Edit tour

Windows Analysis Report
https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/

Overview

General Information

Sample URL:	https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAx
Analysis ID:	1447779
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,5948841906140814486,6483114212248968445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: links.edm.saiglobal.com to https://lp.intertek.com/optoutintertekinform/intertekinform?spmailingid=29115189&spuserid=odq0nzi2ndeyndq5s0&spjobid=mjy2mdiwnju1ngs2&spreportid=mjy2mdiwnju1ngs2&spmailingid=29308509&spuserid=mtawnjc1mjgznjaxmws2&spjobid=2700863430&spreportid=mjcwmdg2mzqzmas2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/ HTTP/1.1Host: links.edm.saiglobal.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQzMAS2 HTTP/1.1Host: lp.intertek.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/jquery/jquery.min.js HTTP/1.1Host: intertek-cdn.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lp.intertek.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/bootstrap/dist/js/bootstrap.min.js HTTP/1.1Host: intertek-cdn.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lp.intertek.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/css/sai-app3.css HTTP/1.1Host: cdn.intertek.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lp.intertek.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/open-sans/bold/opensans-bold-webfont.woff HTTP/1.1Host: cdn.intertek.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://lp.intertek.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.intertek.com/mail/forms/css/sai-app3.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/open-sans/regular/opensans-regular-webfont.woff HTTP/1.1Host: cdn.intertek.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://lp.intertek.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.intertek.com/mail/forms/css/sai-app3.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/open-sans/bold/opensans-bold-webfont.ttf HTTP/1.1Host: cdn.intertek.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://lp.intertek.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.intertek.com/mail/forms/css/sai-app3.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/forms/lib/open-sans/regular/opensans-regular-webfont.ttf HTTP/1.1Host: cdn.intertek.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://lp.intertek.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.intertek.com/mail/forms/css/sai-app3.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: links.edm.saiglobal.com
Source: global traffic	DNS traffic detected: DNS query: lp.intertek.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.intertek.com
Source: global traffic	DNS traffic detected: DNS query: intertek-cdn.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: content-us-1.content-cms.com
Source: global traffic	DNS traffic detected: DNS query: www.intertekinform.com

Source: chromecache_69.2.dr, chromecache_66.2.dr	String found in binary or memory: http://ns.attribution.com/ads/1.0/
Source: chromecache_63.2.dr	String found in binary or memory: https://cdn.intertek.com/mail/forms/css/sai-app3.css
Source: chromecache_62.2.dr	String found in binary or memory: https://cdn.intertek.com/mail/forms/img/sai-logo-2x.png
Source: chromecache_62.2.dr	String found in binary or memory: https://cdn.intertek.com/mail/images/templates/saiGlobalLogo2.png
Source: chromecache_63.2.dr	String found in binary or memory: https://content-us-1.content-cms.com/f0e7afdf-4ec2-4b4d-99c2-785111521b0f/dxdam/e3/e3b68e45-0dbb-4b2
Source: chromecache_62.2.dr	String found in binary or memory: https://foxythemes.net)
Source: chromecache_70.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_70.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_70.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_63.2.dr	String found in binary or memory: https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/bootstrap/dist/js/bootstrap.min.js
Source: chromecache_63.2.dr	String found in binary or memory: https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/jquery/jquery.min.js
Source: chromecache_63.2.dr	String found in binary or memory: https://lp.intertek.com/OptoutIntertekInform/LPT.url?kn=3439086&vs=MDFiMmRiOTAtOWQxMC00NWE0LWI1YjktN
Source: chromecache_63.2.dr	String found in binary or memory: https://www.intertekinform.com/img/inform/favicon.svg

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/26@18/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,5948841906140814486,6483114212248968445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,5948841906140814486,6483114212248968445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/	0%	Virustotal		Browse
https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ns.attribution.com/ads/1.0/	0%	URL Reputation	safe
https://getbootstrap.com)	0%	Avira URL Cloud	safe
https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/bootstrap/dist/js/bootstrap.min.js	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/images/templates/saiGlobalLogo2.png	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/graphs/contributors)	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/lib/open-sans/bold/opensans-bold-webfont.ttf	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/lib/open-sans/regular/opensans-regular-webfont.woff	0%	Avira URL Cloud	safe
https://content-us-1.content-cms.com/f0e7afdf-4ec2-4b4d-99c2-785111521b0f/dxdam/e3/e3b68e45-0dbb-4b2	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/master/LICENSE)	0%	Avira URL Cloud	safe
https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/jquery/jquery.min.js	0%	Avira URL Cloud	safe
https://lp.intertek.com/OptoutIntertekInform/LPT.url?kn=3439086&vs=MDFiMmRiOTAtOWQxMC00NWE0LWI1YjktN	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/lib/open-sans/bold/opensans-bold-webfont.woff	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/css/sai-app3.css	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/lib/open-sans/regular/opensans-regular-webfont.ttf	0%	Avira URL Cloud	safe
https://cdn.intertek.com/mail/forms/img/sai-logo-2x.png	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/graphs/contributors)	0%	Virustotal		Browse
https://github.com/twbs/bootstrap/blob/master/LICENSE)	0%	Virustotal		Browse
https://www.intertekinform.com/img/inform/favicon.svg	0%	Avira URL Cloud	safe
https://foxythemes.net)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pages05.net	54.164.12.236	true	false	unknown
s3-w.us-east-1.amazonaws.com	3.5.28.105	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
f0d8d6c74e797ba1.acs5.tc	13.32.27.102	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
d1ss3r492lzkyv.cloudfront.net	18.173.205.95	true	false	unknown
lp.intertek.com	unknown	unknown	false	unknown
intertek-cdn.s3.amazonaws.com	unknown	unknown	false	unknown
www.intertekinform.com	unknown	unknown	false	unknown
cdn.intertek.com	unknown	unknown	false	unknown
content-us-1.content-cms.com	unknown	unknown	false	unknown
links.edm.saiglobal.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/bootstrap/dist/js/bootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/forms/lib/open-sans/bold/opensans-bold-webfont.ttf	false	Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/forms/lib/open-sans/regular/opensans-regular-webfont.woff	false	Avira URL Cloud: safe	unknown
https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/jquery/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://lp.intertek.com/OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQzMAS2	false		unknown
https://cdn.intertek.com/mail/forms/lib/open-sans/bold/opensans-bold-webfont.woff	false	Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/forms/css/sai-app3.css	false	Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/forms/lib/open-sans/regular/opensans-regular-webfont.ttf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_70.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/images/templates/saiGlobalLogo2.png	chromecache_62.2.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com)	chromecache_70.2.dr	false	Avira URL Cloud: safe	unknown
https://content-us-1.content-cms.com/f0e7afdf-4ec2-4b4d-99c2-785111521b0f/dxdam/e3/e3b68e45-0dbb-4b2	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_70.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ns.attribution.com/ads/1.0/	chromecache_69.2.dr, chromecache_66.2.dr	false	URL Reputation: safe	unknown
https://lp.intertek.com/OptoutIntertekInform/LPT.url?kn=3439086&vs=MDFiMmRiOTAtOWQxMC00NWE0LWI1YjktN	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.intertek.com/mail/forms/img/sai-logo-2x.png	chromecache_62.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intertekinform.com/img/inform/favicon.svg	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
https://foxythemes.net)	chromecache_62.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.27.102	f0d8d6c74e797ba1.acs5.tc	United States	7018	ATT-INTERNET4US	false
3.5.28.105	s3-w.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
54.164.12.236	pages05.net	United States	14618	AMAZON-AESUS	false
18.173.205.95	d1ss3r492lzkyv.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447779
Start date and time:	2024-05-27 02:34:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/26@18/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.186.78, 108.177.15.84, 34.104.35.123, 2.19.96.90, 2.19.96.42, 216.58.206.42, 216.58.206.74, 172.217.16.202, 142.250.185.202, 142.250.181.234, 142.250.185.170, 142.250.184.202, 142.250.185.138, 142.250.186.138, 142.250.185.106, 142.250.186.106, 142.250.184.234, 172.217.18.10, 142.250.185.74, 142.250.186.170, 142.250.185.234, 172.64.152.153, 104.18.35.103, 40.68.123.157, 199.232.210.172, 192.229.221.95, 20.3.187.198, 142.250.186.163
Excluded domains from analysis (whitelisted): content-samples.goacoustic.com.edgekey.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, www.intertekinform.com.cdn.cloudflare.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, e36377.f.akamaiedge.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://lp.intertek.com/OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQz Model: Perplexity: mixtral-8x7b-instruct	```json { "loginform": false, "reasons": [ "The text does not contain any form fields related to a username or password.", "There is no 'Log In' or 'Submit' button in the text.", "The text is related to an opt-out form for marketing communications, not a login form." ] }
inform Email Subscription Management Completing the form below will opt out you of all marketing communications from Intertek Inform. Email Address Is there a particular reason you are opting out? Email too frequent. The content isn't relevant to me. The content is too repetitive or unclear. I signed up for a one-time offer. I moved to another company, and the subject matter no longer pertains to me. I prefer to search out information on my owm I did not sign up to receive emails from SAI Global. Other Comments? Opt Out of all Marketing Communications

Input

Output

URL: https://lp.intertek.com/OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQz Model: Perplexity: mixtral-8x7b-instruct

```json
{
  "loginform": false,
  "reasons": [
    "The text does not contain any form fields related to a username or password.",
    "There is no 'Log In' or 'Submit' button in the text.",
    "The text is related to an opt-out form for marketing communications, not a login form."
  ]
}

inform Email Subscription Management Completing the form below will opt out you of all marketing communications from Intertek Inform. Email Address Is there a particular reason you are opting out? Email too frequent. The content isn't relevant to me. The content is too repetitive or unclear. I signed up for a one-time offer. I moved to another company, and the subject matter no longer pertains to me. I prefer to search out information on my owm I did not sign up to receive emails from SAI Global. Other Comments? Opt Out of all Marketing Communications

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 23:35:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9748346136131896
Encrypted:	false
SSDEEP:	48:8TudWTSepHKWidAKZdA19ehwiZUklqehJy+3:8Hj3Cy
MD5:	706E5197639EDF682886E583CB42D792
SHA1:	C9F8681DA32922EF53874C68EBC3AFD2244AA7AD
SHA-256:	D7A7ABD8DD4B7B20D452E9A809710C03CC48C05E98C1734BC0E79F3E40CA1C4B
SHA-512:	1F488550F26C4B073B3C7A8FA4DD48722FF26EF88B034887AC453CC6E4709FAAA10545251A177A5418ECD4D1EFE2000EC06609FD77DB6A3C643876F004544922
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...... ....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xw............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 23:35:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9906918709517716
Encrypted:	false
SSDEEP:	48:8XudWTSepHKWidAKZdA1weh/iZUkAQkqehyy+2:8rj99Qjy
MD5:	611356E2583853F46A60ACD1FD74953D
SHA1:	4B894A75D6739A397F300DF57A04185C2E536C56
SHA-256:	E4F1B32C8BA1279D551D67A3D529CF212C6C95A036F6B04452FC60044ED423FA
SHA-512:	67F723535BA159C901A2937C4B8E1602F991D7E86A0C9AFBA21947AC636396CE3B1B5ADB5AF9949F351395D9AAABA255140D6398BCD9B0BD3D474206B2BC719D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Q8.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xw............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0008490414333835
Encrypted:	false
SSDEEP:	48:8xHdWTSesHKWidAKZdA14tseh7sFiZUkmgqeh7sky+BX:8x8jynmy
MD5:	6FEC979E08C975821CD6CF3776F202F7
SHA1:	D3346E46C04A32392AF151F305E68C6D41244CD5
SHA-256:	61D0EC5019AAD23446FAB3A098657BAA7037E05E4BF859F8EBB69BE3655E3F3A
SHA-512:	FEE48D82BC55A8F6492D0A63F856715A7A9048BBACCB5BC023EFB20492FE098901231D32B8070C1BE03045DA8A11C282A4F5F8D7B3D0E0929056BF1C521500AF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 23:35:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9878399215345923
Encrypted:	false
SSDEEP:	48:8CvudWTSepHKWidAKZdA1vehDiZUkwqeh+y+R:8CDj+8y
MD5:	007E91AF05CBACCD6010B7937A8E4069
SHA1:	1D228493861E6FCE5A19074D4E88656D4B17EB9D
SHA-256:	98115E27F772390D75EFC7C6B418B1E1407E67E186596F22750C1A0671B03754
SHA-512:	767DFD4ED97F617A3F5D372DEC10D40634745C5ED6662BAD5BC94254DBF8517EB87AAA131BD26D098364BF90B3E3995FE9947C65085BCAA5969CD80768A75CDF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....n.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xw............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 23:35:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981657660061662
Encrypted:	false
SSDEEP:	48:8ludWTSepHKWidAKZdA1hehBiZUk1W1qeh4y+C:8djO9Yy
MD5:	B48F5436749044CD3F15D7E89079C265
SHA1:	709C56B5838C9A398576BCA17A7B9F41E7CF605C
SHA-256:	3FD4901DFBC8BB92B0CA6C2938201D78BA38E6604FD402C7531C37AF8AE987C1
SHA-512:	3D686CF8390FDD96A653B860C78901D0F64EB6DB5D65E2935E30894F12EA9D74A8EBF6E95817CB02F0802B5B0815D9953B03DCDB5FA1E27E44D19E25011CAFFB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....!.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xw............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 23:35:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.990175639577999
Encrypted:	false
SSDEEP:	48:8BudWTSepHKWidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8pjwT/TbxWOvTbmy7T
MD5:	9AF3AAF14792E37D935E87D1CE8639EC
SHA1:	7975299ACFBB55A8910482166913306FAC69B839
SHA-256:	54A602007E1A146E40C05C0D0EC146D36776A34AE23A56D1FDF31A16BE41C04A
SHA-512:	8CA0ACA289F54CEBEF8142DEBEBA1D6583EBF81495164BD3ABAF056D92C3BF42006A4311DC07B710025A569D733449C009723C601DA2DBAF6E558287AB73EE27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xt.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xt.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xt.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xt............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xw............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H6.5.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	506831
Entropy (8bit):	4.908940282738219
Encrypted:	false
SSDEEP:	6144:U/WRE5DB4ID/4ivoT2Hv4VerKt2D0B7G/uwQceoH:LYvoaQceoH
MD5:	BB4B2061274C4B26A719CBC0490229C4
SHA1:	578C802D4F7244A2DEC568D06997D15A1C319D7B
SHA-256:	2071FA098C040D2A7D7CA5270E94892150783E6CB70E47B8FC68B6684B39ECB6
SHA-512:	A527C0615047C59CF87CCD456CD7527D3FC3D1881BFD1D4779E4838FE64804E65BD958EA5600FCB371DE9FD80F679043C18384A2113BCA977019FF0BE4BC6A03
Malicious:	false
Reputation:	low
URL:	https://cdn.intertek.com/mail/forms/css/sai-app3.css
Preview:	/!. maisonnette-admin v0.0.1 (https://foxythemes.net). * Copyright 2018 Foxy Themes all rights reserved. /..@charset "UTF-8";.@media print {. ,. ::before,. ::after {. text-shadow: none !important;. -webkit-box-shadow: none !important;. box-shadow: none !important; }. a:not(.btn) {. text-decoration: underline; }. abbr[title]::after {. content: " (" attr(title) ")"; }. pre {. white-space: pre-wrap !important; }. pre,. blockquote {. border: 1px solid #999;. page-break-inside: avoid; }. thead {. display: table-header-group; }. tr,. img {. page-break-inside: avoid; }. p,. h2,. h3 {. orphans: 3;. widows: 3; }. h2,. h3 {. page-break-after: avoid; }. @page {. size: a3; }. body {. min-width: 992px !important; }. .container {. min-width: 992px !important; }. .navbar {. display: none; }. .badge {. border: 1px solid #000; }. .table {. border-collapse: collapse !important; }. .table td,. .table th {.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (4823)
Category:	downloaded
Size (bytes):	5808
Entropy (8bit):	4.721573826816257
Encrypted:	false
SSDEEP:	96:je4torLh5A3rfjoKQoPvQ/WWYNM1ramNM1rrpNM1rQ5ngNM1rA+NM1rL1uENM1rw:y4aLsrfjojoP8WWgMVaqMVrjMVeIMVAX
MD5:	A3B83B35E8A73EFC1914EBD1FEF76C9C
SHA1:	13BCBB0C0B732335CC98749B7A301D6B8EEE8341
SHA-256:	6133466E1343FE0F972F00CAAE958D6F94C360A4FE5E27096EDB7D12534717CF
SHA-512:	C51CA372018CB96C718CCD8A7AB1DF80F6CEA86B7353DE83267B5C44FE5F2536365B8BEB3F71E8836BD92F7CC482FA493A7BD26203EFF59656681C0946FC94CE
Malicious:	false
Reputation:	low
URL:	https://lp.intertek.com/OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQzMAS2
Preview:	<!DOCTYPE html>.<html lang="en"><head> <link rel="shortcut icon" href="https://www.intertekinform.com/img/inform/favicon.svg" type="image/vnd.microsoft.icon" /> <title>Optout Intertek Inform</title> <link rel="stylesheet" href="https://cdn.intertek.com/mail/forms/css/sai-app3.css" type="text/css" /> <style type="text/css">. .mai-top-header .navbar-brand {. line-height: 41px !important; height: 41px !important; width: 200px !important;. background-image: url("https://content-us-1.content-cms.com/f0e7afdf-4ec2-4b4d-99c2-785111521b0f/dxdam/e3/e3b68e45-0dbb-4b26-b83e-bba96e651c4f/Inform_logo_Small.png") !important;. background-size: 200px 41px !important;. }. @media (max-width: 767.98px) {. .mai-top-header {. background-color: #FFFFFF !important;. }.. .mai-top-header .navbar-brand {. display: block !important;. }.. .mai-top-header>.container {. padding: 0 0 0 20px !important;. }. }. </style>

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32058)
Category:	downloaded
Size (bytes):	86659
Entropy (8bit):	5.36781915816204
Encrypted:	false
SSDEEP:	1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
MD5:	C9F5AEECA3AD37BF2AA006139B935F0A
SHA1:	1055018C28AB41087EF9CCEFE411606893DABEA2
SHA-256:	87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
SHA-512:	DCFF2B5C2B8625D3593A7531FF4DDCD633939CC9F7ACFEB79C18A9E6038FDAA99487960075502F159D44F902D965B0B5AED32B41BFA66A1DC07D85B5D5152B58
Malicious:	false
Reputation:	low
URL:	https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/jquery/jquery.min.js
Preview:	/! jQuery v3.2.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 63564, version 1.0
Category:	downloaded
Size (bytes):	3499
Entropy (8bit):	7.698521536885436
Encrypted:	false
SSDEEP:	48:RLUSfx2KoksWb6l/ag9I9fM71kxZHYYrq6Tnq0D4Ntm0T/siVfBHvW5pgKPzR8:BUSQksoEWE784YrZTnq0cu9ePmpje
MD5:	FEE8546F36642C3B218A43BED2845933
SHA1:	D59876D293E5C5F163DDD3125D7F06040CDFCF36
SHA-256:	A595B0438863169E76EB6E12AD54F9FE6CFD91BCC238F427629AF9515EC27212
SHA-512:	F9A3D15DD0BCB0F0BB8070DD50C8AB29A530D4B93E0FA20EF1B42093B909FC44773EF6531CFD3A37C678D77CA730D476F0CD625617B8DA95558D1809F27CE30D
Malicious:	false
Reputation:	low
URL:	https://cdn.intertek.com/mail/forms/lib/open-sans/bold/opensans-bold-webfont.woff
Preview:	wOFF.......L.......h........................FFTM............]./oGDEF........... ....GPOS....... ... l.t.GSUB............H...OS/2.......`...`.m.%cmap......."...~...cvt ...4.........3.$fpgm...d.......e../.gasp................glyf... ......i..f.head.......4...6...hhea...0...!...$.).\hmtx...T........2i.]loca...p...7...d..W.maxp...... ... ....name............$1@<post...........p..$Kprep.......t.....0._.........o1.....B..........x.c`d``..b...`b..7.I.0.....................latn................x.]RMk.Q.=oN.4..@....qQ.(.*d..R.L.)]...L.e&F.~jm......~.U.M.K....R. ""...Bz..(.s..~.;.....\|.rK~....;..H_v.@......6..FDTQ.../b...J.w..q\r+W].V.=tC.Wr}.=.\|.F./.,x....wL.V...vA...6s.._..O.a..].F/2.....F1...<....?..-...7.>l.J...JI..B\|.w\|.m.H<.A\|.>..U..Hp....4g8...9..<....\|.G\|.g\|....@.....x....'~.7...y.....5a5.?..sE.+..i..\.:7..W\|.7...Z\. )J.:.[..d.....M]K..=.G.....E\....$N.x.H....O..P...g.......9.y[f..a.p..$.aU0G_0k&....`...............3.......3.....f..................@. [...(..

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 82, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11638
Entropy (8bit):	7.89051005162564
Encrypted:	false
SSDEEP:	192:P8DQoNLgd8ram+1pVOnO7PgKVZdcbEflk2s3XmJsoAoCbkQrwNaHKw0jHQBjg9hn:PIDNPpMlpscJHCbkvwKw0bh9Wa9lAs
MD5:	15D40D1C72AA72B87514A64159A7E019
SHA1:	C4B476362AE1CDC7DA618F2259837E7927B48A94
SHA-256:	E86F7F1E93CC0E312DE5B8EA4648ED48DD22880AC0D569B751CF5A6314A1B8BC
SHA-512:	79357FE34A79B0D2E8980E2AB2443F2F9ED72CE49C3588D6F9CCC19BC2C015D4EED7081D08217EE6238E8B8CE186A85973CD65F9CE6A0FD32D1469516C456B3C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......R.....z......pHYs..........+.....:tEXtComment.xr:d:DAF1U5iFHxs:4,j:330299150333217965,t:23112703........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x='adobe:ns:meta/'>. <rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>.. <rdf:Description rdf:about=''. xmlns:dc='http://purl.org/dc/elements/1.1/'>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang='x-default'>Inform_logo_Small - 1</rdf:li>. </rdf:Alt>. </dc:title>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:Attrib='http://ns.attribution.com/ads/1.0/'>. <Attrib:Ads>. <rdf:Seq>. <rdf:li rdf:parseType='Resource'>. <Attrib:Created>2023-11-27</Attrib:Created>. <Attrib:ExtId>486ca9cb-d9c0-4d94-ab39-845ca26be07d</Attrib:ExtId>. <Attrib:FbId>525265914179580</Attrib:FbId>. <Attrib:TouchType>2</Attrib:TouchType>. </rdf:li>. </rdf:Seq>. </Attrib:Ads>. </

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.137537511266052
Encrypted:	false
SSDEEP:	3:QQinPy7CR:+Py0
MD5:	61889B5ACB59A53F8006002E010F854F
SHA1:	4A93211DC8369A6886C2CC08B601C47DADD01E7F
SHA-256:	BCC1818CC312D269BF4CAB598823F842EAA9DDEACFFCBFD71BB377A200BBC38C
SHA-512:	0D037C7FD9C49B566B6B95578246665D0A5F9A3D46FD552A5781B999A8775A2163163FB771BDDF0A71EB9E6EDB434D5BCE013199299189EBDF4BBF33780CE9E8
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwn7TjeNxN7IwRIFDXhvEhkSBQ1cHqX1?alt=proto
Preview:	ChIKBw14bxIZGgAKBw1cHqX1GgA=

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	4.1806786181867786
Encrypted:	false
SSDEEP:	48:6j5hjPZ6oBufEBhgve9bnMDVmiXGy6KR0oHxHKWkgy:05hFB4myuQVL2y61Auv
MD5:	A9E0936A7535B5B79A2955EB41E768F1
SHA1:	D2E595CFDE343D84C9D2AA68AF8BE5D7F224CEC8
SHA-256:	58A5F4405609CE4AE489FD2357069271CF6BE712740995935B2F8646218C591A
SHA-512:	CCD99F906C8B6F0BE9CDF7F8EB5FF87BA7AA7614101A124F90DCB554E25A5C4C8CD6121E0DE96BA63045D3F7E525C00B81A4E646867ECFF9A5F901E8CBEE8060
Malicious:	false
Reputation:	low
Preview:	<svg width="400" height="400" version="1.1" xmlns="http://www.w3.org/2000/svg">. <path d="m197.79 10.12c-42.58 0.494-85.231 15.211-120.23 44.813-38.878 32.897-62.43 78.885-66.916 129.35-4.1119 50.467 11.591 99.808 44.115 138.31 37.757 44.485 91.585 67.294 145.42 67.294 43.364 6e-5 86.727-14.586 122.61-44.492 5.6073-4.8597 6.3605-13.452 1.5006-19.433-4.8599-5.6074-13.459-6.3608-19.066-1.501-68.785 57.943-171.59 49.351-229.53-19.433-28.037-32.897-41.505-75.137-37.766-118.5 3.7382-43.364 23.929-82.627 57.2-110.66 68.411-57.943 171.22-49.34 229.16 19.445 38.131 45.233 48.969 107.67 27.661 162.99-2.6171 7.1027 1.124 14.949 8.2267 17.565 6.729 2.6168 14.574-0.74617 17.565-7.8489 24.299-64.672 11.968-137.57-32.518-190.65-38.061-44.999-92.687-67.883-147.43-67.248zm-58.54 127.44c-8.5975 0-14.208 5.9725-14.208 14.197v87.85c0 19.813 16.079 35.887 36.266 35.887 19.065 0 34.766-14.954 35.887-34.019v-46.727c0-18.691 12.707-30.651 30.651-30.651s30.651 11.959 30.651 30.651v66.549c0 7.8504 5.2359 14.19

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 82, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11638
Entropy (8bit):	7.89051005162564
Encrypted:	false
SSDEEP:	192:P8DQoNLgd8ram+1pVOnO7PgKVZdcbEflk2s3XmJsoAoCbkQrwNaHKw0jHQBjg9hn:PIDNPpMlpscJHCbkvwKw0bh9Wa9lAs
MD5:	15D40D1C72AA72B87514A64159A7E019
SHA1:	C4B476362AE1CDC7DA618F2259837E7927B48A94
SHA-256:	E86F7F1E93CC0E312DE5B8EA4648ED48DD22880AC0D569B751CF5A6314A1B8BC
SHA-512:	79357FE34A79B0D2E8980E2AB2443F2F9ED72CE49C3588D6F9CCC19BC2C015D4EED7081D08217EE6238E8B8CE186A85973CD65F9CE6A0FD32D1469516C456B3C
Malicious:	false
Reputation:	low
URL:	https://content-us-1.content-cms.com/f0e7afdf-4ec2-4b4d-99c2-785111521b0f/dxdam/e3/e3b68e45-0dbb-4b26-b83e-bba96e651c4f/Inform_logo_Small.png
Preview:	.PNG........IHDR.......R.....z......pHYs..........+.....:tEXtComment.xr:d:DAF1U5iFHxs:4,j:330299150333217965,t:23112703........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x='adobe:ns:meta/'>. <rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>.. <rdf:Description rdf:about=''. xmlns:dc='http://purl.org/dc/elements/1.1/'>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang='x-default'>Inform_logo_Small - 1</rdf:li>. </rdf:Alt>. </dc:title>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:Attrib='http://ns.attribution.com/ads/1.0/'>. <Attrib:Ads>. <rdf:Seq>. <rdf:li rdf:parseType='Resource'>. <Attrib:Created>2023-11-27</Attrib:Created>. <Attrib:ExtId>486ca9cb-d9c0-4d94-ab39-845ca26be07d</Attrib:ExtId>. <Attrib:FbId>525265914179580</Attrib:FbId>. <Attrib:TouchType>2</Attrib:TouchType>. </rdf:li>. </rdf:Seq>. </Attrib:Ads>. </

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	low
URL:	https://intertek-cdn.s3.amazonaws.com/mail/forms/lib/bootstrap/dist/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 63712, version 1.0
Category:	downloaded
Size (bytes):	3499
Entropy (8bit):	7.723240412217197
Encrypted:	false
SSDEEP:	96:FSlwsoEOzR784YrZTnq0+CuahPiD38WK0a9IBU:FkwsoTl7Mr9nqFaRiD3IIBU
MD5:	FC68027BFD256D39B6B3642792E2DC7B
SHA1:	CECB962921D68E5052ABAD6B104E699899EF928E
SHA-256:	4DEA34F8DEFAACC5B7EEB1B6609CC71BE83A5D5B6B0B28B2CFCE9878B2B4DBB4
SHA-512:	B905952FED379E5168C21F245B5835B8E99F3CBDAEB87F239201FC63014CAA331E682740020A9C87410C793A1096A3E2B5CC4C686F8A303B6981D2C83894F183
Malicious:	false
Reputation:	low
URL:	https://cdn.intertek.com/mail/forms/lib/open-sans/regular/opensans-regular-webfont.woff
Preview:	wOFF........................................FFTM............].F~GDEF........... ....GPOS....... ... l.t.GSUB............H...OS/2......._...`.6..cmap......."...~...cvt ...4...D...D...Jfpgm...x.......e../.gasp...,............glyf...4......Z.h9K.head.......3...6.\|.Phhea...D...!...$...}hmtx...h...9.....R>.loca......3...dw..maxp....... ... ....name............%8@Qpost...........p..$Kprep...........\|.`.,.........o1.....51.........x.c`d``..b...`b..7.I.0.....................latn................x.]RMk.Q.=oN.4..@....qQ.(.d..R.L.)]...L.e&F.~jm......~.U.M.K....R. ""...Bz..(.s..~.;.....\|.rK~....;..H_v.@......6..FDTQ.../b...J.w..q\r+W].V.=tC.Wr}.=.\|.F./.,x....wL.V...vA...6s.._..O.a..].F/2.....F1...<....?..-...7.>l.J...JI..B\|.w\|.m.H<.A\|.>..U..Hp....4g8...9..<....\|.G\|.g\|....@.....x....'~.7...y.....5a5.?..sE.+..i..\.:7..W\|.7...Z\. )J.:.[..d.....M]K..=.G.....E\....$N.x.H....O..P...g.......9.y[f..a.p..$.aU0G_0k&....`..x.c`f9.8.....u..1...<.f....................{...h.... f0

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1665
Entropy (8bit):	4.1806786181867786
Encrypted:	false
SSDEEP:	48:6j5hjPZ6oBufEBhgve9bnMDVmiXGy6KR0oHxHKWkgy:05hFB4myuQVL2y61Auv
MD5:	A9E0936A7535B5B79A2955EB41E768F1
SHA1:	D2E595CFDE343D84C9D2AA68AF8BE5D7F224CEC8
SHA-256:	58A5F4405609CE4AE489FD2357069271CF6BE712740995935B2F8646218C591A
SHA-512:	CCD99F906C8B6F0BE9CDF7F8EB5FF87BA7AA7614101A124F90DCB554E25A5C4C8CD6121E0DE96BA63045D3F7E525C00B81A4E646867ECFF9A5F901E8CBEE8060
Malicious:	false
Reputation:	low
URL:	https://www.intertekinform.com/img/inform/favicon.svg
Preview:	<svg width="400" height="400" version="1.1" xmlns="http://www.w3.org/2000/svg">. <path d="m197.79 10.12c-42.58 0.494-85.231 15.211-120.23 44.813-38.878 32.897-62.43 78.885-66.916 129.35-4.1119 50.467 11.591 99.808 44.115 138.31 37.757 44.485 91.585 67.294 145.42 67.294 43.364 6e-5 86.727-14.586 122.61-44.492 5.6073-4.8597 6.3605-13.452 1.5006-19.433-4.8599-5.6074-13.459-6.3608-19.066-1.501-68.785 57.943-171.59 49.351-229.53-19.433-28.037-32.897-41.505-75.137-37.766-118.5 3.7382-43.364 23.929-82.627 57.2-110.66 68.411-57.943 171.22-49.34 229.16 19.445 38.131 45.233 48.969 107.67 27.661 162.99-2.6171 7.1027 1.124 14.949 8.2267 17.565 6.729 2.6168 14.574-0.74617 17.565-7.8489 24.299-64.672 11.968-137.57-32.518-190.65-38.061-44.999-92.687-67.883-147.43-67.248zm-58.54 127.44c-8.5975 0-14.208 5.9725-14.208 14.197v87.85c0 19.813 16.079 35.887 36.266 35.887 19.065 0 34.766-14.954 35.887-34.019v-46.727c0-18.691 12.707-30.651 30.651-30.651s30.651 11.959 30.651 30.651v66.549c0 7.8504 5.2359 14.19

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 02:35:39.039443016 CEST	49675	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:39.039443016 CEST	49674	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:39.133198977 CEST	49673	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:46.154212952 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.154251099 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.154346943 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.154726982 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.154736042 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.154792070 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.155014038 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.155038118 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.155158043 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.155174017 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.897439957 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.897814989 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.897847891 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.899538994 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.899624109 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.900645018 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.900738955 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.900857925 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.900867939 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.940247059 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.962973118 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.963466883 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.963495016 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.967401981 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:46.967493057 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.968043089 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:46.968219995 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:47.022134066 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:47.022144079 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:35:47.074925900 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:47.359237909 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:47.363641977 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:47.363707066 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:47.374155045 CEST	49709	443	192.168.2.5	13.32.27.102
May 27, 2024 02:35:47.374176025 CEST	443	49709	13.32.27.102	192.168.2.5
May 27, 2024 02:35:47.597146988 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:47.597209930 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:47.597280979 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:47.598834991 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:47.598854065 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.025592089 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.025633097 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.025695086 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.026530027 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.026547909 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.295725107 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.296073914 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.296103001 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.297732115 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.297836065 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.641341925 CEST	49675	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:48.641341925 CEST	49674	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:48.659449100 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.659583092 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.659614086 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.659869909 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.686034918 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.686719894 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.686748981 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.688272953 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.688441992 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.690395117 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.690511942 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.707758904 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.707788944 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.735827923 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.735833883 CEST	49673	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:48.735855103 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:48.751229048 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.783054113 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:48.853342056 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.853395939 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.853414059 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.853580952 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.853580952 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.853612900 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.853702068 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.953753948 CEST	49713	443	192.168.2.5	54.164.12.236
May 27, 2024 02:35:48.953829050 CEST	443	49713	54.164.12.236	192.168.2.5
May 27, 2024 02:35:48.999010086 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:48.999052048 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:48.999130011 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:48.999594927 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:48.999614954 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.007126093 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.007174969 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.007471085 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.007488966 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.007515907 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.007569075 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.008078098 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.008106947 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.008415937 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.008438110 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.085772038 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.085802078 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.086033106 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.088207960 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.088219881 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.594701052 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.599893093 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.599941969 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.601092100 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.601182938 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.603470087 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.603547096 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.603780031 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.603794098 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.627057076 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.627334118 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.627355099 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.630903959 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.630984068 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.631550074 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.631720066 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.632044077 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.632056952 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.647314072 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.677010059 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.746690989 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.747242928 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.747308969 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.748785019 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.748975039 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.750653982 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.750775099 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.750822067 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.759392023 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.759463072 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.771598101 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.771612883 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.772531033 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.794569969 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.802311897 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.802371979 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:49.817410946 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.833380938 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.843658924 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.847261906 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:49.854690075 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.854712963 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.854758024 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.854756117 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.854788065 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.854794979 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.854815960 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.854840994 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.861136913 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:49.865420103 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.865447998 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.865473032 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.865489960 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.865518093 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.865550995 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.865569115 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.865601063 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.906500101 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:49.911788940 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.931057930 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.931128979 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.931162119 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.931180000 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.931204081 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.931221962 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.931235075 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.943861008 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.943882942 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.943919897 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.943931103 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.943958998 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.943968058 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.943989038 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.944013119 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.944031000 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.944041967 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.952178955 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.952272892 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.952287912 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.952344894 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.954677105 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.954727888 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.954757929 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.954811096 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.954840899 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957043886 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.957099915 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957125902 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957135916 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.957180977 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.957237959 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957292080 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957324982 CEST	443	49716	3.5.28.105	192.168.2.5
May 27, 2024 02:35:49.957348108 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:49.957762957 CEST	49716	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.006903887 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.006942987 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011495113 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011537075 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011579037 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.011584997 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011615992 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011642933 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.011645079 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.011662960 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.013319016 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.013396978 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.013411999 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.016655922 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.016729116 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.016747952 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.016763926 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.016803026 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.023670912 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.023756027 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.023768902 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.023821115 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.023842096 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.023895979 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.023999929 CEST	49717	443	192.168.2.5	3.5.28.105
May 27, 2024 02:35:50.024019957 CEST	443	49717	3.5.28.105	192.168.2.5
May 27, 2024 02:35:50.056408882 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.056477070 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.056588888 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.056663990 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.056679010 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.056695938 CEST	49718	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.056700945 CEST	443	49718	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.090667963 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.090691090 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.090756893 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.091099977 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.091109991 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.467303991 CEST	443	49703	23.1.237.91	192.168.2.5
May 27, 2024 02:35:50.467403889 CEST	49703	443	192.168.2.5	23.1.237.91
May 27, 2024 02:35:50.476059914 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476150036 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476171017 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476187944 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476227999 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476247072 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476372957 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.476372957 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.476372957 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.476373911 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.476450920 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.476521969 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.553533077 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.553728104 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.555670977 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.565958023 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.566011906 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.566154957 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.566155910 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.566220999 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.566277027 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.640330076 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.640614986 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.654113054 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.654298067 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.654418945 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.654479027 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.654572010 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.654902935 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.656613111 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.657010078 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.669280052 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.669431925 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.669538021 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.669604063 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.669657946 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.725425005 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.727335930 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.727541924 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.746710062 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.746731997 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.746857882 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.746900082 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.746900082 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.746972084 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.747020960 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.747571945 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.761569023 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.761754036 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.761837006 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.761837959 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.761900902 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.762006998 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.801855087 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.802158117 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.806992054 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.807001114 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.807348967 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.808903933 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:50.814356089 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.814766884 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.836246967 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.836296082 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.836405993 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.836466074 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.836513042 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.837064028 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.849834919 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.849855900 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.850075006 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.850075006 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.850140095 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.850439072 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.850579977 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:50.858930111 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.859402895 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.920452118 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.920851946 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.920943022 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.934041023 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.934082031 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.934231997 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.934232950 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.934297085 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.939347029 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.939604998 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:50.939665079 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:50.986040115 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.015228033 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.015297890 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.015459061 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.015530109 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.015578032 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.015942097 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.026238918 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.026396036 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.026587963 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.026654959 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.026700974 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.027551889 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.092005014 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.092506886 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.095439911 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:51.095592976 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:51.096167088 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:51.097503901 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:51.097503901 CEST	49719	443	192.168.2.5	184.28.90.27
May 27, 2024 02:35:51.097522020 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:51.097532034 CEST	443	49719	184.28.90.27	192.168.2.5
May 27, 2024 02:35:51.103367090 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.103384972 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.103940964 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.104042053 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.106842041 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.108464003 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.114995003 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.115010023 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.115226030 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.115291119 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.159300089 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.178577900 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.187776089 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.187834978 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.187953949 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.188019037 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.188102007 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.188195944 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.196712971 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.196737051 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.196927071 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.196988106 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.202961922 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.263987064 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.264004946 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.264462948 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.264525890 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.264652014 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.283277035 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.283293009 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.283447981 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.283515930 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.283735037 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.283858061 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.293037891 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.293080091 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.293239117 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.293239117 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.293304920 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.293592930 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.325042009 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.325057983 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.325298071 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.325361013 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.325719118 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.363080978 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.371239901 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.371253014 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.371520996 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.371584892 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.371673107 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.402568102 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.402627945 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.402695894 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.402704000 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.402761936 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.402815104 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.402815104 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.458434105 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.460819006 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.460884094 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.461040020 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.461040974 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.461105108 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.461385965 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.462284088 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.471858025 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.471899986 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.471955061 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.472027063 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.472070932 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.475008011 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.475231886 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.475292921 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.475485086 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.483874083 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.483915091 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.484098911 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.484168053 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.484210968 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.484306097 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.486866951 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.538780928 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.551433086 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.551449060 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.551491976 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.551575899 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.551652908 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.551652908 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.551721096 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.551769972 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.557111979 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.557151079 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.557295084 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.557296038 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.557359934 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.561882973 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.561922073 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.562160015 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.562225103 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.562382936 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.566687107 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.566781998 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.566840887 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.619033098 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.640728951 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.640739918 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.640863895 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.640906096 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.641060114 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.641060114 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.641124010 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.641181946 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.647866964 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.647913933 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.647963047 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.648042917 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.648044109 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.648044109 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.655996084 CEST	49715	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.656058073 CEST	443	49715	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.848835945 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.848893881 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.848957062 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.850596905 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.850634098 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.895617008 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.895699978 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:51.895773888 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.896634102 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:51.896670103 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.675846100 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.676167965 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.676229000 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.677740097 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.677814007 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.678725004 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.678811073 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.678858995 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.722381115 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.722400904 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.727567911 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.727817059 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.727826118 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.728701115 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.728760004 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.729059935 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.729113102 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.729193926 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.768235922 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.774494886 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.783008099 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:52.783067942 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:52.830284119 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.453732014 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453793049 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453813076 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453833103 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453846931 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.453874111 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453893900 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.453896999 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453967094 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453984976 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.453994036 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.454010963 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.454015017 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.454030037 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.455862045 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.455883980 CEST	443	49721	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.455894947 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.455938101 CEST	49721	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.461474895 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.461508036 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.461604118 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.462064981 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.462079048 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517479897 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517509937 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517530918 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517541885 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517549038 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.517560005 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517573118 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517589092 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.517606020 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.517607927 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.517641068 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.518918037 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.518954039 CEST	443	49722	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.519069910 CEST	49722	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.523165941 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.523180962 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:53.523341894 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.523497105 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:53.523509979 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.227204084 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.239691973 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.239710093 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.240622997 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.240983009 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.240983009 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.241039991 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.241358042 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.241374969 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.254403114 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.259475946 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.259484053 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.259777069 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.264231920 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.264231920 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.264287949 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:54.285577059 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:54.318572998 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.008421898 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.012943983 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.013011932 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.013021946 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.013062000 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.035023928 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.054972887 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.054981947 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.054997921 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.055003881 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.055007935 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.055036068 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.055054903 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.055085897 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.055108070 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.059773922 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.059916973 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.106992960 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.107002974 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.107023954 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.107029915 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.107184887 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.107184887 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.151633024 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.151648998 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.151778936 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.151793003 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.151843071 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.177515030 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.177529097 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.177623034 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.177629948 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.177671909 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.189313889 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.189321995 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.189342976 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.189393044 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.189403057 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.189469099 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.204127073 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.204236984 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.204246998 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.218295097 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.218327045 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.218374968 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.218384027 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.218432903 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.226516008 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.226600885 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.226605892 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.243897915 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.243952990 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.256553888 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.256566048 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.256638050 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.256645918 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.280606031 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.280622005 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.280672073 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.280694962 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.280700922 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.280735016 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.296437025 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.300740957 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.300750017 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.300770044 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.300806046 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.300815105 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.300851107 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.320126057 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.320132971 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.320153952 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.320188046 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.320195913 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.320228100 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.320238113 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.323854923 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.323924065 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.323930979 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.323967934 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.327044010 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.327069044 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.327105999 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.327112913 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.327151060 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.337713003 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.337726116 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.337799072 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.337806940 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.347462893 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.347513914 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.347528934 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.347562075 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.559564114 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.559679985 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.584260941 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.584285975 CEST	443	49725	18.173.205.95	192.168.2.5
May 27, 2024 02:35:55.584300041 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.584336996 CEST	49725	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.597568989 CEST	49726	443	192.168.2.5	18.173.205.95
May 27, 2024 02:35:55.597583055 CEST	443	49726	18.173.205.95	192.168.2.5
May 27, 2024 02:35:58.602288008 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:58.602452040 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:35:58.606547117 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:59.595477104 CEST	49714	443	192.168.2.5	172.217.18.4
May 27, 2024 02:35:59.595515966 CEST	443	49714	172.217.18.4	192.168.2.5
May 27, 2024 02:36:16.722584963 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:36:16.722790003 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:36:16.722846031 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:36:18.791419029 CEST	49710	443	192.168.2.5	13.32.27.102
May 27, 2024 02:36:18.791454077 CEST	443	49710	13.32.27.102	192.168.2.5
May 27, 2024 02:36:48.066267967 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:48.066307068 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.066426992 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:48.066669941 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:48.066680908 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.711865902 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.712202072 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:48.712219954 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.712670088 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.714287996 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:48.714368105 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:48.767601967 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:36:58.609504938 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:58.609586954 CEST	443	49738	172.217.18.4	192.168.2.5
May 27, 2024 02:36:58.609752893 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:37:00.539345980 CEST	49738	443	192.168.2.5	172.217.18.4
May 27, 2024 02:37:00.539371967 CEST	443	49738	172.217.18.4	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 02:35:43.980925083 CEST	53	63788	1.1.1.1	192.168.2.5
May 27, 2024 02:35:44.016793013 CEST	53	52901	1.1.1.1	192.168.2.5
May 27, 2024 02:35:45.115626097 CEST	53	58765	1.1.1.1	192.168.2.5
May 27, 2024 02:35:45.765218973 CEST	55744	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:45.765400887 CEST	52483	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:46.102025032 CEST	53	55744	1.1.1.1	192.168.2.5
May 27, 2024 02:35:47.381273985 CEST	59330	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:47.381966114 CEST	64850	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:47.557236910 CEST	53	59330	1.1.1.1	192.168.2.5
May 27, 2024 02:35:47.603458881 CEST	53	64850	1.1.1.1	192.168.2.5
May 27, 2024 02:35:47.905066013 CEST	53	52483	1.1.1.1	192.168.2.5
May 27, 2024 02:35:48.010430098 CEST	52141	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.010895967 CEST	57371	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.017880917 CEST	53	52141	1.1.1.1	192.168.2.5
May 27, 2024 02:35:48.024504900 CEST	53	57371	1.1.1.1	192.168.2.5
May 27, 2024 02:35:48.964251995 CEST	56106	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.964401007 CEST	57001	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.967189074 CEST	49408	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.967575073 CEST	62223	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:48.984853983 CEST	53	56106	1.1.1.1	192.168.2.5
May 27, 2024 02:35:48.998351097 CEST	53	57001	1.1.1.1	192.168.2.5
May 27, 2024 02:35:49.005812883 CEST	53	62223	1.1.1.1	192.168.2.5
May 27, 2024 02:35:49.005863905 CEST	53	49408	1.1.1.1	192.168.2.5
May 27, 2024 02:35:51.729167938 CEST	62631	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:51.729527950 CEST	52898	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:51.959594011 CEST	53	61291	1.1.1.1	192.168.2.5
May 27, 2024 02:35:52.882267952 CEST	50116	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:52.882366896 CEST	60360	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:56.419384956 CEST	57495	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:56.419769049 CEST	53973	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:57.437026024 CEST	64997	53	192.168.2.5	1.1.1.1
May 27, 2024 02:35:57.437485933 CEST	53183	53	192.168.2.5	1.1.1.1
May 27, 2024 02:36:02.263444901 CEST	53	63593	1.1.1.1	192.168.2.5
May 27, 2024 02:36:21.126396894 CEST	53	52669	1.1.1.1	192.168.2.5
May 27, 2024 02:36:43.806344032 CEST	53	58225	1.1.1.1	192.168.2.5
May 27, 2024 02:36:43.834799051 CEST	53	62538	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 27, 2024 02:35:44.016848087 CEST	192.168.2.5	1.1.1.1	c234	(Port unreachable)	Destination Unreachable
May 27, 2024 02:35:47.603709936 CEST	192.168.2.5	1.1.1.1	c24d	(Port unreachable)	Destination Unreachable
May 27, 2024 02:35:53.001351118 CEST	192.168.2.5	1.1.1.1	c287	(Port unreachable)	Destination Unreachable
May 27, 2024 02:35:56.446881056 CEST	192.168.2.5	1.1.1.1	c2a1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 02:35:45.765218973 CEST	192.168.2.5	1.1.1.1	0x232	Standard query (0)	links.edm.saiglobal.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:45.765400887 CEST	192.168.2.5	1.1.1.1	0x9699	Standard query (0)	links.edm.saiglobal.com	65	IN (0x0001)	false
May 27, 2024 02:35:47.381273985 CEST	192.168.2.5	1.1.1.1	0xcc0d	Standard query (0)	lp.intertek.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:47.381966114 CEST	192.168.2.5	1.1.1.1	0x6878	Standard query (0)	lp.intertek.com	65	IN (0x0001)	false
May 27, 2024 02:35:48.010430098 CEST	192.168.2.5	1.1.1.1	0x2e85	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.010895967 CEST	192.168.2.5	1.1.1.1	0x6117	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 27, 2024 02:35:48.964251995 CEST	192.168.2.5	1.1.1.1	0xc578	Standard query (0)	cdn.intertek.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.964401007 CEST	192.168.2.5	1.1.1.1	0x4688	Standard query (0)	cdn.intertek.com	65	IN (0x0001)	false
May 27, 2024 02:35:48.967189074 CEST	192.168.2.5	1.1.1.1	0xf129	Standard query (0)	intertek-cdn.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.967575073 CEST	192.168.2.5	1.1.1.1	0xddfa	Standard query (0)	intertek-cdn.s3.amazonaws.com	65	IN (0x0001)	false
May 27, 2024 02:35:51.729167938 CEST	192.168.2.5	1.1.1.1	0x6f8c	Standard query (0)	content-us-1.content-cms.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:51.729527950 CEST	192.168.2.5	1.1.1.1	0x9e68	Standard query (0)	content-us-1.content-cms.com	65	IN (0x0001)	false
May 27, 2024 02:35:52.882267952 CEST	192.168.2.5	1.1.1.1	0xf60c	Standard query (0)	content-us-1.content-cms.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:52.882366896 CEST	192.168.2.5	1.1.1.1	0xac3b	Standard query (0)	content-us-1.content-cms.com	65	IN (0x0001)	false
May 27, 2024 02:35:56.419384956 CEST	192.168.2.5	1.1.1.1	0x3ff1	Standard query (0)	www.intertekinform.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:56.419769049 CEST	192.168.2.5	1.1.1.1	0xa899	Standard query (0)	www.intertekinform.com	65	IN (0x0001)	false
May 27, 2024 02:35:57.437026024 CEST	192.168.2.5	1.1.1.1	0x2229	Standard query (0)	www.intertekinform.com	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:57.437485933 CEST	192.168.2.5	1.1.1.1	0xaa7d	Standard query (0)	www.intertekinform.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 02:35:46.102025032 CEST	1.1.1.1	192.168.2.5	0x232	No error (0)	links.edm.saiglobal.com	f0d8d6c74e797ba1.acs5.tc		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:46.102025032 CEST	1.1.1.1	192.168.2.5	0x232	No error (0)	f0d8d6c74e797ba1.acs5.tc		13.32.27.102	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:46.102025032 CEST	1.1.1.1	192.168.2.5	0x232	No error (0)	f0d8d6c74e797ba1.acs5.tc		13.32.27.125	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:46.102025032 CEST	1.1.1.1	192.168.2.5	0x232	No error (0)	f0d8d6c74e797ba1.acs5.tc		13.32.27.6	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:46.102025032 CEST	1.1.1.1	192.168.2.5	0x232	No error (0)	f0d8d6c74e797ba1.acs5.tc		13.32.27.66	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:47.557236910 CEST	1.1.1.1	192.168.2.5	0xcc0d	No error (0)	lp.intertek.com	pages05.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:47.557236910 CEST	1.1.1.1	192.168.2.5	0xcc0d	No error (0)	pages05.net		54.164.12.236	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:47.603458881 CEST	1.1.1.1	192.168.2.5	0x6878	No error (0)	lp.intertek.com	pages05.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:47.905066013 CEST	1.1.1.1	192.168.2.5	0x9699	No error (0)	links.edm.saiglobal.com	f0d8d6c74e797ba1.acs5.tc		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:48.017880917 CEST	1.1.1.1	192.168.2.5	0x2e85	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.024504900 CEST	1.1.1.1	192.168.2.5	0x6117	No error (0)	www.google.com			65	IN (0x0001)	false
May 27, 2024 02:35:48.984853983 CEST	1.1.1.1	192.168.2.5	0xc578	No error (0)	cdn.intertek.com	d1ss3r492lzkyv.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:48.984853983 CEST	1.1.1.1	192.168.2.5	0xc578	No error (0)	d1ss3r492lzkyv.cloudfront.net		18.173.205.95	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.984853983 CEST	1.1.1.1	192.168.2.5	0xc578	No error (0)	d1ss3r492lzkyv.cloudfront.net		18.173.205.30	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.984853983 CEST	1.1.1.1	192.168.2.5	0xc578	No error (0)	d1ss3r492lzkyv.cloudfront.net		18.173.205.42	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.984853983 CEST	1.1.1.1	192.168.2.5	0xc578	No error (0)	d1ss3r492lzkyv.cloudfront.net		18.173.205.19	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:48.998351097 CEST	1.1.1.1	192.168.2.5	0x4688	No error (0)	cdn.intertek.com	d1ss3r492lzkyv.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:49.005812883 CEST	1.1.1.1	192.168.2.5	0xddfa	No error (0)	intertek-cdn.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:49.005812883 CEST	1.1.1.1	192.168.2.5	0xddfa	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	intertek-cdn.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.105	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.135.89	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.120.241	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.22.227	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.204.145	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.136.105	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.48.121	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:49.005863905 CEST	1.1.1.1	192.168.2.5	0xf129	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.74.44	A (IP address)	IN (0x0001)	false
May 27, 2024 02:35:51.738183022 CEST	1.1.1.1	192.168.2.5	0x6f8c	No error (0)	content-us-1.content-cms.com	content-samples.goacoustic.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:51.750821114 CEST	1.1.1.1	192.168.2.5	0x9e68	No error (0)	content-us-1.content-cms.com	content-samples.goacoustic.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:52.953619003 CEST	1.1.1.1	192.168.2.5	0xf60c	No error (0)	content-us-1.content-cms.com	content-samples.goacoustic.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:53.001132011 CEST	1.1.1.1	192.168.2.5	0xac3b	No error (0)	content-us-1.content-cms.com	content-samples.goacoustic.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:56.426887989 CEST	1.1.1.1	192.168.2.5	0x3ff1	No error (0)	www.intertekinform.com	www.intertekinform.com.dxcloud.episerver.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:56.426887989 CEST	1.1.1.1	192.168.2.5	0x3ff1	No error (0)	www.intertekinform.com.dxcloud.episerver.net	www.intertekinform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:56.446799040 CEST	1.1.1.1	192.168.2.5	0xa899	No error (0)	www.intertekinform.com	www.intertekinform.com.dxcloud.episerver.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:56.446799040 CEST	1.1.1.1	192.168.2.5	0xa899	No error (0)	www.intertekinform.com.dxcloud.episerver.net	www.intertekinform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:57.523372889 CEST	1.1.1.1	192.168.2.5	0x2229	No error (0)	www.intertekinform.com	www.intertekinform.com.dxcloud.episerver.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:57.523372889 CEST	1.1.1.1	192.168.2.5	0x2229	No error (0)	www.intertekinform.com.dxcloud.episerver.net	www.intertekinform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:57.523395061 CEST	1.1.1.1	192.168.2.5	0xaa7d	No error (0)	www.intertekinform.com	www.intertekinform.com.dxcloud.episerver.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:35:57.523395061 CEST	1.1.1.1	192.168.2.5	0xaa7d	No error (0)	www.intertekinform.com.dxcloud.episerver.net	www.intertekinform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:36:00.140371084 CEST	1.1.1.1	192.168.2.5	0x96b0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 27, 2024 02:36:00.140371084 CEST	1.1.1.1	192.168.2.5	0x96b0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 27, 2024 02:36:02.120826960 CEST	1.1.1.1	192.168.2.5	0x4bca	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:36:02.120826960 CEST	1.1.1.1	192.168.2.5	0x4bca	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 27, 2024 02:36:15.200237036 CEST	1.1.1.1	192.168.2.5	0xc053	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:36:15.200237036 CEST	1.1.1.1	192.168.2.5	0xc053	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 27, 2024 02:36:36.232280970 CEST	1.1.1.1	192.168.2.5	0x10d7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:36:36.232280970 CEST	1.1.1.1	192.168.2.5	0x10d7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 27, 2024 02:36:56.994683981 CEST	1.1.1.1	192.168.2.5	0x8aef	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 02:36:56.994683981 CEST	1.1.1.1	192.168.2.5	0x8aef	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

links.edm.saiglobal.com

lp.intertek.com

https:

intertek-cdn.s3.amazonaws.com

cdn.intertek.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	13.32.27.102	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:46 UTC	849	OUT	GET /els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/ HTTP/1.1 Host: links.edm.saiglobal.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:47 UTC	645	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 27 May 2024 00:35:47 GMT location: https://lp.intertek.com/OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQzMAS2 content-language: en-US x-envoy-upstream-service-time: 4 server: istio-envoy X-Cache: Miss from cloudfront Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: oORsLrGyMiHnoKKlUeV6687WyBs7SpwWDHEbldXQBKPS97WJZgmimA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	54.164.12.236	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:48 UTC	893	OUT	GET /OptoutIntertekInform/intertekinform?spMailingID=29115189&spUserID=ODQ0NzI2NDEyNDQ5S0&spJobID=MjY2MDIwNjU1NgS2&spReportId=MjY2MDIwNjU1NgS2&spMailingID=29308509&spUserID=MTAwNjc1MjgzNjAxMwS2&spJobID=2700863430&spReportId=MjcwMDg2MzQzMAS2 HTTP/1.1 Host: lp.intertek.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:48 UTC	888	IN	HTTP/1.1 200 200 Date: Mon, 27 May 2024 00:35:48 GMT Server: Apache p3p: CP="CAO PSA OUR" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Set-Cookie: VIEW=Y2Y1ZjkyYWUtYjdjMC00YTk3LWI0ODAtODY5NGMwNmQ3MWIwS0; Max-Age=100000000; Expires=Wed, 28 Jul 2027 10:22:28 GMT; Path=/;SameSite=None;Secure Set-Cookie: SESSION=MDFiMmRiOTAtOWQxMC00NWE0LWI1YjktNmE2NWNkMWQ3MTNlOzsS1; Max-Age=1200; Expires=Mon, 27 May 2024 00:55:48 GMT; Path=/OptoutIntertekInform;SameSite=None;Secure Set-Cookie: SP_PAGE_VISIT.19443244=MQS2; Max-Age=1200; Expires=Mon, 27 May 2024 00:55:48 GMT; Path=/OptoutIntertekInform;SameSite=None;Secure Connection: close Transfer-Encoding: chunked Set-Cookie: Silverpop_cookie=1922031626.4525.0000; path=/; Httponly; Secure;SameSite=None Strict-Transport-Security: max-age=16070400; includeSubDomains; preload
2024-05-27 00:35:48 UTC	5821	IN	Data Raw: 31 36 62 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6e 74 65 72 74 65 6b 69 6e 66 6f 72 6d 2e 63 6f 6d 2f 69 6d 67 2f 69 6e 66 6f 72 6d 2f 66 61 76 69 63 6f 6e 2e 73 76 67 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 76 6e 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 69 63 6f 6e 22 20 2f 3e 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 74 6f 75 74 20 49 6e 74 65 72 74 65 6b 20 49 6e 66 6f 72 6d 3c 2f 74 69 74 6c 65 3e 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 Data Ascii: 16b0<!DOCTYPE html><html lang="en"><head> <link rel="shortcut icon" href="https://www.intertekinform.com/img/inform/favicon.svg" type="image/vnd.microsoft.icon" /> <title>Optout Intertek Inform</title> <link rel="stylesheet" hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49717	3.5.28.105	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:49 UTC	563	OUT	GET /mail/forms/lib/jquery/jquery.min.js HTTP/1.1 Host: intertek-cdn.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://lp.intertek.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:49 UTC	555	IN	HTTP/1.1 200 OK x-amz-id-2: CwTF5d3pSa+D2hAPMwxEhIxLfsWhWNw+y9UouwEp4nxsxqngnzoQ/hCj1idFnwuMXG9ohst3cX7ygidyicE8O1qzvoHx/khDFb3SsTE6P1M= x-amz-request-id: B0KN5PZWQGB3R2AJ Date: Mon, 27 May 2024 00:35:50 GMT Last-Modified: Thu, 10 Jan 2019 15:11:15 GMT ETag: "c9f5aeeca3ad37bf2aa006139b935f0a" x-amz-meta-sha256: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de x-amz-meta-s3b-last-modified: 20180626T165314Z Accept-Ranges: bytes Content-Type: application/javascript Server: AmazonS3 Content-Length: 86659 Connection: close
2024-05-27 00:35:49 UTC	15739	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.2.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery
2024-05-27 00:35:49 UTC	16384	IN	Data Raw: 66 28 66 29 7b 77 68 69 6c 65 28 70 29 7b 6d 3d 62 3b 77 68 69 6c 65 28 6d 3d 6d 5b 70 5d 29 69 66 28 68 3f 6d 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 72 3a 31 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 6f 3d 70 3d 22 6f 6e 6c 79 22 3d 3d 3d 61 26 26 21 6f 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 6f 3d 5b 67 3f 71 2e 66 69 72 73 74 43 68 69 6c 64 3a 71 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 67 26 26 73 29 7b 6d 3d 71 2c 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6a 3d 6b 5b 61 5d 7c 7c 5b 5d 2c 6e 3d 6a 5b 30 5d 3d 3d 3d 77 26 26 6a 5b Data Ascii: f(f){while(p){m=b;while(m=m[p])if(h?m.nodeName.toLowerCase()===r:1===m.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){m=q,l=m[u]\|\|(m[u]={}),k=l[m.uniqueID]\|\|(l[m.uniqueID]={}),j=k[a]\|\|[],n=j[0]===w&&j[
2024-05-27 00:35:49 UTC	1024	IN	Data Raw: 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 53 29 2c 72 2e 72 65 61 64 79 28 29 7d 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 64 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 22 6c 6f 61 64 69 6e 67 22 21 3d 3d 64 2e 72 65 61 64 79 53 74 61 74 65 26 26 21 64 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 64 6f 53 63 72 6f 6c 6c 3f 61 2e 73 65 74 54 69 6d 65 6f 75 74 28 72 2e 72 65 61 64 79 29 3a 28 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 53 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 53 29 29 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 76 61 72 20 68 3d 30 2c 69 3d 61 2e Data Ascii: moveEventListener("load",S),r.ready()}"complete"===d.readyState\|\|"loading"!==d.readyState&&!d.documentElement.doScroll?a.setTimeout(r.ready):(d.addEventListener("DOMContentLoaded",S),a.addEventListener("load",S));var T=function(a,b,c,d,e,f,g){var h=0,i=a.
2024-05-27 00:35:49 UTC	16384	IN	Data Raw: 28 61 29 3a 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 26 26 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 5b 72 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 5d 7d 2c 61 63 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 62 7c 7c 62 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 76 6f 69 64 20 30 3d 3d 3d 63 3f 74 68 69 73 2e 67 65 74 28 61 2c 62 29 3a 28 74 68 69 73 2e 73 65 74 28 61 2c 62 2c 63 29 2c 76 6f 69 64 20 30 21 3d 3d 63 3f 63 3a 62 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 3d 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 64 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 62 29 7b 41 72 Data Ascii: (a):a[this.expando]&&a[this.expando][r.camelCase(b)]},access:function(a,b,c){return void 0===b\|\|b&&"string"==typeof b&&void 0===c?this.get(a,b):(this.set(a,b,c),void 0!==c?c:b)},remove:function(a,b){var c,d=a[this.expando];if(void 0!==d){if(void 0!==b){Ar
2024-05-27 00:35:49 UTC	1024	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 20 4a 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 61 2c 74 68 69 73 29 7d 29 7d 2c 61 66 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4a 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 61 2c 74 68 69 73 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 7d 29 7d 2c 65 6d 70 74 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 61 2c 62 3d 30 3b 6e 75 6c 6c Data Ascii: (){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},empty:function(){for(var a,b=0;null
2024-05-27 00:35:50 UTC	16384	IN	Data Raw: 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 2e 66 6e 5b 61 5d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 63 2c 64 3d 5b 5d 2c 65 3d 72 28 61 29 2c 66 3d 65 2e 6c 65 6e 67 74 68 2d 31 2c 67 3d 30 3b 67 3c 3d 66 3b 67 2b 2b 29 63 3d 67 3d 3d 3d 66 3f 74 68 69 73 3a 74 68 69 73 2e 63 6c 6f 6e 65 28 21 30 29 2c 72 28 65 5b 67 5d 29 5b 62 5d 28 63 29 2c 68 2e 61 70 70 6c 79 28 64 2c 63 2e 67 65 74 28 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 64 29 7d Data Ascii: rependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){r.fn[a]=function(a){for(var c,d=[],e=r(a),f=e.length-1,g=0;g<=f;g++)c=g===f?this:this.clone(!0),r(e[g])[b](c),h.apply(d,c.get());return this.pushStack(d)}
2024-05-27 00:35:50 UTC	1024	IN	Data Raw: 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 2c 64 2c 65 2c 66 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 63 29 7b 64 3d 30 2c 65 3d 72 28 74 68 69 73 29 2c 66 3d 61 2e 6d 61 74 63 68 28 4c 29 7c 7c 5b 5d 3b 77 68 69 6c 65 28 62 3d 66 5b 64 2b 2b 5d 29 65 2e 68 61 73 43 6c 61 73 73 28 62 29 3f 65 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 62 29 3a 65 2e 61 64 64 43 6c 61 73 73 28 62 29 7d 65 6c 73 65 20 76 6f 69 64 20 30 21 3d 3d 61 26 26 22 62 6f 6f 6c 65 61 6e 22 21 3d 3d 63 7c 7c 28 62 3d 71 62 28 74 68 69 73 29 2c 62 26 26 57 2e 73 65 74 28 74 68 69 73 2c 22 5f 5f 63 6c 61 73 73 4e 61 6d 65 5f 5f 22 2c 62 29 2c 74 68 69 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 26 26 74 68 69 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 Data Ascii: ach(function(){var b,d,e,f;if("string"===c){d=0,e=r(this),f=a.match(L)\|\|[];while(b=f[d++])e.hasClass(b)?e.removeClass(b):e.addClass(b)}else void 0!==a&&"boolean"!==c\|\|(b=qb(this),b&&W.set(this,"__className__",b),this.setAttribute&&this.setAttribute("class
2024-05-27 00:35:50 UTC	3392	IN	Data Raw: 65 28 72 62 2c 22 22 29 3a 6e 75 6c 6c 3d 3d 63 3f 22 22 3a 63 29 7d 7d 7d 29 2c 72 2e 65 78 74 65 6e 64 28 7b 76 61 6c 48 6f 6f 6b 73 3a 7b 6f 70 74 69 6f 6e 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 66 69 6e 64 2e 61 74 74 72 28 61 2c 22 76 61 6c 75 65 22 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 62 3f 62 3a 70 62 28 72 2e 74 65 78 74 28 61 29 29 7d 7d 2c 73 65 6c 65 63 74 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 3d 61 2e 6f 70 74 69 6f 6e 73 2c 66 3d 61 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 67 3d 22 73 65 6c 65 63 74 2d 6f 6e 65 22 3d 3d 3d 61 2e 74 79 70 65 2c 68 3d 67 3f 6e 75 6c 6c 3a 5b 5d 2c 69 3d 67 3f 66 2b 31 3a 65 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 64 Data Ascii: e(rb,""):null==c?"":c)}}}),r.extend({valHooks:{option:{get:function(a){var b=r.find.attr(a,"value");return null!=b?b:pb(r.text(a))}},select:{get:function(a){var b,c,d,e=a.options,f=a.selectedIndex,g="select-one"===a.type,h=g?null:[],i=g?f+1:e.length;for(d
2024-05-27 00:35:50 UTC	9000	IN	Data Raw: 73 65 72 29 2e 70 61 72 73 65 46 72 6f 6d 53 74 72 69 6e 67 28 62 2c 22 74 65 78 74 2f 78 6d 6c 22 29 7d 63 61 74 63 68 28 64 29 7b 63 3d 76 6f 69 64 20 30 7d 72 65 74 75 72 6e 20 63 26 26 21 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 70 61 72 73 65 72 65 72 72 6f 72 22 29 2e 6c 65 6e 67 74 68 7c 7c 72 2e 65 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 58 4d 4c 3a 20 22 2b 62 29 2c 63 7d 3b 76 61 72 20 77 62 3d 2f 5c 5b 5c 5d 24 2f 2c 78 62 3d 2f 5c 72 3f 5c 6e 2f 67 2c 79 62 3d 2f 5e 28 3f 3a 73 75 62 6d 69 74 7c 62 75 74 74 6f 6e 7c 69 6d 61 67 65 7c 72 65 73 65 74 7c 66 69 6c 65 29 24 2f 69 2c 7a 62 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 6b 65 79 67 65 6e 29 2f 69 3b 66 75 6e 63 74 Data Ascii: ser).parseFromString(b,"text/xml")}catch(d){c=void 0}return c&&!c.getElementsByTagName("parsererror").length\|\|r.error("Invalid XML: "+b),c};var wb=/\[\]$/,xb=/\r?\n/g,yb=/^(?:submit\|button\|image\|reset\|file)$/i,zb=/^(?:input\|select\|textarea\|keygen)/i;funct
2024-05-27 00:35:50 UTC	6304	IN	Data Raw: 3d 68 2e 6f 6e 65 72 72 6f 72 3d 68 2e 6f 6e 61 62 6f 72 74 3d 68 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 6e 75 6c 6c 2c 22 61 62 6f 72 74 22 3d 3d 3d 61 3f 68 2e 61 62 6f 72 74 28 29 3a 22 65 72 72 6f 72 22 3d 3d 3d 61 3f 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 68 2e 73 74 61 74 75 73 3f 66 28 30 2c 22 65 72 72 6f 72 22 29 3a 66 28 68 2e 73 74 61 74 75 73 2c 68 2e 73 74 61 74 75 73 54 65 78 74 29 3a 66 28 52 62 5b 68 2e 73 74 61 74 75 73 5d 7c 7c 68 2e 73 74 61 74 75 73 2c 68 2e 73 74 61 74 75 73 54 65 78 74 2c 22 74 65 78 74 22 21 3d 3d 28 68 2e 72 65 73 70 6f 6e 73 65 54 79 70 65 7c 7c 22 74 65 78 74 22 29 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 68 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 3f 7b 62 69 6e 61 Data Ascii: =h.onerror=h.onabort=h.onreadystatechange=null,"abort"===a?h.abort():"error"===a?"number"!=typeof h.status?f(0,"error"):f(h.status,h.statusText):f(Rb[h.status]\|\|h.status,h.statusText,"text"!==(h.responseType\|\|"text")\|\|"string"!=typeof h.responseText?{bina

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	3.5.28.105	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:49 UTC	577	OUT	GET /mail/forms/lib/bootstrap/dist/js/bootstrap.min.js HTTP/1.1 Host: intertek-cdn.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://lp.intertek.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:49 UTC	555	IN	HTTP/1.1 200 OK x-amz-id-2: QvSAKd4MxH2C/GjudwXkbx/Z9+84hGR6+lSeXZegvQn6DTIkL2/fexh6mXh3dlpIongnURR/aXH24p8/RXjSDUtsL++q3wPBUAmflzXBi5M= x-amz-request-id: B0KK8H927D8CDFX8 Date: Mon, 27 May 2024 00:35:50 GMT Last-Modified: Thu, 10 Jan 2019 15:07:13 GMT ETag: "14d449eb8876fa55e1ef3c2cc52b0c17" x-amz-meta-sha256: e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b x-amz-meta-s3b-last-modified: 20180626T165328Z Accept-Ranges: bytes Content-Type: application/javascript Server: AmazonS3 Content-Length: 48944 Connection: close
2024-05-27 00:35:49 UTC	16384	IN	Data Raw: 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t,e){"o
2024-05-27 00:35:49 UTC	469	IN	Data Raw: 6f 77 22 2b 6f 2c 53 48 4f 57 4e 3a 22 73 68 6f 77 6e 22 2b 6f 2c 43 4c 49 43 4b 3a 22 63 6c 69 63 6b 22 2b 6f 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 6f 2b 61 2c 4b 45 59 44 4f 57 4e 5f 44 41 54 41 5f 41 50 49 3a 22 6b 65 79 64 6f 77 6e 22 2b 6f 2b 61 2c 4b 45 59 55 50 5f 44 41 54 41 5f 41 50 49 3a 22 6b 65 79 75 70 22 2b 6f 2b 61 7d 2c 75 3d 22 64 69 73 61 62 6c 65 64 22 2c 66 3d 22 73 68 6f 77 22 2c 64 3d 22 64 72 6f 70 75 70 22 2c 5f 3d 22 64 72 6f 70 72 69 67 68 74 22 2c 67 3d 22 64 72 6f 70 6c 65 66 74 22 2c 70 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 2d 72 69 67 68 74 22 2c 6d 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 2d 6c 65 66 74 22 2c 76 3d 22 70 6f 73 69 74 69 6f 6e 2d 73 74 61 74 69 63 22 2c 45 3d 27 5b Data Ascii: ow"+o,SHOWN:"shown"+o,CLICK:"click"+o,CLICK_DATA_API:"click"+o+a,KEYDOWN_DATA_API:"keydown"+o+a,KEYUP_DATA_API:"keyup"+o+a},u="disabled",f="show",d="dropup",_="dropright",g="dropleft",p="dropdown-menu-right",m="dropdown-menu-left",v="position-static",E='[
2024-05-27 00:35:49 UTC	16384	IN	Data Raw: 74 22 2c 4f 3d 7b 6f 66 66 73 65 74 3a 30 2c 66 6c 69 70 3a 21 30 2c 62 6f 75 6e 64 61 72 79 3a 22 73 63 72 6f 6c 6c 50 61 72 65 6e 74 22 7d 2c 6b 3d 7b 6f 66 66 73 65 74 3a 22 28 6e 75 6d 62 65 72 7c 73 74 72 69 6e 67 7c 66 75 6e 63 74 69 6f 6e 29 22 2c 66 6c 69 70 3a 22 62 6f 6f 6c 65 61 6e 22 2c 62 6f 75 6e 64 61 72 79 3a 22 28 73 74 72 69 6e 67 7c 65 6c 65 6d 65 6e 74 29 22 7d 2c 4c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 74 2c 65 29 7b 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 2c 74 68 69 73 2e 5f 70 6f 70 70 65 72 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 3d 74 68 69 73 2e 5f 67 65 74 43 6f 6e 66 69 67 28 65 29 2c 74 68 69 73 2e 5f 6d 65 6e 75 3d 74 68 69 73 2e 5f 67 65 74 4d 65 6e 75 45 6c 65 6d 65 6e 74 Data Ascii: t",O={offset:0,flip:!0,boundary:"scrollParent"},k={offset:"(number\|string\|function)",flip:"boolean",boundary:"(string\|element)"},L=function(){function a(t,e){this._element=t,this._popper=null,this._config=this._getConfig(e),this._menu=this._getMenuElement
2024-05-27 00:35:49 UTC	1024	IN	Data Raw: 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 74 69 70 29 7c 7c 74 28 72 29 2e 61 70 70 65 6e 64 54 6f 28 63 29 2c 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 74 72 69 67 67 65 72 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 45 76 65 6e 74 2e 49 4e 53 45 52 54 45 44 29 2c 74 68 69 73 2e 5f 70 6f 70 70 65 72 3d 6e 65 77 20 6e 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2c 72 2c 7b 70 6c 61 63 65 6d 65 6e 74 3a 68 2c 6d 6f 64 69 66 69 65 72 73 3a 7b 6f 66 66 73 65 74 3a 7b 6f 66 66 73 65 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6f 66 66 73 65 74 7d 2c 66 6c 69 70 3a 7b 62 65 68 61 76 69 6f 72 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 66 61 6c 6c 62 61 63 Data Ascii: this.element.ownerDocument.documentElement,this.tip)\|\|t(r).appendTo(c),t(this.element).trigger(this.constructor.Event.INSERTED),this._popper=new n(this.element,r,{placement:h,modifiers:{offset:{offset:this.config.offset},flip:{behavior:this.config.fallbac
2024-05-27 00:35:49 UTC	1092	IN	Data Raw: 65 21 3d 3d 66 26 26 69 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 69 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 69 29 2c 6e 2e 5f 63 6c 65 61 6e 54 69 70 43 6c 61 73 73 28 29 2c 6e 2e 65 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 64 65 73 63 72 69 62 65 64 62 79 22 29 2c 74 28 6e 2e 65 6c 65 6d 65 6e 74 29 2e 74 72 69 67 67 65 72 28 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 45 76 65 6e 74 2e 48 49 44 44 45 4e 29 2c 6e 75 6c 6c 21 3d 3d 6e 2e 5f 70 6f 70 70 65 72 26 26 6e 2e 5f 70 6f 70 70 65 72 2e 64 65 73 74 72 6f 79 28 29 2c 65 26 26 65 28 29 7d 3b 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 74 72 69 67 67 65 72 28 73 29 2c 73 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 Data Ascii: e!==f&&i.parentNode&&i.parentNode.removeChild(i),n._cleanTipClass(),n.element.removeAttribute("aria-describedby"),t(n.element).trigger(n.constructor.Event.HIDDEN),null!==n._popper&&n._popper.destroy(),e&&e()};t(this.element).trigger(s),s.isDefaultPrevente
2024-05-27 00:35:49 UTC	9000	IN	Data Raw: 6e 26 26 28 6e 2e 6e 6f 64 65 54 79 70 65 7c 7c 6e 2e 6a 71 75 65 72 79 29 3f 69 3f 74 28 6e 29 2e 70 61 72 65 6e 74 28 29 2e 69 73 28 65 29 7c 7c 65 2e 65 6d 70 74 79 28 29 2e 61 70 70 65 6e 64 28 6e 29 3a 65 2e 74 65 78 74 28 74 28 6e 29 2e 74 65 78 74 28 29 29 3a 65 5b 69 3f 22 68 74 6d 6c 22 3a 22 74 65 78 74 22 5d 28 6e 29 7d 2c 49 2e 67 65 74 54 69 74 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 22 29 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 69 74 6c 65 3f 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 69 74 6c Data Ascii: n&&(n.nodeType\|\|n.jquery)?i?t(n).parent().is(e)\|\|e.empty().append(n):e.text(t(n).text()):e[i?"html":"text"](n)},I.getTitle=function(){var t=this.element.getAttribute("data-original-title");return t\|\|(t="function"==typeof this.config.title?this.config.titl
2024-05-27 00:35:49 UTC	4591	IN	Data Raw: 66 73 65 74 73 5b 30 5d 26 26 74 68 69 73 2e 5f 6f 66 66 73 65 74 73 5b 30 5d 3e 30 29 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 61 63 74 69 76 65 54 61 72 67 65 74 3d 6e 75 6c 6c 2c 76 6f 69 64 20 74 68 69 73 2e 5f 63 6c 65 61 72 28 29 3b 66 6f 72 28 76 61 72 20 73 3d 74 68 69 73 2e 5f 6f 66 66 73 65 74 73 2e 6c 65 6e 67 74 68 3b 73 2d 2d 3b 29 7b 74 68 69 73 2e 5f 61 63 74 69 76 65 54 61 72 67 65 74 21 3d 3d 74 68 69 73 2e 5f 74 61 72 67 65 74 73 5b 73 5d 26 26 74 3e 3d 74 68 69 73 2e 5f 6f 66 66 73 65 74 73 5b 73 5d 26 26 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 68 69 73 2e 5f 6f 66 66 73 65 74 73 5b 73 2b 31 5d 7c 7c 74 3c 74 68 69 73 2e 5f 6f 66 66 73 65 74 73 5b 73 2b 31 5d 29 26 26 74 68 69 73 2e 5f 61 63 74 69 76 61 74 65 28 Data Ascii: fsets[0]&&this._offsets[0]>0)return this._activeTarget=null,void this._clear();for(var s=this._offsets.length;s--;){this._activeTarget!==this._targets[s]&&t>=this._offsets[s]&&("undefined"==typeof this._offsets[s+1]\|\|t<this._offsets[s+1])&&this._activate(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	18.173.205.95	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:49 UTC	555	OUT	GET /mail/forms/css/sai-app3.css HTTP/1.1 Host: cdn.intertek.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lp.intertek.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:50 UTC	582	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 506831 Connection: close Date: Mon, 27 May 2024 00:35:51 GMT Last-Modified: Tue, 29 Mar 2022 20:41:52 GMT ETag: "bb4b2061274c4b26a719cbc0490229c4" x-amz-meta-sha256: 2071fa098c040d2a7d7ca5270e94892150783e6cb70e47b8fc68b6684b39ecb6 x-amz-meta-s3b-last-modified: 20220329T203958Z Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 b12498b20eb99a0be9023f965d5b2f90.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: mJTB4Az9wOvXcZnyT0TOTRtlZslp6ajXrtrHByPLluTURJga5zGTpw==
2024-05-27 00:35:50 UTC	15802	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6d 61 69 73 6f 6e 6e 65 74 74 65 2d 61 64 6d 69 6e 20 76 30 2e 30 2e 31 20 28 68 74 74 70 73 3a 2f 2f 66 6f 78 79 74 68 65 6d 65 73 2e 6e 65 74 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 38 20 46 6f 78 79 20 54 68 65 6d 65 73 20 61 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 0a 20 2a 2f 0a 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 40 6d 65 64 69 61 20 70 72 69 6e 74 20 7b 0a 20 20 2a 2c 0a 20 20 2a 3a 3a 62 65 66 6f 72 65 2c 0a 20 20 2a 3a 3a 61 66 74 65 72 20 7b 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 Data Ascii: /! maisonnette-admin v0.0.1 (https://foxythemes.net) * Copyright 2018 Foxy Themes all rights reserved /@charset "UTF-8";@media print { , ::before, ::after { text-shadow: none !important; -webkit-box-shadow: none !important;
2024-05-27 00:35:50 UTC	1996	IN	Data Raw: 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 3a 20 30 20 30 20 35 38 2e 33 33 33 33 33 33 33 33 33 33 25 3b 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 35 38 2e 33 33 33 33 33 33 33 33 33 33 25 3b 20 7d 0a 20 20 2e 63 6f 6c 2d 73 6d 2d 38 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 20 30 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3a 20 30 20 30 20 36 36 2e 36 36 36 36 36 36 36 36 36 37 25 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 3a 20 30 20 30 20 36 36 2e 36 36 36 36 36 36 36 36 36 37 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 3a 20 30 20 30 20 36 36 2e 36 36 36 36 36 36 36 36 36 37 25 3b 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 36 36 2e 36 36 36 36 36 36 36 36 36 37 Data Ascii: %; flex: 0 0 58.3333333333%; max-width: 58.3333333333%; } .col-sm-8 { -webkit-box-flex: 0; -webkit-flex: 0 0 66.6666666667%; -ms-flex: 0 0 66.6666666667%; flex: 0 0 66.6666666667%; max-width: 66.6666666667
2024-05-27 00:35:50 UTC	1024	IN	Data Raw: 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 36 3b 20 7d 0a 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 37 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 38 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 37 3b 20 7d 0a 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 38 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 39 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d Data Ascii: -ms-flex-order: 6; order: 6; } .order-sm-7 { -webkit-box-ordinal-group: 8; -webkit-order: 7; -ms-flex-order: 7; order: 7; } .order-sm-8 { -webkit-box-ordinal-group: 9; -webkit-order: 8; -ms-
2024-05-27 00:35:50 UTC	12792	IN	Data Raw: 33 33 33 33 33 33 33 33 25 3b 20 7d 0a 20 20 2e 6f 66 66 73 65 74 2d 73 6d 2d 35 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 31 2e 36 36 36 36 36 36 36 36 36 37 25 3b 20 7d 0a 20 20 2e 6f 66 66 73 65 74 2d 73 6d 2d 36 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 35 30 25 3b 20 7d 0a 20 20 2e 6f 66 66 73 65 74 2d 73 6d 2d 37 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 35 38 2e 33 33 33 33 33 33 33 33 33 33 25 3b 20 7d 0a 20 20 2e 6f 66 66 73 65 74 2d 73 6d 2d 38 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 36 36 2e 36 36 36 36 36 36 36 36 36 37 25 3b 20 7d 0a 20 20 2e 6f 66 66 73 65 74 2d 73 6d 2d 39 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 37 35 25 3b 20 7d 0a 20 20 2e 6f Data Ascii: 33333333%; } .offset-sm-5 { margin-left: 41.6666666667%; } .offset-sm-6 { margin-left: 50%; } .offset-sm-7 { margin-left: 58.3333333333%; } .offset-sm-8 { margin-left: 66.6666666667%; } .offset-sm-9 { margin-left: 75%; } .o
2024-05-27 00:35:50 UTC	2568	IN	Data Raw: 6b 69 74 2d 6f 72 64 65 72 3a 20 2d 31 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 2d 31 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 2d 31 3b 20 7d 0a 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 6c 61 73 74 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 34 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 31 33 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 31 33 3b 20 7d 0a 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 30 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 3b 0a 20 20 20 20 2d 77 65 Data Ascii: kit-order: -1; -ms-flex-order: -1; order: -1; } .order-xl-last { -webkit-box-ordinal-group: 14; -webkit-order: 13; -ms-flex-order: 13; order: 13; } .order-xl-0 { -webkit-box-ordinal-group: 1; -we
2024-05-27 00:35:50 UTC	12792	IN	Data Raw: 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 63 65 65 65 66 3b 20 7d 0a 20 20 2e 74 61 62 6c 65 20 74 68 65 61 64 20 74 68 20 7b 0a 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 6f 74 74 6f 6d 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 65 63 65 65 65 66 3b 20 7d 0a 20 20 2e 74 61 62 6c 65 20 74 62 6f 64 79 20 2b 20 74 62 6f 64 79 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 65 63 65 65 65 66 3b 20 7d 0a 20 20 2e 74 61 62 6c 65 20 2e 74 61 62 6c 65 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 34 66 34 66 34 3b 20 7d 0a 0a 2e 74 61 62 6c 65 2d 73 6d 20 74 68 2c 0a 2e Data Ascii: border-top: 1px solid #eceeef; } .table thead th { vertical-align: bottom; border-bottom: 2px solid #eceeef; } .table tbody + tbody { border-top: 2px solid #eceeef; } .table .table { background-color: #f4f4f4; }.table-sm th,.
2024-05-27 00:35:50 UTC	3592	IN	Data Raw: 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 30 20 72 67 62 61 28 34 34 2c 20 31 39 33 2c 20 31 33 33 2c 20 30 2e 32 35 29 3b 20 7d 0a 20 20 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 76 61 6c 69 64 20 7e 20 2e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 0a 20 20 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 76 61 6c 69 64 20 7e 20 2e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2e 69 73 2d 76 61 6c 69 64 20 7e 20 2e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 0a 20 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2e 69 73 2d 76 61 6c 69 64 20 7e 20 2e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 20 2e 77 61 73 2d 76 61 6c 69 64 61 74 Data Ascii: ox-shadow: 0 0 0 0 rgba(44, 193, 133, 0.25); } .was-validated .form-control:valid ~ .valid-feedback, .was-validated .form-control:valid ~ .valid-tooltip, .form-control.is-valid ~ .valid-feedback, .form-control.is-valid ~ .valid-tooltip, .was-validat
2024-05-27 00:35:50 UTC	12792	IN	Data Raw: 6f 6e 74 72 6f 6c 3a 69 6e 76 61 6c 69 64 20 7e 20 2e 69 6e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2e 69 73 2d 69 6e 76 61 6c 69 64 20 7e 20 2e 69 6e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 0a 20 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2e 69 73 2d 69 6e 76 61 6c 69 64 20 7e 20 2e 69 6e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 20 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 0a 20 20 2e 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 3a 69 6e 76 61 6c 69 64 20 7e 20 2e 69 6e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 0a 20 20 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 0a 20 20 2e 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 3a 69 6e 76 61 6c 69 64 20 7e 20 2e 69 6e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 0a 20 20 2e 63 Data Ascii: ontrol:invalid ~ .invalid-tooltip, .form-control.is-invalid ~ .invalid-feedback, .form-control.is-invalid ~ .invalid-tooltip, .was-validated .custom-select:invalid ~ .invalid-feedback, .was-validated .custom-select:invalid ~ .invalid-tooltip, .c
2024-05-27 00:35:50 UTC	5640	IN	Data Raw: 2c 20 2e 62 74 6e 2d 64 61 6e 67 65 72 2e 66 6f 63 75 73 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 30 20 72 67 62 61 28 32 34 34 2c 20 38 38 2c 20 37 30 2c 20 30 2e 35 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 30 20 72 67 62 61 28 32 34 34 2c 20 38 38 2c 20 37 30 2c 20 30 2e 35 29 3b 20 7d 0a 20 20 2e 62 74 6e 2d 64 61 6e 67 65 72 2e 64 69 73 61 62 6c 65 64 2c 20 2e 62 74 6e 2d 64 61 6e 67 65 72 3a 64 69 73 61 62 6c 65 64 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 34 35 38 34 36 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 46 34 Data Ascii: , .btn-danger.focus { -webkit-box-shadow: 0 0 0 0 rgba(244, 88, 70, 0.5); box-shadow: 0 0 0 0 rgba(244, 88, 70, 0.5); } .btn-danger.disabled, .btn-danger:disabled { color: #FFFFFF; background-color: #F45846; border-color: #F4
2024-05-27 00:35:50 UTC	16384	IN	Data Raw: 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 30 20 72 67 62 61 28 33 33 2c 31 38 32 2c 32 31 35 2c 20 30 2e 35 29 3b 20 7d 0a 0a 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 73 65 63 6f 6e 64 61 72 79 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 38 37 38 37 38 37 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 6e 6f 6e 65 3b 0a 20 20 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 38 37 38 37 38 37 20 21 69 6d 70 6f 72 74 61 6e 74 20 7d 0a 20 20 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 73 65 63 6f 6e 64 61 72 79 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 Data Ascii: box-shadow: 0 0 0 0 rgba(33,182,215, 0.5); }.btn-outline-secondary { color: #878787; background-color: transparent; background-image: none; border:1px solid #878787 !important } .btn-outline-secondary:hover { color: #FFFFFF; backgrou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 00:35:50 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228805 Date: Mon, 27 May 2024 00:35:49 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 00:35:51 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228886 Date: Mon, 27 May 2024 00:35:51 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-27 00:35:51 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	18.173.205.95	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:52 UTC	626	OUT	GET /mail/forms/lib/open-sans/bold/opensans-bold-webfont.woff HTTP/1.1 Host: cdn.intertek.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://lp.intertek.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.intertek.com/mail/forms/css/sai-app3.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:53 UTC	597	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 63564 Connection: close Date: Mon, 27 May 2024 00:35:54 GMT Last-Modified: Thu, 10 Jan 2019 15:14:06 GMT ETag: "892667349c5cff6fcf7e40439596b97c" x-amz-meta-sha256: 7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9 x-amz-meta-s3b-last-modified: 20180626T165329Z Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 ba01631fe255b1896a9e6bfd4c86a06a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 8SQ0oHYmYvGqcttV-Dib8moyPj4XWSkQwSqwFf8PY0Gayi3HrzXk6w==
2024-05-27 00:35:53 UTC	15787	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 f8 4c 00 12 00 00 00 01 ad 68 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 46 54 4d 00 00 01 94 00 00 00 1c 00 00 00 1c 5d d2 2f 6f 47 44 45 46 00 00 01 b0 00 00 00 1e 00 00 00 20 03 de 00 03 47 50 4f 53 00 00 01 d0 00 00 00 20 00 00 00 20 6c 91 74 8f 47 53 55 42 00 00 01 f0 00 00 01 bf 00 00 02 8a 48 8f b8 db 4f 53 2f 32 00 00 03 b0 00 00 00 60 00 00 00 60 a2 6d a1 25 63 6d 61 70 00 00 04 10 00 00 03 22 00 00 04 7e cd 2a 1c 8d 63 76 74 20 00 00 07 34 00 00 00 2e 00 00 00 2e 0d 33 0e 24 66 70 67 6d 00 00 07 64 00 00 01 b1 00 00 02 65 0f b4 2f a7 67 61 73 70 00 00 09 18 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 09 20 00 00 cf da 00 01 69 84 8d 66 2a a7 68 65 61 64 00 00 d8 fc 00 00 00 Data Ascii: wOFFLhFFTM]/oGDEF GPOS ltGSUBHOS/2``m%cmap"~cvt 4..3$fpgmde/gaspglyf ifhead
2024-05-27 00:35:53 UTC	203	IN	Data Raw: ff 3e da 39 5c 4a f1 5e cf fd b1 71 5e 3d 0f 98 25 01 5b ed 34 b7 cf 2a b5 c6 05 2f 4b f3 33 26 67 2a 45 79 7b 28 a4 a7 2b 19 f5 b8 4e 2f fa c5 8c 2c 02 c8 4b ab 34 5c 96 06 54 19 53 89 4d fd 44 bd f0 54 d3 aa 47 97 dc 7f 97 61 e7 67 df 7e fc d9 79 f5 0c 9f 33 ed ce 19 53 99 ec 09 6b 98 2a a1 8d 69 89 36 23 9a 50 99 03 4a 4f 79 10 eb bd 68 6a 70 b4 02 f8 51 85 13 8b b8 d0 90 24 87 93 79 a4 00 19 ba 63 2e 30 ce 0a b5 de 2e 15 70 e4 32 51 20 ef 2e c7 53 73 c4 c2 72 b4 04 06 1c 7a ce 4a 14 31 81 8b e6 70 d4 12 ae 94 cb 31 a3 37 33 c2 c2 0e 7a 16 d0 d2 2e 0e f1 3f f9 f3 49 52 02 3c 8d 30 2b 24 fc 4f a4 a8 Data Ascii: >9\J^q^=%[4/K3&gEy{(+N/,K4\TSMDTGag~y3Sk*i6#PJOyhjpQ$yc.0.p2Q .SsrzJ1p173z.?IR<0+$O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	18.173.205.95	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:52 UTC	632	OUT	GET /mail/forms/lib/open-sans/regular/opensans-regular-webfont.woff HTTP/1.1 Host: cdn.intertek.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://lp.intertek.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.intertek.com/mail/forms/css/sai-app3.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:53 UTC	597	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 63712 Connection: close Date: Mon, 27 May 2024 00:35:54 GMT Last-Modified: Thu, 10 Jan 2019 15:14:13 GMT ETag: "ac327c4db6284ef64ebe872b6308f5da" x-amz-meta-sha256: 2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b x-amz-meta-s3b-last-modified: 20180626T165329Z Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 044b6ab929e12b48b2113c346ddcec30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: xi1LevgzfyQHllAQTHIi_sUGo_QnZnH8L9ROJoe-oZc8XLoKJyvV2g==
2024-05-27 00:35:53 UTC	15425	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 f8 e0 00 12 00 00 00 01 9f 0c 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 46 54 4d 00 00 01 94 00 00 00 1c 00 00 00 1c 5d c5 46 7e 47 44 45 46 00 00 01 b0 00 00 00 1e 00 00 00 20 03 de 00 03 47 50 4f 53 00 00 01 d0 00 00 00 20 00 00 00 20 6c 91 74 8f 47 53 55 42 00 00 01 f0 00 00 01 bf 00 00 02 8a 48 8f b8 db 4f 53 2f 32 00 00 03 b0 00 00 00 5f 00 00 00 60 a1 36 9e d6 63 6d 61 70 00 00 04 10 00 00 03 22 00 00 04 7e cd 2a 1c 8d 63 76 74 20 00 00 07 34 00 00 00 44 00 00 00 44 0b 07 0e 4a 66 70 67 6d 00 00 07 78 00 00 01 b1 00 00 02 65 0f b4 2f a7 67 61 73 70 00 00 09 2c 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 09 34 00 00 cf da 00 01 5a 1c 68 39 4b f8 68 65 61 64 00 00 d9 10 00 00 00 Data Ascii: wOFFFFTM]F~GDEF GPOS ltGSUBHOS/2_`6cmap"~*cvt 4DDJfpgmxe/gasp,glyf4Zh9Khead

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	18.173.205.95	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:54 UTC	625	OUT	GET /mail/forms/lib/open-sans/bold/opensans-bold-webfont.ttf HTTP/1.1 Host: cdn.intertek.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://lp.intertek.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.intertek.com/mail/forms/css/sai-app3.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:55 UTC	596	IN	HTTP/1.1 200 OK Content-Type: application/x-font-ttf Content-Length: 109928 Connection: close Date: Mon, 27 May 2024 00:35:55 GMT Last-Modified: Thu, 10 Jan 2019 15:14:06 GMT ETag: "5a100916f94b0babde0c92aaa8fb80d6" x-amz-meta-sha256: 91ce513fa6945f376012dc9f5b1eb3d020f3eb4a510a6efae6083a2a1f1d82a7 x-amz-meta-s3b-last-modified: 20180626T165329Z Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 43be4ee3b8e339e1d27addbbdc49a4d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 6zYR_J0y_rlLOOdAOD2EIlLa6iUr--vynGjPCR7RagE4ATF7uZc1cw==
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: 00 01 00 00 00 12 01 00 00 04 00 20 46 46 54 4d 5d d2 2f 6f 00 00 01 2c 00 00 00 1c 47 44 45 46 03 de 00 03 00 00 01 48 00 00 00 20 47 50 4f 53 6c 91 74 8f 00 00 01 68 00 00 00 20 47 53 55 42 48 8f b8 db 00 00 01 88 00 00 02 8a 4f 53 2f 32 a2 6d a1 25 00 00 04 14 00 00 00 60 63 6d 61 70 cd 2a 1c 8d 00 00 04 74 00 00 04 7e 63 76 74 20 0d 33 0e 24 00 00 08 f4 00 00 00 2e 66 70 67 6d 0f b4 2f a7 00 00 09 24 00 00 02 65 67 61 73 70 00 00 00 10 00 00 0b 8c 00 00 00 08 67 6c 79 66 8d 66 2a a7 00 00 0b 94 00 01 69 84 68 65 61 64 fa da b6 06 00 01 75 18 00 00 00 36 68 68 65 61 0e 29 0a 5c 00 01 75 50 00 00 00 24 68 6d 74 78 32 69 07 5d 00 01 75 74 00 00 0e bc 6c 6f 63 61 fa d9 57 ce 00 01 84 30 00 00 07 64 6d 61 78 70 04 e7 02 c7 00 01 8b 94 00 00 00 20 6e 61 6d Data Ascii: FFTM]/o,GDEFH GPOSlth GSUBHOS/2m%`cmapt~cvt 3$.fpgm/$egaspglyffiheadu6hhea)\uP$hmtx2i]utlocaW0dmaxp nam
2024-05-27 00:35:55 UTC	519	IN	Data Raw: b3 0c 0a 0e 13 2b b3 0d 0a 0e 13 2b b2 0b 0a 0e 20 8a 20 8a 23 06 0e 11 12 39 b0 0c 39 b0 0d 39 00 b7 02 0b 14 19 1a 0c 0d 0e 2e 2e 2e 2e 2e 2e 2e 2e 01 40 0b 02 0a 0b 14 17 19 1a 1d 0c 0d 0e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e b0 40 1a 01 00 b1 00 1d 11 12 b1 04 10 39 39 30 31 13 21 13 16 17 33 36 3f 01 13 21 13 1e 03 17 33 3e 01 37 13 21 01 21 0b 01 23 03 21 14 01 30 81 1f 20 06 04 1f 10 8a 01 50 83 04 11 10 0d 01 06 09 2e 0a 86 01 2b fe be fe b4 56 74 07 cc fe b8 04 5e fe 11 85 ea 4c a5 55 02 18 fd e8 16 56 61 5d 1c 48 fb 2c 01 ef fb a2 01 87 01 ee fc 8b 00 00 01 00 0a 00 00 04 96 04 5e 00 0b 00 26 00 b2 00 01 00 2b b0 08 33 b2 02 02 00 2b b0 05 33 01 b0 0c 2f b1 0d 01 2b 00 b1 02 00 11 12 b1 04 0a 39 39 30 31 33 09 01 21 1b 01 21 09 01 21 0b 01 0a 01 7b Data Ascii: ++ #999........@...........@9901!36?!3>7!!#!0 P.+Vt^LUVa]H,^&+3+3/+99013!!!{
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: 1f 00 6e 00 b2 09 03 00 2b b1 0a 05 e9 b0 19 2f b1 18 05 e9 b0 00 2f b1 01 06 e9 01 b0 20 2f b0 1c d6 b0 04 32 b4 15 08 00 1f 04 2b b0 0d 32 b2 15 1c 0a 2b b3 40 15 19 09 2b b0 09 32 b2 1c 15 0a 2b b3 40 1c 00 09 2b b1 21 01 2b b1 15 1c 11 12 b0 10 39 00 b1 00 18 11 12 b1 13 1c 39 39 b0 01 11 b1 0f 11 39 39 b0 0a 12 b1 06 0e 39 39 30 31 13 35 32 36 3d 01 11 34 36 33 15 0e 01 15 11 06 07 15 16 1d 01 11 14 16 17 15 22 26 35 11 34 26 1f 7e 82 c2 f4 63 4b 06 e4 ea 4a 64 f4 c2 83 01 c1 ef 58 52 08 01 3e 99 7d e1 03 46 44 fe d5 bc 22 0c 23 b1 09 fe d5 44 46 03 e2 7d 9a 01 3b 57 5c 00 00 00 00 01 01 c7 fe 2f 02 a2 06 0e 00 03 00 1d 00 01 b0 04 2f b0 00 d6 b4 03 08 00 11 04 2b b4 03 08 00 11 04 2b b1 05 01 2b 00 30 31 01 11 33 11 01 c7 db fe 2f 07 df f8 21 00 01 Data Ascii: n+// /2+2+@+2+@+!+999999901526=463"&54&~cKJdXR>}FD"#DF};W\//+++013/!
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: b0 04 2f b1 00 01 2b b4 03 0a 00 07 04 2b b1 05 01 2b 00 30 31 01 35 21 15 01 1b 02 a6 04 d9 d3 d3 00 01 00 e3 04 d9 03 f6 06 2b 00 0d 00 4d 00 b0 0b 2f b1 05 05 e9 b2 05 0b 0a 2b b3 40 05 08 09 2b b0 00 32 01 b0 0e 2f b0 00 d6 b4 01 08 00 0b 04 2b b0 01 10 b1 07 01 2b b4 08 08 00 0b 04 2b b1 0f 01 2b b1 01 00 11 12 b0 0d 39 b0 07 11 b0 0b 39 b0 08 12 b0 09 39 00 30 31 13 33 1e 02 33 32 37 33 0e 01 23 22 26 e3 aa 04 2f 55 55 ce 10 ae 0c dc a6 ae cf 06 2b 2f 36 18 7d 9a b8 b6 00 00 01 00 93 04 e9 01 df 06 14 00 08 00 28 00 b0 07 2f b4 02 04 00 23 04 2b b4 02 04 00 23 04 2b 01 b0 09 2f b0 00 d6 b1 04 0a e9 b1 04 0a e9 b1 0a 01 2b 00 30 31 13 34 33 32 15 14 06 23 22 93 a6 a6 53 53 a6 05 7f 95 95 47 4f 00 00 02 01 54 04 d7 03 4a 06 b2 00 0b 00 17 00 4c 00 b0 Data Ascii: /+++015!+M/+@+2/++++9990133273#"&/UU+/6}(/#+#+/+01432#"SSGOTJL
2024-05-27 00:35:55 UTC	1938	IN	Data Raw: 12 b0 07 39 30 31 33 11 21 11 33 20 16 15 14 06 23 27 33 32 35 34 26 2b 01 01 11 21 11 a0 01 31 93 01 00 f6 f6 f5 9e 8d cb 68 67 89 03 2b 01 31 04 5e fe 50 a4 a6 b1 b3 d3 8d 41 3a fe 25 04 5e fb a2 00 00 00 00 02 00 a0 00 00 04 a2 04 5e 00 09 00 11 00 42 00 b2 09 01 00 2b b1 0a 05 e9 b2 01 02 00 2b b4 03 11 09 01 0d 2b b1 03 05 e9 01 b0 12 2f b0 00 d6 b1 0a 08 e9 b0 02 32 b0 0a 10 b1 0d 01 2b b1 07 08 e9 b1 13 01 2b 00 b1 11 0a 11 12 b0 07 39 30 31 33 11 21 11 33 20 16 15 10 21 27 33 32 35 34 26 2b 01 a0 01 31 d7 01 02 f8 fe 12 e3 d5 cb 68 67 d1 04 5e fe 50 a4 a6 fe 9c d3 8d 41 3a 00 00 01 00 4a ff ec 03 bc 04 73 00 19 00 61 00 b2 18 01 00 2b b1 03 05 e9 b2 12 02 00 2b b1 0c 05 e9 b4 08 07 18 12 0d 2b b4 08 05 00 14 04 2b 01 b0 1a 2f b0 06 d6 b0 09 32 b1 Data Ascii: 9013!3 #'3254&+!1hg+1^PA:%^^B+++/2++9013!3 !'3254&+1hg^PA:Jsa++++/2
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: c2 fe 2f 04 ac 00 00 ff ff 00 a0 00 00 04 f4 06 21 12 26 01 e9 00 00 10 07 00 76 00 ae 00 00 ff ff 00 a0 00 00 05 23 06 21 12 26 01 e7 00 00 10 06 00 43 0c 00 00 00 ff ff 00 00 fe 14 04 8d 06 3f 12 26 00 5c 00 00 10 06 03 8d fb 00 00 00 00 01 00 a0 fe 6f 04 c1 04 5e 00 0b 00 4b 00 b2 0b 01 00 2b b0 07 33 b1 03 05 e9 b2 0b 03 0a 2b b3 40 0b 0a 09 2b b2 05 02 00 2b b0 01 33 01 b0 0c 2f b0 00 d6 b1 03 08 e9 b0 03 10 b1 0a 01 2b b4 09 08 00 25 04 2b b0 09 10 b1 04 01 2b b1 07 08 e9 b1 0d 01 2b 00 30 31 33 11 21 11 21 11 21 11 21 11 21 11 a0 01 31 01 be 01 32 fe 78 fe ee 04 5e fc 87 03 79 fb a2 fe 6f 01 91 00 01 00 77 ff ec 08 3d 05 c9 00 32 00 8d 00 b2 30 01 00 2b b0 2a 33 b1 10 04 e9 b0 17 32 b2 10 30 0a 2b b3 40 10 13 09 2b b2 03 03 00 2b b0 24 33 b1 0a 06 Data Ascii: /!&v#!&C?&\o^K+3+@++3/+%+++013!!!!!12x^yow=20+*320+@++$3
2024-05-27 00:35:55 UTC	1024	IN	Data Raw: 09 2b b2 01 03 00 2b b0 07 33 b1 00 04 e9 b0 03 32 01 b0 10 2f b0 0e d6 b1 05 0a e9 b2 05 0e 0a 2b b3 40 05 03 09 2b b2 0e 05 0a 2b b3 40 0e 00 09 2b b0 05 10 b1 06 01 2b b1 09 0a e9 b0 09 10 b1 0c 0b 2b b1 0b 08 e9 b1 11 01 2b 00 b1 00 05 11 12 b1 09 0a 39 39 30 31 13 11 21 11 21 11 21 11 21 11 21 11 21 11 21 11 29 04 3b fe 69 02 1a 01 36 01 2b fe d5 fb 7b 04 b4 01 02 fe fe fc 4e 04 b4 fb 54 fd 4c 01 aa 04 b4 00 00 01 00 2f fe 6f 06 37 04 5e 00 0f 00 5d 00 b2 0e 01 00 2b b1 05 05 e9 b0 09 32 b2 01 02 00 2b b0 07 33 b1 00 05 e9 b0 03 32 01 b0 10 2f b0 0e d6 b1 05 08 e9 b2 05 0e 0a 2b b3 40 05 03 09 2b b2 0e 05 0a 2b b3 40 0e 00 09 2b b0 05 10 b1 06 01 2b b1 09 08 e9 b0 09 10 b1 0c 0b 2b b4 0b 08 00 25 04 2b b1 11 01 2b 00 30 31 13 35 21 15 21 11 21 11 21 Data Ascii: ++32/+@++@++++9901!!!!!!!);i6+{NTL/o7^]+2+32/+@++@+++%++015!!!!
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: c8 02 be 01 a0 fe 67 92 01 00 f1 10 29 01 e3 fb a2 01 bc 36 13 f2 d9 04 bb 00 00 00 01 00 b8 00 00 05 66 05 b6 00 13 00 4a 00 b2 00 01 00 2b b0 0a 33 b2 01 03 00 2b b4 06 0f 00 01 0d 2b b1 06 04 e9 b0 12 20 d6 11 b1 03 06 e9 01 b0 14 2f b0 00 d6 b1 13 0a e9 b0 02 32 b0 13 10 b1 0b 01 2b b1 0a 0a e9 b1 15 01 2b b1 0b 13 11 12 b0 06 39 00 30 31 33 11 21 11 3e 01 33 32 16 15 11 21 11 34 26 23 22 06 07 11 b8 01 36 93 d6 5b ce e6 fe cb 62 75 4f a7 76 05 b6 fd cb 33 27 c7 b8 fd a4 02 04 6a 6b 20 2a fd 71 00 00 00 00 01 00 a0 00 00 04 c5 04 5e 00 11 00 49 00 b2 0b 01 00 2b b0 00 33 b2 01 02 00 2b b4 06 0e 0b 01 0d 2b b1 06 05 e9 01 b0 12 2f b0 00 d6 b1 11 08 e9 b0 02 32 b0 11 10 b1 0b 01 2b b1 0a 08 e9 b1 13 01 2b b1 0b 11 11 12 b0 06 39 00 b1 06 0e 11 12 b0 03 Data Ascii: g)6fJ+3++ /2++9013!>32!4&#"6[buOv3'jk *q^I+3++/2++9
2024-05-27 00:35:55 UTC	1024	IN	Data Raw: 2f 01 91 4c 40 60 71 fe b4 00 00 00 01 00 23 00 00 04 27 05 b6 00 11 00 6a 00 b2 10 01 00 2b b2 03 03 00 2b b1 06 07 e9 b4 00 01 10 03 0d 2b b0 0b 33 b4 00 05 00 14 04 2b b0 0d 32 b4 07 0a 10 03 0d 2b b1 07 07 e9 01 b0 12 2f b0 10 d6 b0 02 32 b1 0f 08 e9 b1 06 0a 32 32 b2 0f 10 0a 2b b3 40 0f 0d 09 2b b3 40 0f 05 09 2b b3 40 0f 09 09 2b b2 10 0f 0a 2b b3 40 10 00 09 2b b1 13 01 2b 00 30 31 13 35 33 11 21 15 21 11 21 15 21 15 21 15 21 11 21 11 23 95 03 6f fd c2 02 19 fd e7 01 3c fe c4 fe cf 01 06 b2 03 fe fe fe b0 fe b2 b2 fe fa 01 06 00 00 00 00 01 00 52 00 00 04 6a 05 cb 00 25 00 8f 00 b2 00 01 00 2b b1 23 04 e9 b0 01 32 b2 0f 03 00 2b b1 15 06 e9 b4 05 06 00 0f 0d 2b b0 1d 33 b4 05 05 00 14 04 2b b0 1f 32 b4 0a 09 00 0f 0d 2b b0 1b 33 b4 0a 05 00 14 04 Data Ascii: /L@`q#'j+++3+2+/222+@+@+@++@++0153!!!!!!!#o<Rj%+#2++3+2+3
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: f3 39 ff 00 3b 01 0a eb 00 00 00 00 04 00 3f ff ec 06 1d 05 c1 00 14 00 18 00 24 00 30 00 b4 00 b2 15 01 00 2b b2 22 01 00 2b b4 28 05 00 0c 04 2b b2 03 03 00 2b b0 16 33 b4 08 05 00 0c 04 2b b4 2e 1c 22 03 0d 2b b4 2e 05 00 0c 04 2b b4 0d 12 22 03 0d 2b b4 0d 05 00 0c 04 2b 01 b0 31 2f b0 00 d6 b4 0b 08 00 11 04 2b b0 0b 10 b1 19 01 2b b4 25 08 00 11 04 2b b0 25 10 b1 2b 01 2b b4 1f 08 00 11 04 2b b1 32 01 2b b1 0b 00 11 12 b0 15 39 b0 19 11 b4 03 05 0f 12 18 24 17 39 b0 25 12 b0 16 39 b0 2b 11 b2 1c 22 17 39 39 39 00 b1 2e 28 11 12 b1 1f 19 39 39 b1 0d 12 11 12 b0 10 39 b0 08 11 b2 00 06 0f 39 39 39 b0 03 12 b0 05 39 30 31 13 34 36 33 32 17 07 26 23 22 06 15 14 33 32 37 15 06 23 22 26 13 01 33 09 01 34 36 33 32 16 15 14 06 23 22 26 37 14 16 33 32 36 35 Data Ascii: 9;?$0+"+(++3+."+.+"++1/++%+%+++2+9$9%9+"999.(9999999014632&#"327#"&34632#"&73265

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	18.173.205.95	443	2800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 00:35:54 UTC	631	OUT	GET /mail/forms/lib/open-sans/regular/opensans-regular-webfont.ttf HTTP/1.1 Host: cdn.intertek.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://lp.intertek.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.intertek.com/mail/forms/css/sai-app3.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 00:35:55 UTC	596	IN	HTTP/1.1 200 OK Content-Type: application/x-font-ttf Content-Length: 106252 Connection: close Date: Mon, 27 May 2024 00:35:55 GMT Last-Modified: Thu, 10 Jan 2019 15:14:12 GMT ETag: "cd7296352d159532b66c07d98efb1126" x-amz-meta-sha256: 52bab2720136d9c479b90581eeb14ed7dd92f73dd11f76c08ce0eba13c2f2821 x-amz-meta-s3b-last-modified: 20180626T165329Z Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 8576ee57c8a84a61190d4c1b31b69a90.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: Pnm6EwnoyMQavKjg5eWFjdmGPxUoX07ngFI5B3isn24RzLB1haU3DQ==
2024-05-27 00:35:55 UTC	3482	IN	Data Raw: 00 01 00 00 00 12 01 00 00 04 00 20 46 46 54 4d 5d c5 46 7e 00 00 01 2c 00 00 00 1c 47 44 45 46 03 de 00 03 00 00 01 48 00 00 00 20 47 50 4f 53 6c 91 74 8f 00 00 01 68 00 00 00 20 47 53 55 42 48 8f b8 db 00 00 01 88 00 00 02 8a 4f 53 2f 32 a1 36 9e d6 00 00 04 14 00 00 00 60 63 6d 61 70 cd 2a 1c 8d 00 00 04 74 00 00 04 7e 63 76 74 20 0b 07 0e 4a 00 00 08 f4 00 00 00 44 66 70 67 6d 0f b4 2f a7 00 00 09 38 00 00 02 65 67 61 73 70 00 00 00 10 00 00 0b a0 00 00 00 08 67 6c 79 66 68 39 4b f8 00 00 0b a8 00 01 5a 1c 68 65 61 64 fa 7c b0 50 00 01 65 c4 00 00 00 36 68 68 65 61 0d cc 09 7d 00 01 65 fc 00 00 00 24 68 6d 74 78 f3 52 3e 82 00 01 66 20 00 00 0e bc 6c 6f 63 61 77 fc d0 92 00 01 74 dc 00 00 07 64 6d 61 78 70 04 e7 02 ad 00 01 7c 40 00 00 00 20 6e 61 6d Data Ascii: FFTM]F~,GDEFH GPOSlth GSUBHOS/26`cmap*t~cvt JDfpgm/8egaspglyfh9KZhead\|Pe6hhea}e$hmtxR>f locawtdmaxp\|@ nam
2024-05-27 00:35:55 UTC	8949	IN	Data Raw: 36 1a ba 3e c2 f3 73 00 15 2b 0a ba 3e d8 f3 e4 00 15 2b 0a b0 1a 10 b3 02 1a 07 13 2b b3 03 1a 07 13 2b b3 06 1a 07 13 2b b0 19 10 b3 09 19 08 13 2b b0 16 10 b3 0a 16 0b 13 2b b0 15 10 b3 0d 15 0c 13 2b b3 10 15 0c 13 2b b3 11 15 0c 13 2b b3 14 15 0c 13 2b b0 16 10 b3 17 16 0b 13 2b b0 19 10 b3 18 19 08 13 2b b0 1a 10 b3 1b 1a 07 13 2b b0 19 10 b3 1c 19 08 13 2b b0 16 10 b3 1d 16 0b 13 2b b3 1e 16 0b 13 2b b0 19 10 b3 1f 19 08 13 2b 03 40 10 02 03 06 09 0a 0d 10 11 14 17 18 1b 1c 1d 1e 1f 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e b0 40 1a 00 30 31 13 35 21 13 21 35 21 13 33 03 21 13 33 03 21 15 21 03 21 15 21 03 23 13 21 03 23 13 37 21 13 21 33 01 1f 44 fe eb 01 2b 52 8b 52 01 31 54 86 54 01 08 fe df 42 01 1b fe cd 54 89 54 fe d1 52 88 50 a2 01 2f Data Ascii: 6>s+>+++++++++++++++++@................@015!!5!3!3!!!!#!#7!!3D+RR1TTBTTRP/
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: f2 fe f2 fe d5 4f 52 8d 02 25 e7 c7 df d1 d6 d2 c3 00 01 00 73 ff ec 03 8b 04 5c 00 16 00 3d 00 b2 14 01 00 2b b1 0f 0c e9 b2 03 02 00 2b b1 0a 0d e9 01 b0 17 2f b0 00 d6 b1 0c 0f e9 b1 18 01 2b 00 b1 0f 14 11 12 b0 12 39 b0 0a 11 b2 00 07 11 39 39 39 b0 03 12 b0 06 39 30 31 13 10 00 33 32 16 17 07 2e 01 23 20 11 14 16 33 32 37 15 06 23 22 00 73 01 09 f5 4f 9e 2d 33 37 82 32 fe b2 a3 a0 89 90 6e a7 ee fe fb 02 1d 01 13 01 2c 22 17 8d 16 1d fe 56 ca d8 3b 93 39 01 25 00 02 00 73 ff ec 04 37 06 14 00 12 00 1f 00 63 00 b2 0c 01 00 2b b2 10 01 00 2b b1 16 0b e9 b2 03 02 00 2b b1 1d 0b e9 01 b0 20 2f b0 00 d6 b1 13 0f e9 b0 13 10 b1 19 01 2b b0 08 32 b1 0b 17 e9 b0 0b 10 b1 0c 14 e9 b0 0c 2f b1 21 01 2b b1 19 13 11 12 b3 05 03 0e 10 24 17 39 b0 0c 11 b0 06 39 Data Ascii: OR%s\=++/+999990132.# 327#"sO-372n,"V;9%s7c+++ /+2/!+$99
2024-05-27 00:35:55 UTC	9483	IN	Data Raw: 52 ff ff 00 b0 00 00 03 27 06 21 12 26 00 55 00 00 10 06 00 76 dc 00 00 00 ff ff 00 c9 fe 3b 04 cf 05 b6 12 26 00 35 00 00 10 06 03 8f 7d 00 00 00 ff ff 00 60 fe 3b 03 27 04 5c 12 26 00 55 00 00 10 07 03 8f fe ef 00 00 ff ff 00 c9 00 00 04 cf 07 73 12 26 00 35 00 00 10 07 01 55 00 1b 01 52 ff ff 00 82 00 00 03 27 06 21 12 26 00 55 00 00 10 07 01 55 ff 76 00 00 ff ff 00 6a ff ec 04 02 07 73 12 26 00 36 00 00 10 07 00 76 00 50 01 52 ff ff 00 6a ff ec 03 73 06 21 12 26 00 56 00 00 10 06 00 76 ea 00 00 00 ff ff 00 6a ff ec 04 02 07 73 12 26 00 36 00 00 10 07 01 54 ff ea 01 52 ff ff 00 6a ff ec 03 73 06 21 12 26 00 56 00 00 10 06 01 54 97 00 00 00 ff ff 00 6a fe 14 04 02 05 cb 12 26 00 36 00 00 10 07 00 7a 01 27 00 00 ff ff 00 6a fe 14 03 73 04 5c 12 26 00 56 Data Ascii: R'!&Uv;&5}`;'\&Us&5UR'!&UUvjs&6vPRjs!&Vvjs&6TRjs!&VTj&6z'js\&V
2024-05-27 00:35:55 UTC	8949	IN	Data Raw: fd 3c 4a 37 12 83 18 fd 02 d1 fc 46 03 ba 00 02 00 a6 fe 14 04 62 04 5c 00 10 00 1c 00 56 00 b2 0a 01 00 2b b1 13 0b e9 b2 04 02 00 2b b1 19 0b e9 b0 00 2f 01 b0 1d 2f b0 00 d6 b1 10 0f e9 b0 11 32 b0 10 10 b1 16 01 2b b1 07 0f e9 b1 1e 01 2b b1 10 00 11 12 b0 0c 39 b0 16 11 b1 0a 04 39 39 00 b1 13 0a 11 12 b1 0c 0d 39 39 b0 19 11 b0 07 39 30 31 13 11 10 12 33 32 12 11 10 00 23 22 27 23 16 15 19 01 16 33 32 36 35 34 26 23 22 06 15 a6 fb ea db fc ff 00 e9 b3 78 08 08 7a b7 9f 98 90 a3 9e 97 fe 14 04 1f 01 0a 01 1f fe d1 fe f8 fe f1 fe d6 5e 3d d4 fe db 02 c9 66 d0 de d6 d4 cf d1 00 00 00 00 01 00 73 fe 6f 03 a2 04 5c 00 20 00 4a 00 b2 03 02 00 2b b1 09 0d e9 01 b0 21 2f b0 00 d6 b1 0c 0f e9 b0 0c 10 b1 1a 01 2b b1 13 16 e9 b0 06 32 b1 22 01 2b b1 1a 0c 11 Data Ascii: <J7Fb\V++//2++9999990132#"'#32654&#"xz^=fso\ J+!/+2"+
2024-05-27 00:35:55 UTC	8459	IN	Data Raw: 12 19 e9 b0 12 10 b1 15 01 2b b1 03 0e 32 32 b1 19 16 e9 b1 05 0c 32 32 b0 19 10 b1 1c 01 2b b1 09 0f e9 b1 20 01 2b 00 b1 15 0f 11 12 b1 0b 10 39 39 b0 16 11 b1 09 00 39 39 b0 03 12 b0 02 39 30 31 13 34 00 25 11 33 11 16 00 15 14 00 07 11 23 11 26 00 37 14 16 17 11 0e 01 01 3e 01 35 10 25 71 01 1f 00 ff 9e fb 01 1e fe e5 fe a4 f8 fe e0 ae b0 c0 b9 b7 02 0e be af fe 93 02 25 f9 01 26 14 01 bc fe 44 17 fe d4 f0 f9 fe d9 15 fe 24 01 dc 13 01 2e f4 c0 da 12 03 54 11 cf fd 8c 13 da bf 01 7f 27 ff ff 00 27 00 00 04 08 04 48 12 06 00 5b 00 00 00 01 00 b0 fe 85 04 dd 04 48 00 0b 00 47 00 b2 00 01 00 2b b1 03 0c e9 b0 07 32 b2 00 03 0a 2b b3 40 00 0a 09 2b b2 01 02 00 2b b0 05 33 01 b0 0c 2f b0 00 d6 b1 03 17 e9 b0 03 10 b1 04 01 2b b1 07 17 e9 b3 0a 07 04 08 2b Data Ascii: +2222+ +99999014%3#&7>5%q%&D$.T''H[HG+2+@++3/++
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: b3 39 34 41 08 2b b0 38 33 b1 3c 08 e9 b1 30 3d 32 32 01 b0 55 2f b0 00 d6 b1 0c 1a e9 b0 0c 10 b1 30 01 2b b1 45 12 e9 b0 45 10 b1 49 01 2b b1 53 11 e9 b2 49 53 0a 2b b3 40 49 46 09 2b b3 00 49 4e 09 2b b0 53 10 b1 18 01 2b b1 24 1a e9 b1 56 01 2b b0 36 1a ba f0 7d c1 e9 00 15 2b 0a b0 40 2e b0 38 2e b0 40 10 b1 35 08 f9 b0 38 10 b1 3d 08 f9 ba ec 91 c3 06 00 15 2b 0b b0 35 10 b3 36 35 38 13 2b b3 37 35 38 13 2b b0 40 10 b3 3e 40 3d 13 2b b3 3f 40 3d 13 2b b2 36 35 38 20 8a 20 8a 23 06 0e 11 12 39 b0 37 39 b2 3f 40 3d 11 12 39 b0 3e 39 00 b3 36 37 3e 3f 2e 2e 2e 2e 01 b7 35 36 37 38 3d 3e 3f 40 2e 2e 2e 2e 2e 2e 2e 2e b0 40 1a 01 b1 30 0c 11 12 b3 09 03 0f 2d 24 17 39 b0 45 11 b0 06 39 b0 49 12 b3 12 2a 34 05 24 17 39 b1 18 53 11 12 b4 15 1f 21 27 3a 24 Data Ascii: 94A+83<0=22U/0+EEI+SIS+@IF+IN+S+$V+6}+@.8.@58=+5658+758+@>@=+?@=+658 #979?@=9>967>?....5678=>?@........@0-$9E9I*4$9S!':$
2024-05-27 00:35:55 UTC	10463	IN	Data Raw: 14 96 a6 04 46 8c fc d5 fd f8 01 79 00 00 ff ff 00 c9 00 00 06 0a 07 25 12 26 01 da 00 00 10 07 00 6a 01 1b 01 52 ff ff 00 b0 00 00 05 79 05 d3 12 26 01 fa 00 00 10 07 00 6a 00 c5 00 00 ff ff 00 2f fe 75 04 08 05 b6 12 26 02 40 00 00 10 07 03 9f 00 93 00 00 ff ff 00 12 fe 75 03 42 04 48 12 26 02 41 00 00 10 06 03 a0 75 00 00 00 ff ff 00 08 fe 75 04 c9 05 b6 10 26 00 3b 00 00 10 07 03 9f 03 58 00 00 ff ff 00 27 fe 75 04 34 04 48 10 26 00 5b 00 00 10 07 03 a0 02 c3 00 00 00 01 00 06 00 00 04 96 05 b6 00 11 00 3d 00 b2 0f 01 00 2b b0 00 33 b2 05 03 00 2b b0 08 33 b4 03 02 0f 05 0d 2b b0 0c 33 b1 03 04 e9 b0 0a 32 01 b0 12 2f b1 13 01 2b 00 b1 02 0f 11 12 b0 10 39 b1 05 03 11 12 b0 07 39 30 31 33 01 21 35 21 01 33 09 01 33 01 21 15 21 01 23 09 01 06 01 bf fe Data Ascii: Fy%&jRy&j/u&@uBH&Auu&;X'u4H&[=+3+3+32/+99013!5!33!!#
2024-05-27 00:35:55 UTC	16384	IN	Data Raw: 12 b1 08 26 39 39 00 b1 1e 23 11 12 b0 21 39 b0 00 11 b0 20 39 b1 10 07 11 12 b0 0e 39 b0 0b 11 b0 0d 39 30 31 13 35 33 27 35 37 23 35 33 12 00 33 32 17 07 26 23 20 03 21 15 21 07 15 17 21 15 21 1e 01 33 32 37 15 06 23 22 00 03 3f 98 02 02 98 a4 27 01 24 ed c9 a5 47 a6 81 fe c1 4f 01 fe fd f4 02 02 01 cf fe 41 25 cb aa 9c 99 92 ab ed fe df 2e 01 fa 81 2a 2c 50 81 01 05 01 24 61 8b 56 fe 6d 81 39 40 2d 81 b4 c5 42 96 41 01 0d 01 01 00 00 00 04 00 8d ff f8 06 0a 05 c1 00 13 00 17 00 23 00 2b 00 95 00 b2 21 01 00 2b b0 14 33 b1 26 06 e9 b2 03 03 00 2b b0 15 33 b1 08 06 e9 b4 2a 1b 21 03 0d 2b b1 2a 06 e9 b4 0c 11 21 03 0d 2b b1 0c 06 e9 01 b0 2c 2f b0 00 d6 b1 0a 13 e9 b0 0a 10 b1 18 01 2b b1 24 14 e9 b0 24 10 b1 28 01 2b b1 1e 14 e9 b1 2d 01 2b b1 18 0a 11 Data Ascii: &99#!9 9990153'57#5332&# !!!!327#"?'$GOA%.,P$aVm9@-BA#+!+3&+3!+*!+,/+$$(+-+
2024-05-27 00:35:55 UTC	7315	IN	Data Raw: 40 02 41 02 42 02 43 02 44 02 45 02 46 02 47 02 48 02 49 02 4a 02 4b 02 4c 02 4d 02 4e 02 4f 02 50 02 51 02 52 02 53 02 54 02 55 02 56 02 57 02 58 02 59 02 5a 02 5b 02 5c 02 5d 02 5e 02 5f 02 60 02 61 02 62 02 63 02 64 02 65 02 66 02 67 02 68 02 69 02 6a 02 6b 02 6c 02 6d 02 6e 02 6f 02 70 02 71 02 72 02 73 02 74 02 75 02 76 02 77 02 78 02 79 02 7a 02 7b 02 7c 02 7d 02 7e 02 7f 02 80 02 81 02 82 02 83 02 84 02 85 02 86 02 87 02 88 02 89 02 8a 02 8b 02 8c 02 8d 02 8e 02 8f 02 90 02 91 02 92 02 93 02 94 02 95 02 96 02 97 02 98 02 99 02 9a 02 9b 02 9c 02 9d 02 9e 02 9f 02 a0 02 a1 02 a2 02 a3 02 a4 02 a5 02 a6 02 a7 02 a8 02 a9 02 aa 02 ab 02 ac 02 ad 02 ae 02 af 02 b0 02 b1 02 b2 02 b3 02 b4 02 b5 02 b6 02 b7 02 b8 02 b9 02 ba 02 bb 02 bc 02 bd 02 be 02 bf Data Ascii: @ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~

Target ID:	0
Start time:	20:35:39
Start date:	26/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:35:42
Start date:	26/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,5948841906140814486,6483114212248968445,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:35:44
Start date:	26/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
https://links.edm.saiglobal.com/els/v2/mW0NSwkwRaJ6/WmVFMGROMGZHZVhVT3JpSEFvSlUyS2preUEvYUdWNjdzdk9pVjMwUXZOcFR3T2xkcTlkMHhSeHhFY3VDdmMyUEhkTEcxVUtjZDVKdUpYRWJVcnhlSE95OThTeTEzTUxPYkk0SzlvNmpmbHpLYVAxOGtQTms4dz09S0/