apr 2024 13:17:13 GMT Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 b33e91c066f49dc7c18162b9a344e266.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: sGfro5vUvE4y-ylrWLJQT8m9rUwXCmKy53YQ_uXF_-NMLrnhZLEpew== Vary: Origin
2024-04-11 13:17:14 UTC	261	IN	Data Raw: 66 66 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 5a 47 58 4a 38 4d 52 48 45 44 4b 33 5a 56 34 42 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 68 56 41 55 64 62 6e 51 31 46 53 39 2f 63 7a 77 2b 39 78 75 53 61 50 68 53 58 70 4c 79 72 4f 6e 66 62 4c 72 35 65 6c 63 77 35 6a 6a 66 71 5a 34 67 4a 74 31 62 6e 4e 6c 2f 4a 4e 69 41 73 48 71 63 6c 75 61 52 6f 6b 78 50 38 6f 4a 73 42 4f 66 48 57 43 68 6d 77 3d 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 Data Ascii: ff<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>ZGXJ8MRHEDK3ZV4B</RequestId><HostId>hVAUdbnQ1FS9/czw+9xuSaPhSXpLyrOnfbLr5elcw5jjfqZ4gJt1bnNl/JNiAsHqcluaRokxP8oJsBOfHWChmw==</HostId></Er
2024-04-11 13:17:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:16:47
Start date:	11/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:16:48
Start date:	11/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1904,i,4635795211928151453,16146864486055887246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:16:51
Start date:	11/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
https://surveys.hotjar.com/acb47b15-657f-4926-ae9c-3678736cffb3