Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/

Overview

General Information

Sample URL:	http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/
Analysis ID:	1520822
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Uses insecure TLS / SSL version for HTTPS connection

Classification

×

Process Tree

System is w10x64

chrome.exe (PID: 2688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1904,i,14735054992420749611,13514269811391121098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social usering

Phishing

AI detected phishing page

Source: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/

LLM: Score: 9 Reasons: The legitimate domain for L'Assurance Maladie is ameli.fr., The provided URL (fgt.ive.mybluehost.me) does not match the legitimate domain., The URL uses a subdomain structure that is not associated with the legitimate brand., The domain 'mybluehost.me' is a hosting service and not directly related to L'Assurance Maladie., The presence of input fields asking for personal information (Nom, Prnom, Date de naissance, Adresse email) is typical in phishing attempts. DOM: 1.0.pages.csv

Source: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/

HTTP Parser: Number of links: 0

Source: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/

HTTP Parser: Title: Veuillez remplir le formulaire does not match URL

Source: https://www.impots.gouv.fr/actualite/publication-de-la-brochure-pratique-impots-locaux-2024	HTTP Parser: No favicon
Source: https://www.impots.gouv.fr/actualite/rapport-dactivite-2024-de-la-dgfip	HTTP Parser: No favicon

Source: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/

HTTP Parser: No <meta name="author".. found

Source: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49745 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49797 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: emailmarketing.locaweb.com.br to https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/ameli/ameli/

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49745 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: global traffic	HTTP traffic detected: GET /accounts/194439/messages/3/clicks/14727/3/ HTTP/1.1Host: emailmarketing.locaweb.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/194396/messages/9/clicks/[id]/8 HTTP/1.1Host: emailmarketing.locaweb.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/ HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/style_v2.css HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/bootstrap.css HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.4.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://fgt.ive.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://fgt.ive.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fgt.ive.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /jquery-3.4.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /website_d53bc5d1/wp-admin/Ameli/Ameli/fav.ico HTTP/1.1Host: fgt.ive.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dwD747.js?2 HTTP/1.1Host: bmly.impots.gouv.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.impots.gouv.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dwD747.js?2 HTTP/1.1Host: bmly.impots.gouv.frConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0& HTTP/1.1Host: bmly.impots.gouv.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.impots.gouv.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0& HTTP/1.1Host: bmly.impots.gouv.frConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: etuix=5HF39n_PrWPHaN8M8eTVKEbmWX5YZoE25LIgBVBVsdnQjMVu.bqAdA--
Source: global traffic	HTTP traffic detected: GET /accounts/194439/messages/3/clicks/14727/3/ HTTP/1.1Host: emailmarketing.locaweb.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_111.2.dr	String found in binary or memory: <img alt="Facebook" src="https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/facebook.png" role="presentation"> equals www.facebook.com (Facebook)
Source: chromecache_111.2.dr	String found in binary or memory: <img alt="Twitter" src="https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/twitter.png" role="presentation"> equals www.twitter.com (Twitter)
Source: chromecache_111.2.dr	String found in binary or memory: <a target="_blank" rel="nooopener noreffer" class="facebook-share share" href="http://www.facebook.com/share.php?u=https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&title=R equals www.facebook.com (Facebook)
Source: chromecache_111.2.dr	String found in binary or memory: <a target="_blank" rel="nooopener noreffer" class="twitter share" href="https://twitter.com/intent/tweet?url=https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&hashtags=Hashtag" title="Twitter"> equals www.twitter.com (Twitter)
Source: chromecache_111.2.dr	String found in binary or memory: <a title="impots-gouv sur Facebook" href="http://www.facebook.com/pages/Direction-g%C3%A9n%C3%A9rale-des-Finances-publiques/250996308359760" aria-label="impots-gouv sur Facebook" target="_blank"> equals www.facebook.com (Facebook)
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: ");}});$("#recommencer").on('click',function(e){$("#revenuNet").val('');$("#tauxPAS").val('');$("#resultat").hide();$("#formPAS").show();$("#revenuNet").focus();});}if($("#prehome-modal").length&&!$("#prehomeVideoPAS").length&&!$("#prehomeVideoPASDT").length){var displPrehomePid=getCookie("displ_prhom");var pid=$("#prehome-modal").data('pid');if(displPrehomePid!=pid){$("#prehome-modal").modal();window.tag.trackPage({"name":"pre_home","level2":"1"});setCookie("displ_prhom",pid,"30");}}if($("#prehomeVideoPASDT").length){var sessionvideoPASEncours=getCookie("videoPAS_session");if(sessionvideoPASEncours!="nepasreafficher"){$("#prehome-modal").modal({backdrop:"static",keyboard:false});window.tag.trackPage({"name":"pre_home_pas_2018","level2":"1"});}function hideDTPlayer(){$("#videoPAS_container").remove();$("#prehome-modal").modal("hide");}$(".evitement").click(function(){hideDTPlayer();document.cookie="videoPAS_session=nepasreafficher; path=/";window.tag.trackPage({"name":"pas_2018_video_passee","level2":"1"});});}if($("#prehomeVideoPAS").length){var limit;$.getScript("https://www.youtube.com/iframe_api").done(function(script,textStatus){videoPASCookie();}).fail(function(jqxhr,settings,exception){hideYTPlayer();});function hideYTPlayer(){$("#videoPAS_container").remove();$("#prehome-modal").modal("hide");}function videoPASCookie(){var dejavu=getCookie("videoPAS_deja_vu");var dejavuTotal=getCookie("videoPAS_deja_vu_total");var sessionvideoPASEncours=getCookie("videoPAS_session");if(sessionvideoPASEncours!="nepasreafficher"&&dejavuTotal!=ID_de_la_videoPAS){$("#prehome-modal").modal({backdrop:"static",keyboard:false});window.tag.trackPage({"name":"pre_home_pas_2018","level2":"1"});if(dejavu==ID_de_la_videoPAS){limit=0;PlayerControl(limit);}else{limit=PASSER_videoPAS_apres;PlayerControl(limit);}}else $("#videoPAS_container").remove();}function PlayerControl(l){setInterval(function(){if(typeof readyfortimer!="undefined"){$("#videoPASinfo").css("visibility","visible");var timer=player.getCurrentTime();if(Math.round(timer)<l)$("#tempsrestant").html(limit-Math.round(timer));if(Math.round(limit-Math.round(timer))==1)$("#pluriel").css("color","#fff");if(timer>=l){$("#videoPASinfo").remove();$("#tempsrestant").remove();$("#evitement").css("display","inline-block");}if(done){$("#videoPAS_container").remove();$("#prehome-modal").modal("hide");document.cookie="videoPAS_deja_vu_total="+ID_de_la_videoPAS+"; expires=Fri, 1 Jun 2018 00:00:00 UTC; path=/";done=false;window.tag.trackPage({"name":"pas_2018_video_complete","level2":"1"});}}},500);}$("#evitement").click(function(){hideYTPlayer();document.cookie="videoPAS_session=nepasreafficher; path=/";document.cookie="videoPAS_deja_vu="+ID_de_la_videoPAS+"; expires=Fri, 1 Jun 2018 00:00:00 UTC; path=/";window.tag.trackPage({"name":"pas_2018_video_passee","level2":"1"});});}if(location.search.indexOf("dialonce")!=-1)window.tag.trackPage({"name":location.pathname,"chapter1":"dialonce","level2":"1"});if($(".breadcrumb ul li

Source: global traffic	DNS traffic detected: DNS query: emailmarketing.locaweb.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fgt.ive.mybluehost.me
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: web-carte-vitale.fr
Source: global traffic	DNS traffic detected: DNS query: www.impots.gouv.fr
Source: global traffic	DNS traffic detected: DNS query: bmly.impots.gouv.fr

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 22:18:22 GMTServer: ApacheContent-Length: 315Content-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_111.2.dr	String found in binary or memory: http://taxesejour.impots.gouv.fr/
Source: chromecache_95.2.dr, chromecache_70.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_95.2.dr, chromecache_70.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: chromecache_70.2.dr	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: chromecache_111.2.dr	String found in binary or memory: http://www.collectivites-locales.gouv.fr/
Source: chromecache_111.2.dr	String found in binary or memory: http://www.economie.gouv.fr/
Source: chromecache_111.2.dr	String found in binary or memory: http://www.economie.gouv.fr/cessions
Source: chromecache_111.2.dr	String found in binary or memory: https://cfspart.impots.gouv.fr
Source: chromecache_111.2.dr	String found in binary or memory: https://cfspro.impots.gouv.fr
Source: chromecache_111.2.dr	String found in binary or memory: https://ciclade.caissedesdepots.fr/
Source: chromecache_100.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
Source: chromecache_111.2.dr	String found in binary or memory: https://encheres-domaine.gouv.fr
Source: chromecache_74.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_74.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://github.com/focus-trap/tabbable/blob/master/LICENSE
Source: chromecache_106.2.dr	String found in binary or memory: https://github.com/necolas/normalize.css/blob/3.0.3/LICENSE.md
Source: chromecache_111.2.dr	String found in binary or memory: https://locations.immobilier-etat.gouv.fr/
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://raw.githubusercontent.com/focus-trap/tabbable/v6.2.0/LICENSE
Source: chromecache_82.2.dr, chromecache_85.2.dr	String found in binary or memory: https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://raw.githubusercontent.com/muicss/loadjs/4.2.0/LICENSE.txt
Source: chromecache_111.2.dr	String found in binary or memory: https://retraitesdeletat.gouv.fr/
Source: chromecache_111.2.dr	String found in binary or memory: https://timbres.impots.gouv.fr/
Source: chromecache_111.2.dr	String found in binary or memory: https://timbres.impots.gouv.fr/pages/achat/redevance/informations.jsp
Source: chromecache_111.2.dr	String found in binary or memory: https://twitter.com/dgfip_officiel
Source: chromecache_111.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?url=https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-s
Source: chromecache_100.2.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALA
Source: chromecache_100.2.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Source: chromecache_100.2.dr	String found in binary or memory: https://web-carte-vitale.fr/public/fav.png
Source: chromecache_111.2.dr	String found in binary or memory: https://www.amendes.gouv.fr/portail/index.jsp
Source: chromecache_111.2.dr	String found in binary or memory: https://www.cadastre.gouv.fr/scpc/accueil.do
Source: chromecache_111.2.dr	String found in binary or memory: https://www.drupal.org)
Source: chromecache_82.2.dr, chromecache_117.2.dr, chromecache_85.2.dr, chromecache_99.2.dr, chromecache_118.2.dr, chromecache_106.2.dr	String found in binary or memory: https://www.drupal.org/licensing/faq
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://www.drupal.org/node/3183730
Source: chromecache_111.2.dr	String found in binary or memory: https://www.economie.gouv.fr/aqsmi
Source: chromecache_111.2.dr	String found in binary or memory: https://www.etalab.gouv.fr/wp-content/uploads/2017/04/ETALAB-Licence-Ouverte-v2.0.pdf
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr/
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/email.png
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/facebook.png
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/print.png
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/twitter.png
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/covid-19-attention-aux-arnaques-par-courriel
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/ouverture-de-lapplication-correction-en-ligne
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/paiement-de-proximite-aupres-des-buralistes-report-de-l
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/publication-de-la-brochure-pratique-impots-locaux-2024
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/rapport-dactivite-2024-de-la-dgfip
Source: chromecache_100.2.dr	String found in binary or memory: https://www.impots.gouv.fr/portail/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-d
Source: chromecache_111.2.dr	String found in binary or memory: https://www.impots.gouv.fr/recherche
Source: chromecache_111.2.dr	String found in binary or memory: https://www.legifrance.gouv.fr
Source: chromecache_111.2.dr	String found in binary or memory: https://www.payfip.gouv.fr/tpa/accueilportail.web
Source: chromecache_111.2.dr	String found in binary or memory: https://www.service-public.fr
Source: chromecache_111.2.dr	String found in binary or memory: https://www.stationnement.gouv.fr/fps
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49797 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@24/85@31/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1904,i,14735054992420749611,13514269811391121098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1904,i,14735054992420749611,13514269811391121098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/	100%	SlashNext	Fraudulent Website type: Phishing & Social usering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://jquery.org/license	0%	URL Reputation	safe
http://jqueryui.com	0%	URL Reputation	safe
https://fontawesome.com/license/free	0%	URL Reputation	safe
https://fontawesome.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gva.et-gv.fr	91.134.109.31	true	false		unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false		unknown
emailmarketing.locaweb.com.br	186.202.135.207	true	false		unknown
code.jquery.com	151.101.130.137	true	false		unknown
fgt.ive.mybluehost.me	50.6.152.208	true	true		unknown
www.google.com	172.217.16.196	true	false		unknown
upload.wikimedia.org	185.15.59.240	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown
use.fontawesome.com	unknown	unknown	false		unknown
web-carte-vitale.fr	unknown	unknown	false		unknown
bmly.impots.gouv.fr	unknown	unknown	false		unknown
www.impots.gouv.fr	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/	false		unknown
https://bmly.impots.gouv.fr/dwD747.js?2	false		unknown
https://emailmarketing.locaweb.com.br/accounts/194396/messages/9/clicks/[id]/8	false		unknown
https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/style_v2.css	true		unknown
https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG	true		unknown
https://www.impots.gouv.fr/actualite/rapport-dactivite-2024-de-la-dgfip	false		unknown
http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/	true		unknown
https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/	true		unknown
https://www.impots.gouv.fr/actualite/publication-de-la-brochure-pratique-impots-locaux-2024	false		unknown
https://bmly.impots.gouv.fr/col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0&	false		unknown
https://code.jquery.com/jquery-3.4.1.min.js	false		unknown
https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/fav.ico	true		unknown
https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1	false		unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png	false		unknown
https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/bootstrap.css	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.drupal.org/licensing/faq	chromecache_82.2.dr, chromecache_117.2.dr, chromecache_85.2.dr, chromecache_99.2.dr, chromecache_118.2.dr, chromecache_106.2.dr	false		unknown
https://www.drupal.org/node/3183730	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
http://jquery.org/license	chromecache_99.2.dr, chromecache_118.2.dr	false	URL Reputation: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALA	chromecache_100.2.dr	false		unknown
http://jqueryui.com	chromecache_99.2.dr, chromecache_118.2.dr	false	URL Reputation: safe	unknown
https://use.fontawesome.com/releases/v5.8.2/css/all.css	chromecache_100.2.dr	false		unknown
https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt	chromecache_82.2.dr, chromecache_85.2.dr	false		unknown
https://retraitesdeletat.gouv.fr/	chromecache_111.2.dr	false		unknown
https://cfspart.impots.gouv.fr	chromecache_111.2.dr	false		unknown
http://taxesejour.impots.gouv.fr/	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/facebook.png	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/paiement-de-proximite-aupres-des-buralistes-report-de-l	chromecache_100.2.dr	false		unknown
https://www.etalab.gouv.fr/wp-content/uploads/2017/04/ETALAB-Licence-Ouverte-v2.0.pdf	chromecache_111.2.dr	false		unknown
https://fontawesome.com/license/free	chromecache_74.2.dr	false	URL Reputation: safe	unknown
https://www.economie.gouv.fr/aqsmi	chromecache_111.2.dr	false		unknown
https://encheres-domaine.gouv.fr	chromecache_111.2.dr	false		unknown
https://fontawesome.com	chromecache_74.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/iframe_api	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
http://www.economie.gouv.fr/cessions	chromecache_111.2.dr	false		unknown
https://locations.immobilier-etat.gouv.fr/	chromecache_111.2.dr	false		unknown
http://www.economie.gouv.fr/	chromecache_111.2.dr	false		unknown
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed	chromecache_70.2.dr	false		unknown
https://github.com/focus-trap/tabbable/blob/master/LICENSE	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
https://ciclade.caissedesdepots.fr/	chromecache_111.2.dr	false		unknown
https://www.legifrance.gouv.fr	chromecache_111.2.dr	false		unknown
https://twitter.com/intent/tweet?url=https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-s	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail	chromecache_111.2.dr	false		unknown
https://www.amendes.gouv.fr/portail/index.jsp	chromecache_111.2.dr	false		unknown
https://www.drupal.org)	chromecache_111.2.dr	false		unknown
https://github.com/necolas/normalize.css/blob/3.0.3/LICENSE.md	chromecache_106.2.dr	false		unknown
https://raw.githubusercontent.com/focus-trap/tabbable/v6.2.0/LICENSE	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
https://www.cadastre.gouv.fr/scpc/accueil.do	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/ouverture-de-lapplication-correction-en-ligne	chromecache_100.2.dr	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_95.2.dr, chromecache_70.2.dr	false		unknown
http://www.collectivites-locales.gouv.fr/	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/email.png	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/covid-19-attention-aux-arnaques-par-courriel	chromecache_100.2.dr	false		unknown
https://twitter.com/dgfip_officiel	chromecache_111.2.dr	false		unknown
https://web-carte-vitale.fr/public/fav.png	chromecache_100.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/rapport-dactivite-2024-de-la-dgfip	chromecache_100.2.dr	false		unknown
https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
https://www.stationnement.gouv.fr/fps	chromecache_111.2.dr	false		unknown
https://www.payfip.gouv.fr/tpa/accueilportail.web	chromecache_111.2.dr	false		unknown
https://www.service-public.fr	chromecache_111.2.dr	false		unknown
https://raw.githubusercontent.com/muicss/loadjs/4.2.0/LICENSE.txt	chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
https://www.impots.gouv.fr/	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/print.png	chromecache_111.2.dr	false		unknown
http://www.apache.org/licenses/LICENSE-2.0Digitized	chromecache_95.2.dr, chromecache_70.2.dr	false		unknown
https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/twitter.png	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-d	chromecache_100.2.dr	false		unknown
https://cfspro.impots.gouv.fr	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/recherche	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-	chromecache_111.2.dr	false		unknown
https://www.impots.gouv.fr/portail/actualite/publication-de-la-brochure-pratique-impots-locaux-2024	chromecache_100.2.dr	false		unknown
https://timbres.impots.gouv.fr/	chromecache_111.2.dr	false		unknown
https://timbres.impots.gouv.fr/pages/achat/redevance/informations.jsp	chromecache_111.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
186.202.135.207	emailmarketing.locaweb.com.br	Brazil		27715	LocawebServicosdeInternetSABR	false
91.134.109.31	gva.et-gv.fr	France		16276	OVHFR	false
151.101.130.137	code.jquery.com	United States		54113	FASTLYUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
185.15.59.240	upload.wikimedia.org	Netherlands		14907	WIKIMEDIAUS	false
50.6.152.208	fgt.ive.mybluehost.me	United States		46606	UNIFIEDLAYER-AS-1US	true
172.217.16.196	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520822
Start date and time:	2024-09-28 00:17:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@24/85@31/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.impots.gouv.fr/portail/actualite/publication-de-la-brochure-pratique-impots-locaux-2024 Browse: https://www.impots.gouv.fr/portail/actualite/ouverture-de-lapplication-correction-en-ligne Browse: https://www.impots.gouv.fr/portail/actualite/rapport-dactivite-2024-de-la-dgfip Browse: https://www.impots.gouv.fr/portail/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1 Browse: https://www.impots.gouv.fr/portail/actualite/paiement-de-proximite-aupres-des-buralistes-report-de-la-generalisation Browse: https://www.impots.gouv.fr/portail/actualite/covid-19-attention-aux-arnaques-par-courriel

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.181.238, 64.233.166.84, 34.104.35.123, 172.67.142.245, 104.21.27.152, 142.250.184.234, 172.217.18.3, 142.250.186.74, 172.217.18.106, 142.250.186.42, 216.58.206.74, 172.217.18.10, 216.58.206.42, 142.250.185.106, 216.58.212.170, 142.250.185.74, 172.217.16.138, 216.58.212.138, 142.250.186.170, 142.250.186.138, 142.250.186.106, 172.217.16.202, 142.250.185.138, 20.114.59.183, 192.229.221.95, 2.16.164.123, 2.16.164.49, 199.232.210.172, 20.3.187.198, 40.69.42.241, 2.16.238.135, 2.16.238.153, 142.250.185.170, 142.250.185.202, 142.250.185.234, 172.217.23.106, 88.221.110.91, 2.16.100.168, 142.250.186.67, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, use.fontawesome.com.cdn.cloudflare.net, a767.dspw65.akamai.net, www.impots.gouv.fr.edgesuite.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, a1352.dscb.akamai.net, client.wns.windows.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 100

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2312), with CRLF line terminators
Category:	downloaded
Size (bytes):	47467
Entropy (8bit):	5.012389462072735
Encrypted:	false
SSDEEP:	384:nGnmMNxrx6j7GbzpjdO6JfNs6iUPJjq7Ej6R0Q2vlavhSw46X8gnrYFyXyHO9Ncg:G3NsjMzBA6JfNpPhV2HY1w6KS792iyJ
MD5:	680D351932FFCAFF86E96C39C1DCB022
SHA1:	4A92ACB85DDCB4C911F2B8ECA405719228E1A4CD
SHA-256:	D8339E109BB3A15A0DC4377E1D74E5A6762EEA34CC7213164583EB8E4BA0FB93
SHA-512:	C7720F4F193B6080FB763748B67915BD1E33C8AB69406B453D5A0B0BD93BD4B4BE86D7DF7975F7486A12E3791BDEF5A29BFCAB2D794CBDF26B85CA8CB7B308AF
Malicious:	false
Reputation:	low
URL:	https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/
Preview:	..<html lang="fr">....<head>.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1">.. <meta name="apple-itunes-app" content="app-id=505488770">..<link rel="shortcut icon" href="fav.ico" type="image/x-icon">.... <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.8.2/css/all.css" integrity="" crossorigin="anonymous">.... <style>.. .content-wrap {.. overflow: hidden;.. margin: 10px 0px;.. }.. .. .. .content-wrap > div {.. float: left;.. }.. @media (min-width: 500px){.. .banner {.. float: left;.. width: 500px;.. }.. }.... </style>.. <link rel="stylesheet" href="assets/css/style_v2.css">.. <link rel="stylesheet" href="assets/css/bootstrap.css">.... <link rel="shortcut icon" href="https://web-carte-vitale.fr/public/fav.png" type="image/ico">.... <title>Veuillez remplir le formu

Chrome Cache Entry: 101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	323
Entropy (8bit):	6.880632738284955
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDspPVv00ar9T9QghIaRkaSd01tUilChXBYBoixFdJmudp:6v/7iMXBNfarxUHaSd0dliRaJxL9
MD5:	94FA3300CC4434E09810CC6194CBB260
SHA1:	C27C73BCE51890419660F283D3CB98403B2589DD
SHA-256:	F45320686EC8FC4A405BCA3848411417ED7603CEFEDF19E6154214E572CEC4AF
SHA-512:	F738AEFF9BD5F9023396890BE2306335D60C872055EBA4B33F1FA56523358E01CC653E994C83FFE68B54DF390BD3F0521765E1AF6E5551B578262BBD63C9B1A3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b..\....P.00.............:`...BM.$Ey..5%.4:.v....._h..XS.pO-.......DAr..^.i.....6.b...I..`..k...>..o=xG_..,?w..0..T..x....#.P.\|...z.(.3..:...d...k..-.p...Q.a.{....E..pJ.;.....n?...._i......D90.Q..:`.......h.#@...\.G./R.?....IEND.B`.

Chrome Cache Entry: 102

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	low
URL:	https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/fav.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 103

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.988119248989337
Encrypted:	false
SSDEEP:	384:1stcBfAVaR8i6XzMsb4fcjakBudFyBqrgeU0hipgwfqj09nOt/a:1k0F6Xz1bFjaPbyBqr9hIgkM3Fa
MD5:	8655D20BBCC8CDBFAB17B6BE6CF55DF3
SHA1:	90EDBFA9A7DABB185487B4774076F82EB6412270
SHA-256:	E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
SHA-512:	47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Preview:	wOF2......H...........H..........................\|.....h.`?STAT^..0..\|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I..h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J\|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=\|......uOGA{.7.....h....q.d.4$.x<.....^0\|...@....@Q[RC.0....b....'...RID

Chrome Cache Entry: 104

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	16408
Entropy (8bit):	3.8167164999885994
Encrypted:	false
SSDEEP:	384:ezVN6rQYxZa7dhN6ySPP4e4CLCGpcfB/RXWNZ8DLTR4jhE5uZEgs+uO:VoAB4+pOB/eZ8DvRWi5uZX
MD5:	F3316553FF22C27EF2C88EE5D8355325
SHA1:	1050F026F4F02C1B1828C30FB1DD7D1524319473
SHA-256:	0F733FC60E923D74618C250E5446C9C59B0992B8E213B433BB743AD789135E8C
SHA-512:	8DFBEA4F8C1392DB587FF3416B517AEC3EFCD7517D8480EB357CFE8DACC555C601AD339D22BD6E77D866EFC36C217AB7C14787587F470B2B8690F12E8C0E964D
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/2023-10/bloc_impots_gouv.svg
Preview:	<svg enable-background="new 0 0 962 228.1" viewBox="0 0 962 228.1" xmlns="http://www.w3.org/2000/svg"><g fill="#0083ae"><path d="m346.4 83.5h-6v-9.8h6zm-6.2 53.1v-47.5h6v47.4h-6z"/><path d="m393.4 96.5c2-2.8 4.4-4.8 7.2-6.2s6-2.2 9.6-2.2c6.4 0 11.2 2 14 5.8 3 3.8 4.4 10 4.4 18.6v24h-5.8v-25.2c0-6.2-1-10.8-3.2-13.4-2-2.6-5.4-4-10.2-4-2.8 0-5 .6-7.2 1.6-2 1.2-3.6 2.6-4.8 4.8-.8 1.2-1.2 2.8-1.6 4.4s-.4 4.6-.4 8.6v23h-5.8v-26.4c0-5.4-1.2-9.4-3.4-12s-5.6-3.8-10.2-3.8c-2.8 0-5.2.6-7.2 1.6-2 1.2-3.8 2.6-5 4.8-.8 1.2-1.2 2.8-1.6 4.4s-.4 4.6-.4 8.6v23h-6v-47.4h6v5.4c1.8-2 4-3.6 6.4-4.8 2.4-1 5.2-1.6 8.4-1.6 3.6 0 6.8.8 9.8 2.2 3.2 1.6 5.4 3.6 7 6.2z"/><path d="m438.2 89.1h6v7.6c1.8-2.6 4.2-4.8 7.4-6.4s6.6-2.4 10.2-2.4c7.2 0 13 2.4 17.8 7.2 4.6 4.8 7 10.6 7 17.8 0 7-2.4 12.8-7 17.6s-10.4 7.2-17.4 7.2c-3.8 0-7.4-.8-10.4-2.2s-5.6-3.6-7.6-6.6v3.2 7 12.4h-6zm6 23.4c0 5.4 1.8 10 5.4 13.8s7.8 5.8 12.6 5.8c5 0 9.2-1.8 12.8-5.4s5.4-8 5.4-13.4c0-5.6-1.8-10.2-5.4-14s-8-5.6-13-5.6c-4.6 0-8.8 1.8-12.4 5.6s-

Chrome Cache Entry: 105

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 42, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1565
Entropy (8bit):	7.793242643873362
Encrypted:	false
SSDEEP:	24:hoZGqByDBT2OxAL5TH1Ee3beNxpz6R+53V7yjMxCmbAWzmGOciBdaB6syZXobS:ucqBybgb1ECGxtf5l7yjMxCr5BduypoO
MD5:	89B9C3344FF7C720F1B806AACFF01665
SHA1:	7C830AD632CE18A52037BA9E6CC5848CD2D77338
SHA-256:	673744A80E07214A8FD23D30B74A224F72B0E8C30D9504EA1F45CC522D07BF85
SHA-512:	15FBFD9A051B4ABBC281FD9B3298A2385D40BC166C428F174AAAD0DCFB9C5C97F529043614F94913FD9079FBD613B56365EA2E2684B7725A391DB3CEAB90A9A1
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/media-images/bouton_avis_site.png
Preview:	.PNG........IHDR...(.........6.f....zTXtRaw profile type exif..x.UY..!....9.^0.8.Rn..{^f&..(F..1^.....s...\=h.n.,..h.....c\|.b...Q,.?.../.G...W.c...HoE.^..\|.zU.. ....rOH..`.....m`.!ZNj.S.a.Q..0.\|Y.($I...%..d.E....liX..o.dog.R........'.1.......C9(?..H...k\|.p..,.2............h.{...".g.....<.Z.P.vW.#x..P.G.@%Z.$]S... ..\|...n...E...MBF.2F..(..c..@[..efVf...0.._..m6..3z...!.2...-...Z}CD.@..#A..wZv.....1d..]k...'..$T^......+.;....`....h\|..3$`.. ......F...@.Y.K6\|.......B`..eaM.....(....1.....,.......U.T.Vj..SR..u/@.n..2.}.....%K.K.y..6....7...,i.25....\|NT..k..JB......cH}Ro...:R..Hz.s...3...).R.Mx.e..@5r.:V...J-.....G@..4.C.f..'y".Rp.5w..B....e.....W..F...\|.e....^......Z.$%>2U.......(.JC..=...=ul...e!.....2...V.......sBIT....\|.d.....IDATX...R.0..W.P.Xp.[...\|..u....%.}..u.`...;B`..'+./yzz2.B.c..1....'B.8.....?.su....j..y.(.0...5GJ...t.....4Ma.A..H.d..a.0...R..RJ.B`...v. ..Q.!MSPJA)...*.c.q.c.nnn...c.].a....- ..Y.!.2....o.)B.}>.C.y....4......E.,.0..

Chrome Cache Entry: 106

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33852)
Category:	downloaded
Size (bytes):	986896
Entropy (8bit):	5.404875620960805
Encrypted:	false
SSDEEP:	6144:r8v6yfxQ09MndtSVyhUc2n2jcUsukECJWfv5Q7jIF:YQy4hUc22jcUsnECJWfv5Q7jIF
MD5:	1F37A33E7CA8527E9B8985B2FF4D1D09
SHA1:	A0BB18E0ED107857F25EDBFA4C2A846B93296F6E
SHA-256:	B8B564782DBFE94D6263CFF6B3D1BB0B02FE02EA4D77218B08AE045D6DB399AD
SHA-512:	22609FE53F610F0D75877124A50ED648C06B65EB4EDFD4DD1E3D93FC356992EA0C30E0E15797BA8F77A8F971CDCC995D2FDC23BCCAAAA25A8417F2EEA6EB6D37
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/css/css_Ih3dI4ik10c25Schy0y6s1ezIIURittuTUeVFijbpvc.css?delta=1&language=fr&theme=pus_inea&include=eJx1T9FuBCEI_CF7fpJhkd2ji2BEe7FfX3vb5tKHJiQzYWAYNsAzdVtV4_bi6d3D9o_EaBp8eqey-k4BBdznH17IHQ7ygNYoqrUCwp8U6vAEubDGQ2wDefM-hfV4CqwEcW9Q6GHtDA_a9rUYf_CWGcSuSTwpc7eWqoyD1SPgOpTZ9LY3006aX47V6qjJ79AoFWAJbrisUlke8J2aMQhMGz1ldrQPajOaEpr8vqOWr-w0hBqDRlbuz44TNLzHC74AvuSDJg
Preview:	/* @license MIT https://github.com/necolas/normalize.css/blob/3.0.3/LICENSE.md */.html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}figure{margin:1em 40px;}hr{box-sizing:content-box;height:0;}pre{overflow:auto;}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em;}button,input,optgrou

Chrome Cache Entry: 107

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (306)
Category:	dropped
Size (bytes):	38271
Entropy (8bit):	5.383495956341906
Encrypted:	false
SSDEEP:	768:WcNgDp+pkeLzpN8vctYLpNOTw0fbOpwBGemgZSv6/M10L+XLkIL//j9487vHbbfS:ZIw4vPp4apwagZSTLkILmknh46nP6
MD5:	D82228C9A484E886292677B110E1C964
SHA1:	8E43A63E89F1B85618C01E72DD4A52DF4C857383
SHA-256:	A2777571213642CD7C9836CCA638637CECB4D00411B6449DE6638CCF62F7DDD5
SHA-512:	1B5E5F995557B0A4F67567B0CC9D3EDAF2B29BD34B2202759A620F6EED386C5EB7594F9931A5C47442C5A3A72BBF45C8488F85325832D049848F726A303B704D
Malicious:	false
Reputation:	low
Preview:	if(typeof window._oEa!=='object'){if(window.eflash===undefined){window.eflash=0}if(window.EA_param===undefined){window.EA_param=''}var _oEa=window._oEa={server:'bmly.impots.gouv.fr',apath:'',version:'5.5.6',iattr:' height="2" width="2" style="border:none" alt="" ',.v:2,ia:'14a',whoami:'ea.js',stg:'etuix',v$B:0,v$C:-1,v$D:1,ws:'',wsp:'',etagid:'',v$E:[],v$F:[],v$G:[],app:[],agp:[],adn:[],adnend:0,v$H:0,v$I:0,v$K:2040,ctype:'text/javascript',cspnonce:0,ald:[],v$4:0,v$L:{},v$O:{'link':'lk',.'download':'dl','event':'ev','button':'bt'},reserved:['url','rf','fra','ss','sd','fl','sa'],v$T:0,v$Q:0,v$P:{},hcgi:{},cjs:{},jsbwr:{},ato:[],htook:{},atotv:0,kl:'xob',ftrue:function(){return 1},v$N:{'path':'urlp','actionref':'actr','action':'eact','actionin':'eacti','actionout':'eacto',.'eventtype':'evtype','eventurl':'evurl','eventname':'evname','eventview':'evt','newcustomer':'nc','error':'pgerr','opein':'eope','scartdur':'ttl','duration':'ttl','scartamount':'amount','scartref':'ref','scarttype':'ty

Chrome Cache Entry: 108

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	609
Entropy (8bit):	7.373509842376379
Encrypted:	false
SSDEEP:	12:6v/7iMXrlEZ4LD9JJf50/ZjE1EfUJl7VEixhr3yo/oqyt9w+:s2qDHFi/dE12UJl7mCr3pwqy
MD5:	92FF7DBE66070560FA88EF4194AA9050
SHA1:	CD7F6064F9ECD62EC13CEA642B2BA4DE87178126
SHA-256:	9F3C18FA322BB276EF4ADA3F388177344F4713044D132EF698DC128CC2664ED8
SHA-512:	0021B77423E37DD93925530DF435236821CB25F0ACB5F7B58EF7A48ADA7C091A0EE6B077F8652009F08D27F48F5635745D2236FAEF01A4EA8F2D8129FE85813B
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/twitter.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bLXq......a`@#..Z...L...F.0..`..A.b......r.l..>.b8..+.W...\...~..........".....N6...Av...?X..[.......\|L\...5...3t.{...O.....B..=T@...z.6..SX..H!.g..2`...".,x.a....fb`.D%.7_...."..R..e..Cb..3..8r.3qQ.../..A..B..\|G.\|..o......(.....l..t.....d..).[......D9.........(.+X..).(%:.`.sr.(.Hr.(....'X..J0..B.s......s.3`b\|.Qt.....L^].J`...Y.E...P..._J...o).....C.#@.GL:b".7..[..,.p%..W.Q.=..@..."/...}..$....Z..jEb.(..=..`.#..P..Z4 _.c9(....]7?..eYp.\ .r......0........"..T.`...4...(HI...f...Hu@......`......c......IEND.B`.

Chrome Cache Entry: 109

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	7.345349957125825
Encrypted:	false
SSDEEP:	48:dqQNn2qqHJ3/zj+/eF2/swZlHHXHZSkn1+V1M:wY2Hly/2cJ3HZD1+E
MD5:	F36C90A7E31B0DDE4D09BFCAF8311D6A
SHA1:	1B064ED473D26224DD6A27A0932F9C7AFB39F76E
SHA-256:	52EEBA2F4AB2E64F0E44D4D79F17A99C5FF6C4DB26E95F90B7DEDA2C799BC97D
SHA-512:	31D3673CF4AFE2510BA43781116845F4C164F960541466201C0F6FF92F6966D9A5893AF5095869B18FDFA681366100CCC2B0634EDD7E88AECDD3EA206AF7E36A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F38B721E641711E589C9A697BE9A2657" xmpMM:DocumentID="xmp.did:F38B721F641711E589C9A697BE9A2657"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F38B721C641711E589C9A697BE9A2657" stRef:documentID="xmp.did:F38B721D641711E589C9A697BE9A2657"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6-6.....IDATx..WKO.Q..f........0,H...(;..A...h"..*.?.+..}..........w......h.$..}@K_3.{oi..)s...4.N....s..3....4. .3

Chrome Cache Entry: 110

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.001629167387823
Encrypted:	false
SSDEEP:	3:PORshY:WRb
MD5:	114EE640735E499992E77D2ACBEA9C52
SHA1:	AB8E57BCA77195796B653B4999FF454156B3BB7B
SHA-256:	9B03F93F8EC40B297BF1BDA57A270591EA6C857BB934734525AEE41386DC2552
SHA-512:	EE2F3D1A95E7B457027E1FAF90BE85B89DFC0918B8B9AF7AE202820A0CAB237013496A0BD295D795EFDB914BA04EF16687C0743E7EB96959AAFDE678C1035283
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnryAkQBcyn9RIFDQKP-2g=?alt=proto
Preview:	Cg4KDA0Cj/toGgUImgEYAg==

Chrome Cache Entry: 111

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1431)
Category:	downloaded
Size (bytes):	37396
Entropy (8bit):	5.084351572185461
Encrypted:	false
SSDEEP:	768:ZqnBCQzNmkMpKg5MlzqwzjzPr7Wqxk2W7Wqxk2pffk+OwG1cvVhlUaI+u33HbKhc:DJpKg5Mw4r7Wqxk2W7Wqxk2xOcNhlUaq
MD5:	AECBB2D662E6AB67B00833863839464D
SHA1:	74276B369DBED644D12B7163015A1986216B9E38
SHA-256:	8F0E669A1CF8D13AE0C8D5DE0813860D9801DDE213ACD5B04A2E1E5FAD33941B
SHA-512:	880DB9ECC77344EADEF73F561D21C86DEAC7F9B89367548D89B9DEB4F28BA32498A3BD4402499144B54944FC18A2818716C841AE37132D9C408D6E2FE5FDA788
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1
Preview:	<!DOCTYPE html>.<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# schema: http://schema.org/ sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema# ">. <head>. <meta charset="utf-8" />.<meta name="description" content="R.sultats de l.enqu.te de satisfaction r.alis.e aupr.s d.usagers particuliers de la DGFIP en 2019" />.<link rel="canonical" href="https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1" />.<meta property="og:site_name" content="impots.gouv.fr" />.<meta property="og:type" content="Article (inc blog)" />.<meta property="og:url" content="https://www.impots.gouv.fr/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dus

Chrome Cache Entry: 112

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2110
Entropy (8bit):	4.022789923090999
Encrypted:	false
SSDEEP:	48:Tx1L/GW5Pxwv/d4CYwfo9sebpqijZQM2jjZLcKDtyNxLxD:T+Wrwv/rYwIpqyypvDtyNNxD
MD5:	A12090748B2984DC342AFB7B813EDBBD
SHA1:	18181B06CD8E3D2D5920CA66F7287A3ABC045814
SHA-256:	65ACF90439B948A5AD8B9B8B5885BAE6AADAFC8D8A5D388FBE1D5D1921BD3464
SHA-512:	E1108BDA165713B66530429D733E5C4EFB60B6E5ED37D4E812D709D04D9C642BB43FB05899CEE540649FD2BE569D6438F8A79EB7C7EA9CBD34519868307615E9
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/picto/ideotag.svg
Preview:	<svg id="Calque_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 282.5 282.5" enable-background="new 0 0 282.5 282.5"><g><path fill="#2295a6" d="M135.6 265.6c-25.8.0-46.3-12-59.1-34.6-3-5.3-3.8-11.4-2.1-17.2 1.6-5.8 5.4-10.7 10.7-13.7 3.4-1.9 7.3-3 11.2-3 8.1.0 15.7 4.4 19.7 11.5 5.3 9.3 11.4 12.4 22.7 11.5 7.1-.5 14.4-8.2 16.8-13.5.5-1.2.7-5.3.8-8.4.4-8 .9-20 6.7-33.3 3.6-9.5 9.1-17.3 14.3-24.9 4.2-6 8.5-12.2 9.5-16.3 2.5-11.8 4-23.6-4.9-37.9-10.4-15.5-20.7-21.4-39.3-22.2-.7.0-1.4-.1-2-.1-18.1.0-30 12.1-34.3 17.2-5.3 6.5-8.6 17.2-9.3 20.5-2.3 10.3-11.6 17.8-22.1 17.8-1.6.0-3.3-.2-4.9-.5-12.2-2.7-19.9-14.7-17.3-26.9C53 89.3 57.9 68.1 71.1 52c8.4-10.1 31.8-33.8 69.1-33.8 1.4.0 2.9.0 4.3.1 32.9 1.5 56.7 15 75.1 42.6l.3.4c19.7 31.3 13.9 58.8 11.1 72.1l-.1.4c-2.9 12.6-9.8 22.5-16.4 32.1-4 5.7-7.7 11.2-9.4 15.6l-.5 1.3c-2.6 5.8-2.8 11.3-3.1 17.6-.3 7.2-.8 16.2-4.9 25.2-8.2 17.8-28.8 37.9-54.7 39.8C139.8 265.6 137.7 265.6 135.6 265.6zM96.2 211.4c-

Chrome Cache Entry: 113

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	4.022789923090999
Encrypted:	false
SSDEEP:	48:Tx1L/GW5Pxwv/d4CYwfo9sebpqijZQM2jjZLcKDtyNxLxD:T+Wrwv/rYwIpqyypvDtyNNxD
MD5:	A12090748B2984DC342AFB7B813EDBBD
SHA1:	18181B06CD8E3D2D5920CA66F7287A3ABC045814
SHA-256:	65ACF90439B948A5AD8B9B8B5885BAE6AADAFC8D8A5D388FBE1D5D1921BD3464
SHA-512:	E1108BDA165713B66530429D733E5C4EFB60B6E5ED37D4E812D709D04D9C642BB43FB05899CEE540649FD2BE569D6438F8A79EB7C7EA9CBD34519868307615E9
Malicious:	false
Reputation:	low
Preview:	<svg id="Calque_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 282.5 282.5" enable-background="new 0 0 282.5 282.5"><g><path fill="#2295a6" d="M135.6 265.6c-25.8.0-46.3-12-59.1-34.6-3-5.3-3.8-11.4-2.1-17.2 1.6-5.8 5.4-10.7 10.7-13.7 3.4-1.9 7.3-3 11.2-3 8.1.0 15.7 4.4 19.7 11.5 5.3 9.3 11.4 12.4 22.7 11.5 7.1-.5 14.4-8.2 16.8-13.5.5-1.2.7-5.3.8-8.4.4-8 .9-20 6.7-33.3 3.6-9.5 9.1-17.3 14.3-24.9 4.2-6 8.5-12.2 9.5-16.3 2.5-11.8 4-23.6-4.9-37.9-10.4-15.5-20.7-21.4-39.3-22.2-.7.0-1.4-.1-2-.1-18.1.0-30 12.1-34.3 17.2-5.3 6.5-8.6 17.2-9.3 20.5-2.3 10.3-11.6 17.8-22.1 17.8-1.6.0-3.3-.2-4.9-.5-12.2-2.7-19.9-14.7-17.3-26.9C53 89.3 57.9 68.1 71.1 52c8.4-10.1 31.8-33.8 69.1-33.8 1.4.0 2.9.0 4.3.1 32.9 1.5 56.7 15 75.1 42.6l.3.4c19.7 31.3 13.9 58.8 11.1 72.1l-.1.4c-2.9 12.6-9.8 22.5-16.4 32.1-4 5.7-7.7 11.2-9.4 15.6l-.5 1.3c-2.6 5.8-2.8 11.3-3.1 17.6-.3 7.2-.8 16.2-4.9 25.2-8.2 17.8-28.8 37.9-54.7 39.8C139.8 265.6 137.7 265.6 135.6 265.6zM96.2 211.4c-

Chrome Cache Entry: 114

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	323
Entropy (8bit):	6.880632738284955
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDspPVv00ar9T9QghIaRkaSd01tUilChXBYBoixFdJmudp:6v/7iMXBNfarxUHaSd0dliRaJxL9
MD5:	94FA3300CC4434E09810CC6194CBB260
SHA1:	C27C73BCE51890419660F283D3CB98403B2589DD
SHA-256:	F45320686EC8FC4A405BCA3848411417ED7603CEFEDF19E6154214E572CEC4AF
SHA-512:	F738AEFF9BD5F9023396890BE2306335D60C872055EBA4B33F1FA56523358E01CC653E994C83FFE68B54DF390BD3F0521765E1AF6E5551B578262BBD63C9B1A3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b..\....P.00.............:`...BM.$Ey..5%.4:.v....._h..XS.pO-.......DAr..^.i.....6.b...I..`..k...>..o=xG_..,?w..0..T..x....#.P.\|...z.(.3..:...d...k..-.p...Q.a.{....E..pJ.;.....n?...._i......D90.Q..:`.......h.#@...\.G./R.?....IEND.B`.

Chrome Cache Entry: 115

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 177, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35625
Entropy (8bit):	7.97105738419603
Encrypted:	false
SSDEEP:	768:frFECoJ8pLnsRmiFEL1MOwfshCmNXGmHN4zL27mWFDjyw/ZbfUiqCjnc06qZjQ:5jfpLnsY1xMOAmCXq4P2qWdjX9M1UL6b
MD5:	1C0F6A975AF7F9F284F791941DBBE5BD
SHA1:	6C77DBDB34DAAF4D5BAD557C69B32F5B619A809E
SHA-256:	11325C3D10908B33A3249BFA0524658C18C1B3A0861B717872D67E62C8E33D45
SHA-512:	6DFF88A1637A77147CEDD1EAE1D92EC84E4013BC13BB5CFF189D6A9FCD83C84A15B28720B26FB3968BFA313EA4E104BD349D030444CD54E828BBB3CF23C44909
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME......czaa....IDATx..]yxSU.~.{..67m."...;Z..PTp..u\Y........:.(K....\F.A.6..q.....).M[.....HZ.6mn....y.C.s...y.w.. ..hN.8.n..2P.P.......#!!!!!.u."...l..Y.\|.....gY............oT..'[NBBBBBB....L...;.-.....E.NL..D..."X.P...>..=7.........k.......<..J...#k..-...`..{..f.j...d....p.1=..._..+!!!!!.uA.M.....(..Q...hF>..W...$X T'.w(....Lb.lX........[..Ks.N.........h._Y. @....6.ti....W._.o.... R.,.Q......b.........J........"...7....&...7.n.w..)..q...........[.k5....x......!6..r{....0.........`9,6...P...U.~j.....8....x)...k...........V....<O_1a.Z.z...`....?...X..0..G.F.;%._...$...CMBBBBBb...N..9.gj4h-.>.....}....l}.@5.cZJ..d.`........1p.......\|. j..1.n$VN.....M .....q-.<.NW....0........`.].c..8..L.w.^........p....a...`f.y.i.."...U)...]..(>v..M._.Q....0}....~.^1a..`.8C..rHIHHHHHH.......P.8?R.^..1.c...s..VB...W..&..Is./g..J......."9l$$$$$$$........

Chrome Cache Entry: 116

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	323
Entropy (8bit):	6.880632738284955
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDspPVv00ar9T9QghIaRkaSd01tUilChXBYBoixFdJmudp:6v/7iMXBNfarxUHaSd0dliRaJxL9
MD5:	94FA3300CC4434E09810CC6194CBB260
SHA1:	C27C73BCE51890419660F283D3CB98403B2589DD
SHA-256:	F45320686EC8FC4A405BCA3848411417ED7603CEFEDF19E6154214E572CEC4AF
SHA-512:	F738AEFF9BD5F9023396890BE2306335D60C872055EBA4B33F1FA56523358E01CC653E994C83FFE68B54DF390BD3F0521765E1AF6E5551B578262BBD63C9B1A3
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/facebook.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b..\....P.00.............:`...BM.$Ey..5%.4:.v....._h..XS.pO-.......DAr..^.i.....6.b...I..`..k...>..o=xG_..,?w..0..T..x....#.P.\|...z.(.3..:...d...k..-.p...Q.a.{....E..pJ.;.....n?...._i......D90.Q..:`.......h.#@...\.G./R.?....IEND.B`.

Chrome Cache Entry: 117

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (14298)
Category:	downloaded
Size (bytes):	28333
Entropy (8bit):	5.001741146735526
Encrypted:	false
SSDEEP:	384:DUtGwDtQfaZrZXnA6qW/zJvzxfOVRW6GJWlE92114SAtZ5eeQgtSHj:eDtQ6nAo/zlzIVRW6GJWlE9211feQtj
MD5:	C10C1712EAD4E37106966CD5DBEB0605
SHA1:	1821BE9D1430A7EBA4EE1DC84381438D11D0FB17
SHA-256:	83A4C0013B25F828658AF4AE1B391B708126CC023D70859492A9646C881F66B7
SHA-512:	19F60B8910B49A7D4CE07B206C86874205B6AB6E392E8E2ED40890EC3391E316E0E369FE88FB343F0B076678914559D46B2E757CD0BF881E3D2D6D73ED594F40
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/css/css_pOQ_-ztHkjbRJKBhGPU2vp4kMcHefBz-HqlupqfX4cQ.css?delta=0&language=fr&theme=pus_inea&include=eJx1T9FuBCEI_CF7fpJhkd2ji2BEe7FfX3vb5tKHJiQzYWAYNsAzdVtV4_bi6d3D9o_EaBp8eqey-k4BBdznH17IHQ7ygNYoqrUCwp8U6vAEubDGQ2wDefM-hfV4CqwEcW9Q6GHtDA_a9rUYf_CWGcSuSTwpc7eWqoyD1SPgOpTZ9LY3006aX47V6qjJ79AoFWAJbrisUlke8J2aMQhMGz1ldrQPajOaEpr8vqOWr-w0hBqDRlbuz44TNLzHC74AvuSDJg
Preview:	/* @license GNU-GPL-2.0-or-later https://www.drupal.org/licensing/faq */..ui-helper-hidden{display:none;}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none;}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse;}.ui-helper-clearfix:after{clear:both;}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:absolute;opacity:0;-ms-filter:"alpha(opacity=0)";}.ui-front{z-index:100;}.ui-state-disabled{cursor:default !important;pointer-events:none;}.ui-icon{display:inline-block;vertical-align:middle;margin-top:-.25em;position:relative;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat;}.ui-widget-icon-block{left:50%;margin-left:-8px;display:block;}.ui-widget-overlay{position:fixed;top:0;left:0;width:100%;height:100%;}..ui-c

Chrome Cache Entry: 118

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18314)
Category:	dropped
Size (bytes):	255672
Entropy (8bit):	5.265464932754465
Encrypted:	false
SSDEEP:	3072:Iqa0OgghhA2dXNkCvK4uJ6wm8EkDCnq/kHyW3V66Mr:dgTkCTCy8Exq/MyW3V6pr
MD5:	5178F42F95B57233E26326F6239F865D
SHA1:	D456602A25C6265C428AFB129227018FB6B067DA
SHA-256:	474541BF2681F88D77E4FD59DB190B8ABEF00D31CC23BD97AB4B03687FC3660E
SHA-512:	AEC1EF4A131FFD81E2A344778F5AF75E70DABEF1474EFD4A6B43D5FD07709E37BD3155482C94C923D867B968AC4F6DD9ACB22A993D14F76FB0CC618A645722FE
Malicious:	false
Reputation:	low
Preview:	/* @license GNU-GPL-2.0-or-later https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md /./! @drupal/once - v1.0.1 - 2021-06-12 */.var once=function(){"use strict";var n=/[\11\12\14\15\40]+/,e="data-once",t=document;function r(n,t,r){return n[t+"Attribute"](e,r)}function o(e){if("string"!=typeof e)throw new TypeError("once ID must be a string");if(""===e\|\|n.test(e))throw new RangeError("once ID must not be empty or contain spaces");return'[data-once~="'+e+'"]'}function u(n){if(!(n instanceof Element))throw new TypeError("The element must be an instance of Element");return!0}function i(n,e){void 0===e&&(e=t);var r=n;if(null===n)r=[];else{if(!n)throw new TypeError("Selector must not be empty");"string"!=typeof n\|\|e!==t&&!u(e)?n instanceof Element&&(r=[n]):r=e.querySelectorAll(n)}return Array.prototype.slice.call(r)}function c(n,e,t){return e.filter((function(e){var r=u(e)&&e.matches(n);return r&&t&&t(e),r}))}function f(e,t){var o=t.add,u=t.remove,i=[];r(e,"has")&&r(e,"get").tr

Chrome Cache Entry: 119

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.176616191925469
Encrypted:	false
SSDEEP:	24:Xa6LwORAQ8IBH8R8OfZfPAXRlo8ehTpRAxv34Dsw1O0:Xc+AOqR8KX4RlBcR8oO
MD5:	4C2C39D7CB584994B956B7001FC462E1
SHA1:	82C00353C1CA67D925E65FD6022CD0CCBC0F5C3C
SHA-256:	99AF879888A29FEEEC095725F74E18CD070DE29E7F1B4A35F20746FA45382C21
SHA-512:	FF39C0EC947C7DA6E775DB481A40684AC97B19F1DBBFDFE6CB3BAD5EDDBDC1CC20A9F5648573452A4AD38F69EF84F1C3DF069EC57EF0C8A293D115790F417268
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .........................................................................................................................h....................................................p].lH(.....(.......................................................zW9.....?.......................................................vS5.....@.......................................................vR3.....A.......................................toj............uQ1.~...?...........................................A0..tmf.c[S.B-..GYa.-P`...}.........................................kT<.[@&.V:..X=!.X>!.]A".^B#.X;..\J5.....................................nJ,.~...@.................z..tb................................rM,.....A.......................................................pK+.....C.......................................................pJ).....4.......................................................kH(.....0...L...N...U...l....{n..............................uc.S2...q`..qa.\|n_.{m

Chrome Cache Entry: 69

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1838
Entropy (8bit):	7.295677631925419
Encrypted:	false
SSDEEP:	48:dqQNn2qODJ3ektQ3mLQNF+um9lUR4a+nUFpYUa:wY27htQ3TNv8GR4OFpYV
MD5:	FD9D710F2BB6E7BFFE7180AF7B6E161E
SHA1:	623587FFD942AF1C9682B27799B30FA17F87316B
SHA-256:	2D1B87D0960A07DC0966F75B1986CA600DEF5B8607144C6B6A617E496E0FFAD6
SHA-512:	5F77A0D600BAE35A573E75A1FD515AE149A031B01C0C0FA68101F219036EF51BA7158A783B6A2A81C6E8A9EE8E5061986A241B83FC0819969D980648AE7DBF66
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/email.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F38B721A641711E589C9A697BE9A2657" xmpMM:DocumentID="xmp.did:F38B721B641711E589C9A697BE9A2657"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9D415C75641711E589C9A697BE9A2657" stRef:documentID="xmp.did:9D415C76641711E589C9A697BE9A2657"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx..W_H.Q......>.....LZAa..B..`...\|....!.eJ.eo:.R\|H.@..a.. . ..)i.........~....77._../...?...9.s.....^

Chrome Cache Entry: 70

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 30 names, Macintosh, Digitized data copyright \251 2011, Google Corporation.Open Sans SemiboldRegularAscender - Open
Category:	downloaded
Size (bytes):	221328
Entropy (8bit):	6.431506062562893
Encrypted:	false
SSDEEP:	6144:cTPF4C9GrdELutgCNktQFvmnoxXTS4uFC8:m9f9VSqCNktA+SXfaC8
MD5:	33F225B8F5F7D6B34A0926F58F96C1E9
SHA1:	F1EE7A9C6D13EE2D642A806C09E737275E613792
SHA-256:	AA3B0EF53DB12E3D45094030CAC0E69D384E44CC5978643DD4390041CAD546E2
SHA-512:	4169D72F086E732A30FE1B0E977B32C9EF0D2913B8608A4D2409C4876E204BFA48548188B0C2A7437DBB79A1FC632916F966B25453FEB5E40F2F79D75AA3299D
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/themes/custom/pus_inea/dist/fonts/open-sans/semibold/OpenSans-Semibold.ttf
Preview:	...........0DSIG=..>..K....tGDEF.&....F.....GPOS.7.7..G....8GSUB.+=...GT....OS/2...........`cmap)./h........cvt ...4........fpgm~a..........gasp......F.....glyfw.....%...>.head.......<...6hhea.......t...$hmtx.. e........kernT+.~..dP...6loca..HV...D...Vmaxp.8......... name$.Ot.......9post.C.l.. ...&+prepx..n...................._.<..........L.}......Lx.T.....d.........................T.{...............................W......./.\...............X.......3.......3.....f..................@. [...(....1ASC... ...........X ........R..... ...................5...}...+./...o...T...`.......R...=.b.J...`.#.?...H.3.........X.......Z...V...'...u...^...J...X...V.3...9.?...`...f...`...../.o.J...H.....y.....w...B.....y.......J.d.d.....V...b...D...L.y.....L.y.....f.d...........................B...........3.L...o.....j...Z.......f...f...f...#.s.......;...;.......;.............f.......f.s.....b.%.'.....H.......h...J.....D...-.h.....-...`.....5.........H...u.....h.....s...%...d...9.s.R...`...H...d.....m.m...`

Chrome Cache Entry: 71

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2619)
Category:	dropped
Size (bytes):	4000
Entropy (8bit):	5.3092575400864055
Encrypted:	false
SSDEEP:	96:mpTmr1wMt0yTZaPj1GDU+Q7tcwMGiiMP08M7wL8p5ix:mp6ri4ZaxGHitcw/iiMNL8H2
MD5:	8EE15E19E57C20E06C19868D35C4E83A
SHA1:	6AC237D0477CC65EBA6F48622158A2CF8953E9BF
SHA-256:	7438ABEF232E5056184966A5DFC8AA28809C8F2E9EA060080AA23E0C44DCFD1B
SHA-512:	DAF5912060C047BE9BBC7C5062740DC3DC2FF339D4D7456AEEAC2846407C6906FF51D6AEF4A148A7CD55B90B8FCAA2EB0EE5FD768F995D65AC9813C006EE0003
Malicious:	false
Reputation:	low
Preview:	/* #633395289 /.(function(o){.o.pmtcrec .= 0;o.rcollector = function(a) {var o = _oEa;o.pmtcrec = 1;o.recurse(1);o.collector( a );};o.pmdenyall = 0;o.tcfv2dh.= 0;o.tcfv2cvh.= 0;o.pmtcfv2thaw = function() {var h, o = _oEa, d = o.tcfv2d, cv, t, wcv = 0;var amisc = [];var cvmap = {};o.hpmvendor = o.hpmpurpose = o.hpmsfeature = {};o.hpmcustomvendor = {};cv = o.tcfv2cv = [];if (cvmap) {/ Specifics // didomi /t = window.didomiState;if (o.isdef( typeof t ) && o.isdef( typeof t.didomiVendorsConsent )){t.didomiVendorsConsent.split(',').forEach(function(k) {if (k.substr(0,4)!=="iab:") {cv.push( k.substr(k.indexOf(':')+1) ) } } );wcv = 1;}/ onetrust /}/ with __eaGenericCmpApi /if (d && d.eamode === 'tac' && (t = d.eapayload) && t.state) {var k;for(k in t.state){ / at least one state defined */d.tcString=d.tcString\|\|'CPjTJ1aPjTJ1aOhAAAENCZCgAAAAAAAAAAAAAAAAAAAA.YAAAAAAAAAA';if(t.state[k]){cv.push( k + '-tac' ); wcv = 1;if (k === 'eulerian' \|\| k === 'eulerian-analytics'){d.tcString='CPjTJ

Chrome Cache Entry: 72

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (362), with no line terminators
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	5.403136358284295
Encrypted:	false
SSDEEP:	6:hn8FRcJCc4ssncOb+n4mc4sLzA9MhH4N8nZ3X96THFAbVgmMAKkoSNl/G0ZKD:hnM+J0Nb1n+NYkJCVjBKkN4D
MD5:	66B19BDF24319BA3C17C3B43D4FA4021
SHA1:	24EEB2E052F79EC07FC0E63222D90849EC9F970B
SHA-256:	E8EC727E66035789DA04595AF59655E92F21AE4459C896A53F7017636AC038EC
SHA-512:	BF9B0402DFF1A252B2269FB5EEA6CE5342B8B2F96FF76251CC8B3A952B1AB26376E690358F97CCA4CD8028D5800EB8021E712E362C294B109C12BD18CD407F14
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/actualite/publication-de-la-brochure-pratique-impots-locaux-2024
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>Page non trouv.e \| impots.gouv.fr</title></head><body><h1>Page non trouv.e</h1><p>L'URL demand.e "/actualite/publication-de-la-brochure-pratique-impots-locaux-2024" n'a pas .t. trouv.e.</p></body></html>

Chrome Cache Entry: 73

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 39666
Category:	downloaded
Size (bytes):	6004
Entropy (8bit):	7.9403054741646555
Encrypted:	false
SSDEEP:	96:wJAv/gvN4h67EIL/YbwAiulZkeVU/pKHR3xU/pKrLlFiqhOAG9p1mIBiAuY8v:wJVvN4O5EeulZkRRKx3aRKrZ1OAM1HB0
MD5:	354341B6F079D40454E4BDACE2DF7FCF
SHA1:	BDC70681A7D581901742E6025EC640E042470250
SHA-256:	0281D4D11833A9DF3E921F28867F0C772C25B2E363FEF4C19C50FFD807AB2425
SHA-512:	DD937BE4000CB736E472B880F38F3AF9C5E843E36EF595616EC2A066037BEEDBF93FBBDE5FC3F1D6BEEE2B589271EB1708077241F016A95E1B660482424E1F3D
Malicious:	false
Reputation:	low
URL:	https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/bootstrap.css
Preview:	.............8.........$Ad...#.6.{,.B.%...eH.6...R.d..:...9i.U<.g7.......s.....>..c...k?.....Z.v.C}.g...W..p..;>M...e.;....?.?...s.._.....Y......l..?}....v..........l.K}8t.....q.b.>...-..r...Z...m..j.f....j..._.~m..;...[..,.R..rK..-+.(.......:8..p?.]r..nY..tK..-.[V.Q.5.1.t..up...~@..n).tK..-.[......k.c...h........5....e....6....q....r7....}v..8.2..o.d............yk.v..i...x.V....=..;>M.#/s.95-l.\.l.....=5s~.......f...........z..v;..C..J.z.....=...s.1<.e..xk....N.$.......m/.N\.....,.!.fr..\.P."b/....861NOL%.\...h.....~..E>._...-.....;..#....2d...@."....}...y....w...T.....$..9...PA.G).%...j.\...+......\....\E-.R.\U8J#..X.4.+V..V......c8.......J%.q...$[....U....f..n...>...Y.V'.w.q.i.&\|..wh.../\|y.......8........ZP......)u.KT-)....U+J.\|.B.Rk_.Q....W.T]Q..WWxZ.. m.....0px...9.d.E.k..\...p..S.NvZ;q}.."......J....%.]...$.Y.h.U......fP.z0..Uijj....>...sP.s.rn.]..?...az.o..e......\|<o?A>/C.6.........m......V......n%...............

Chrome Cache Entry: 74

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54998)
Category:	downloaded
Size (bytes):	55183
Entropy (8bit):	4.7118040861283195
Encrypted:	false
SSDEEP:	768:nuC31UP18Pq4/vnU6UHJXkQCZ/WMQyjJKX7I9sGsQz5:nu5PWC4/vYH5BCkgc7qsiF
MD5:	77CBAD34E5CE95E70847B074E05FAEAB
SHA1:	50CCFD672CC8D4D4CFF476204509C2FD51907FFA
SHA-256:	06D6E10886ED7DE5561ACAB1935BCE1C46174BAA9CBD0BCB319AA3B69594131F
SHA-512:	AEA425B5746E1F1B4F5A192DA406712C751527712899B9F786F93D3C78D5FCDE43314627CCA3C2D62DEE6F49845E0173B1A64D789728134607AB48FF185B1D1A
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.8.2/css/all.css
Preview:	/!. Font Awesome Free 5.8.2 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pull-lef

Chrome Cache Entry: 75

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	88145
Entropy (8bit):	5.291106244832159
Encrypted:	false
SSDEEP:	1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
MD5:	220AFD743D9E9643852E31A135A9F3AE
SHA1:	88523924351BAC0B5D560FE0C5781E2556E7693D
SHA-256:	0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
SHA-512:	6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var

Chrome Cache Entry: 76

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	323
Entropy (8bit):	6.880632738284955
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDspPVv00ar9T9QghIaRkaSd01tUilChXBYBoixFdJmudp:6v/7iMXBNfarxUHaSd0dliRaJxL9
MD5:	94FA3300CC4434E09810CC6194CBB260
SHA1:	C27C73BCE51890419660F283D3CB98403B2589DD
SHA-256:	F45320686EC8FC4A405BCA3848411417ED7603CEFEDF19E6154214E572CEC4AF
SHA-512:	F738AEFF9BD5F9023396890BE2306335D60C872055EBA4B33F1FA56523358E01CC653E994C83FFE68B54DF390BD3F0521765E1AF6E5551B578262BBD63C9B1A3
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/menuimage/picto/facebook.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b..\....P.00.............:`...BM.$Ey..5%.4:.v....._h..XS.pO-.......DAr..^.i.....6.b...I..`..k...>..o=xG_..,?w..0..T..x....#.P.\|...z.(.3..:...d...k..-.p...Q.a.{....E..pJ.;.....n?...._i......D90.Q..:`.......h.#@...\.G./R.?....IEND.B`.

Chrome Cache Entry: 77

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (306)
Category:	downloaded
Size (bytes):	38271
Entropy (8bit):	5.383495956341906
Encrypted:	false
SSDEEP:	768:WcNgDp+pkeLzpN8vctYLpNOTw0fbOpwBGemgZSv6/M10L+XLkIL//j9487vHbbfS:ZIw4vPp4apwagZSTLkILmknh46nP6
MD5:	D82228C9A484E886292677B110E1C964
SHA1:	8E43A63E89F1B85618C01E72DD4A52DF4C857383
SHA-256:	A2777571213642CD7C9836CCA638637CECB4D00411B6449DE6638CCF62F7DDD5
SHA-512:	1B5E5F995557B0A4F67567B0CC9D3EDAF2B29BD34B2202759A620F6EED386C5EB7594F9931A5C47442C5A3A72BBF45C8488F85325832D049848F726A303B704D
Malicious:	false
Reputation:	low
URL:	https://bmly.impots.gouv.fr/dwD747.js?2
Preview:	if(typeof window._oEa!=='object'){if(window.eflash===undefined){window.eflash=0}if(window.EA_param===undefined){window.EA_param=''}var _oEa=window._oEa={server:'bmly.impots.gouv.fr',apath:'',version:'5.5.6',iattr:' height="2" width="2" style="border:none" alt="" ',.v:2,ia:'14a',whoami:'ea.js',stg:'etuix',v$B:0,v$C:-1,v$D:1,ws:'',wsp:'',etagid:'',v$E:[],v$F:[],v$G:[],app:[],agp:[],adn:[],adnend:0,v$H:0,v$I:0,v$K:2040,ctype:'text/javascript',cspnonce:0,ald:[],v$4:0,v$L:{},v$O:{'link':'lk',.'download':'dl','event':'ev','button':'bt'},reserved:['url','rf','fra','ss','sd','fl','sa'],v$T:0,v$Q:0,v$P:{},hcgi:{},cjs:{},jsbwr:{},ato:[],htook:{},atotv:0,kl:'xob',ftrue:function(){return 1},v$N:{'path':'urlp','actionref':'actr','action':'eact','actionin':'eacti','actionout':'eacto',.'eventtype':'evtype','eventurl':'evurl','eventname':'evname','eventview':'evt','newcustomer':'nc','error':'pgerr','opein':'eope','scartdur':'ttl','duration':'ttl','scartamount':'amount','scartref':'ref','scarttype':'ty

Chrome Cache Entry: 78

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	609
Entropy (8bit):	7.373509842376379
Encrypted:	false
SSDEEP:	12:6v/7iMXrlEZ4LD9JJf50/ZjE1EfUJl7VEixhr3yo/oqyt9w+:s2qDHFi/dE12UJl7mCr3pwqy
MD5:	92FF7DBE66070560FA88EF4194AA9050
SHA1:	CD7F6064F9ECD62EC13CEA642B2BA4DE87178126
SHA-256:	9F3C18FA322BB276EF4ADA3F388177344F4713044D132EF698DC128CC2664ED8
SHA-512:	0021B77423E37DD93925530DF435236821CB25F0ACB5F7B58EF7A48ADA7C091A0EE6B077F8652009F08D27F48F5635745D2236FAEF01A4EA8F2D8129FE85813B
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/menuimage/picto/twitter.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bLXq......a`@#..Z...L...F.0..`..A.b......r.l..>.b8..+.W...\...~..........".....N6...Av...?X..[.......\|L\...5...3t.{...O.....B..=T@...z.6..SX..H!.g..2`...".,x.a....fb`.D%.7_...."..R..e..Cb..3..8r.3qQ.../..A..B..\|G.\|..o......(.....l..t.....d..).[......D9.........(.+X..).(%:.`.sr.(.Hr.(....'X..J0..B.s......s.3`b\|.Qt.....L^].J`...Y.E...P..._J...o).....C.#@.GL:b".7..[..,.p%..W.Q.=..@..."/...}..$....Z..jEb.(..=..`.#..P..Z4 _.c9(....]7?..eYp.\ .r......0........"..T.`...4...(HI...f...Hu@......`......c......IEND.B`.

Chrome Cache Entry: 79

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	16408
Entropy (8bit):	3.8167164999885994
Encrypted:	false
SSDEEP:	384:ezVN6rQYxZa7dhN6ySPP4e4CLCGpcfB/RXWNZ8DLTR4jhE5uZEgs+uO:VoAB4+pOB/eZ8DvRWi5uZX
MD5:	F3316553FF22C27EF2C88EE5D8355325
SHA1:	1050F026F4F02C1B1828C30FB1DD7D1524319473
SHA-256:	0F733FC60E923D74618C250E5446C9C59B0992B8E213B433BB743AD789135E8C
SHA-512:	8DFBEA4F8C1392DB587FF3416B517AEC3EFCD7517D8480EB357CFE8DACC555C601AD339D22BD6E77D866EFC36C217AB7C14787587F470B2B8690F12E8C0E964D
Malicious:	false
Reputation:	low
Preview:	<svg enable-background="new 0 0 962 228.1" viewBox="0 0 962 228.1" xmlns="http://www.w3.org/2000/svg"><g fill="#0083ae"><path d="m346.4 83.5h-6v-9.8h6zm-6.2 53.1v-47.5h6v47.4h-6z"/><path d="m393.4 96.5c2-2.8 4.4-4.8 7.2-6.2s6-2.2 9.6-2.2c6.4 0 11.2 2 14 5.8 3 3.8 4.4 10 4.4 18.6v24h-5.8v-25.2c0-6.2-1-10.8-3.2-13.4-2-2.6-5.4-4-10.2-4-2.8 0-5 .6-7.2 1.6-2 1.2-3.6 2.6-4.8 4.8-.8 1.2-1.2 2.8-1.6 4.4s-.4 4.6-.4 8.6v23h-5.8v-26.4c0-5.4-1.2-9.4-3.4-12s-5.6-3.8-10.2-3.8c-2.8 0-5.2.6-7.2 1.6-2 1.2-3.8 2.6-5 4.8-.8 1.2-1.2 2.8-1.6 4.4s-.4 4.6-.4 8.6v23h-6v-47.4h6v5.4c1.8-2 4-3.6 6.4-4.8 2.4-1 5.2-1.6 8.4-1.6 3.6 0 6.8.8 9.8 2.2 3.2 1.6 5.4 3.6 7 6.2z"/><path d="m438.2 89.1h6v7.6c1.8-2.6 4.2-4.8 7.4-6.4s6.6-2.4 10.2-2.4c7.2 0 13 2.4 17.8 7.2 4.6 4.8 7 10.6 7 17.8 0 7-2.4 12.8-7 17.6s-10.4 7.2-17.4 7.2c-3.8 0-7.4-.8-10.4-2.2s-5.6-3.6-7.6-6.6v3.2 7 12.4h-6zm6 23.4c0 5.4 1.8 10 5.4 13.8s7.8 5.8 12.6 5.8c5 0 9.2-1.8 12.8-5.4s5.4-8 5.4-13.4c0-5.6-1.8-10.2-5.4-14s-8-5.6-13-5.6c-4.6 0-8.8 1.8-12.4 5.6s-

Chrome Cache Entry: 80

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 804 x 604, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	199039
Entropy (8bit):	7.9893373863943715
Encrypted:	false
SSDEEP:	3072:+SnuXAX1GSBa0egY3j4Kji42PEJWYDnaMYbkv7ottkZFRclt2GzA3K1anJWDG:/uX4eP3iMJWYOMREfSF13K1HDG
MD5:	38913BCF7484E43BF5472B79DBB57962
SHA1:	3955EBB0F5470042F2DEF0479698CA71EC405BAA
SHA-256:	EA192FCB8D784EAB17A9E9C2A40DABF4DEBDCAC48ADBFD148B52A8425DA118F4
SHA-512:	9A8FD2AD21AD45928E0B31E3C2F1472D1B55EA7104AB8CE84F7EF1E0CE87AA7109AEF959C500A778D0CDB2FEC9A31040776A91BAFC26D42BE7404B7A35152DF3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...$...\.......`.....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^...UU......._.:......X %. .".bwww...tww#Hw..~k.}.y/....F..S..>.}....x.Zqssss..%.W.S[..['.V..E...9.../...}&...].........KW5=..=3.g.{.\#..B.8.......e.....&...e..mQ&.nnnnn.5.7q8...8..?..b...2p."...........&..aA......A.........7rW.q2u.JY.~..'.7...p......p8~.X..@..Y".>...<...-.'$.G$-H..K,.n..w].hB(.k]-}.=.....h..l.l(@.l..q8...o..H....7.u.6.%+....e.......z#.&.{DB!..G.....b..72.+....E>S.7.....a.{W....r.#_..?..YKVY.H..IN.................@..X'.>.,...I!1.....F.....B..X.W..fC.>.....{...o..{....D..?If-]... ...C.,q8...o..H....7......2z.R.....}..!T&..(1.pS.....z68.tAb.2.".....w.<L...[>....\..0I&.\as_H........p8~.pA.p8..q.:_ .T...{......\|DA.......#a.\|.#..S..'.#..?^.C....a..==....eM"F2Hi..$............#.....>l.Ri..p.....?m.;....0.+,~.so.&..;Rh.WV....]..'.....csF6l..#..C..J?q8...o..H....7.,....;c.i..@..A.....%..~ *(...dhW..yIF8.bG..E.........rG..2...8g$&....X....

Chrome Cache Entry: 81

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	88
Entropy (8bit):	4.9975543127953195
Encrypted:	false
SSDEEP:	3:fmRSOCVnnqjOO/10P418jby3DNK99h7To01n:bOCdnqjOOGP4q6c3B/
MD5:	9054F108ACA8FD3E04119D2CB9B1FE97
SHA1:	8C6AB9D131E9F4FF574610DD4994A2EFD1E8A2F0
SHA-256:	716E049C953B6897B5168D1CC21B252A4FA00E79E4197496411FE8F7671908FF
SHA-512:	1B980E83B3CF3AD899980F476BF4EE91A73088136F8F9046CB091F392FA5379097B0A00E5ACD7BB5B58128D1F4FEE18985F219E86584C4C1ED103C1FF441AE96
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSMwkOZ9OoJtkochIFDVVfspgSBQ0X74bIEgUNL8DjWRIFDXe-PlUSBQ0tIlB-EgUN4Pz0Fw==?alt=proto
Preview:	Cj4KCw1VX7KYGgQIMxgBCgcNF++GyBoACgcNL8DjWRoACgcNd74+VRoACgcNLSJQfhoACgsN4Pz0FxoECAkYAQ==

Chrome Cache Entry: 82

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65362)
Category:	dropped
Size (bytes):	114834
Entropy (8bit):	5.312844163604332
Encrypted:	false
SSDEEP:	1536:YRUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKvfgjv0:4HNwcv9VBQpLl88SMBQ47GKHgT0
MD5:	B7750BE34F859AB2628647E7E5B899F5
SHA1:	94CC97B31FC885A7623A08C33867D71DFBB8DFBC
SHA-256:	572147C91D05F64DFB2D60C7F3ECBFB73F53367349E207EFDACD117AFEF86A35
SHA-512:	487D36DAE06DFE499289200A07E498D76465780F6B2AD040B0993AA6A07C21837708A7D74E929D2CC50685E4C889DA44346723305C64806212C0BE145933E37C
Malicious:	false
Reputation:	low
Preview:	/* @license MIT https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt /./! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttri

Chrome Cache Entry: 83

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2619)
Category:	downloaded
Size (bytes):	4000
Entropy (8bit):	5.305601108472243
Encrypted:	false
SSDEEP:	96:LFpTmr1wMt0yTZaPj1GDU+Q7tcwMGiiMP08M7wL8p5ix:LFp6ri4ZaxGHitcw/iiMNL8H2
MD5:	61D18756679ABE32EB07188BC81846CB
SHA1:	545F54DECF91605BA86C59C5CE8215F8EE58D381
SHA-256:	FD93B820AD01A1483DEF376C0B10589E7374EA4390152E84E78204EC6BF06F92
SHA-512:	29314042EC11579F60B376B74FCD945C573D7712FBA8002C932B2FA95836FEC75BFD6D389C535D6F219A20AD4510066705B640535396B1C86E7C67258A5D9205
Malicious:	false
Reputation:	low
URL:	https://bmly.impots.gouv.fr/col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0&
Preview:	/* #512003581 /.(function(o){.o.pmtcrec .= 0;o.rcollector = function(a) {var o = _oEa;o.pmtcrec = 1;o.recurse(1);o.collector( a );};o.pmdenyall = 0;o.tcfv2dh.= 0;o.tcfv2cvh.= 0;o.pmtcfv2thaw = function() {var h, o = _oEa, d = o.tcfv2d, cv, t, wcv = 0;var amisc = [];var cvmap = {};o.hpmvendor = o.hpmpurpose = o.hpmsfeature = {};o.hpmcustomvendor = {};cv = o.tcfv2cv = [];if (cvmap) {/ Specifics // didomi /t = window.didomiState;if (o.isdef( typeof t ) && o.isdef( typeof t.didomiVendorsConsent )){t.didomiVendorsConsent.split(',').forEach(function(k) {if (k.substr(0,4)!=="iab:") {cv.push( k.substr(k.indexOf(':')+1) ) } } );wcv = 1;}/ onetrust /}/ with __eaGenericCmpApi /if (d && d.eamode === 'tac' && (t = d.eapayload) && t.state) {var k;for(k in t.state){ / at least one state defined */d.tcString=d.tcString\|\|'CPjTJ1aPjTJ1aOhAAAENCZCgAAAAAAAAAAAAAAAAAAAA.YAAAAAAAAAA';if(t.state[k]){cv.push( k + '-tac' ); wcv = 1;if (k === 'eulerian' \|\| k === 'eulerian-analytics'){d.tcString='CPjTJ

Chrome Cache Entry: 84

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1852
Entropy (8bit):	7.345349957125825
Encrypted:	false
SSDEEP:	48:dqQNn2qqHJ3/zj+/eF2/swZlHHXHZSkn1+V1M:wY2Hly/2cJ3HZD1+E
MD5:	F36C90A7E31B0DDE4D09BFCAF8311D6A
SHA1:	1B064ED473D26224DD6A27A0932F9C7AFB39F76E
SHA-256:	52EEBA2F4AB2E64F0E44D4D79F17A99C5FF6C4DB26E95F90B7DEDA2C799BC97D
SHA-512:	31D3673CF4AFE2510BA43781116845F4C164F960541466201C0F6FF92F6966D9A5893AF5095869B18FDFA681366100CCC2B0634EDD7E88AECDD3EA206AF7E36A
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr//themes/custom/pus_inea/assets/social-media/print.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F38B721E641711E589C9A697BE9A2657" xmpMM:DocumentID="xmp.did:F38B721F641711E589C9A697BE9A2657"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F38B721C641711E589C9A697BE9A2657" stRef:documentID="xmp.did:F38B721D641711E589C9A697BE9A2657"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6-6.....IDATx..WKO.Q..f........0,H...(;..A...h"..*.?.+..}..........w......h.$..}@K_3.{oi..)s...4.N....s..3....4. .3

Chrome Cache Entry: 85

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65362)
Category:	downloaded
Size (bytes):	114834
Entropy (8bit):	5.312844163604332
Encrypted:	false
SSDEEP:	1536:YRUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKvfgjv0:4HNwcv9VBQpLl88SMBQ47GKHgT0
MD5:	B7750BE34F859AB2628647E7E5B899F5
SHA1:	94CC97B31FC885A7623A08C33867D71DFBB8DFBC
SHA-256:	572147C91D05F64DFB2D60C7F3ECBFB73F53367349E207EFDACD117AFEF86A35
SHA-512:	487D36DAE06DFE499289200A07E498D76465780F6B2AD040B0993AA6A07C21837708A7D74E929D2CC50685E4C889DA44346723305C64806212C0BE145933E37C
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/js/js_ZflCk2ALm2Vi-03FgwgW4BmR9GoRTbbRFIEioRu6q1s.js?scope=header&delta=0&language=fr&theme=pus_inea&include=eJx1T9FuBCEI_CF7fpJhkd2ji2BEe7FfX3vb5tKHJiQzYWAYNsAzdVtV4_bi6d3D9o_EaBp8eqey-k4BBdznH17IHQ7ygNYoqrUCwp8U6vAEubDGQ2wDefM-hfV4CqwEcW9Q6GHtDA_a9rUYf_CWGcSuSTwpc7eWqoyD1SPgOpTZ9LY3006aX47V6qjJ79AoFWAJbrisUlke8J2aMQhMGz1ldrQPajOaEpr8vqOWr-w0hBqDRlbuz44TNLzHC74AvuSDJg
Preview:	/* @license MIT https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt /./! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttri

Chrome Cache Entry: 86

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	609
Entropy (8bit):	7.373509842376379
Encrypted:	false
SSDEEP:	12:6v/7iMXrlEZ4LD9JJf50/ZjE1EfUJl7VEixhr3yo/oqyt9w+:s2qDHFi/dE12UJl7mCr3pwqy
MD5:	92FF7DBE66070560FA88EF4194AA9050
SHA1:	CD7F6064F9ECD62EC13CEA642B2BA4DE87178126
SHA-256:	9F3C18FA322BB276EF4ADA3F388177344F4713044D132EF698DC128CC2664ED8
SHA-512:	0021B77423E37DD93925530DF435236821CB25F0ACB5F7B58EF7A48ADA7C091A0EE6B077F8652009F08D27F48F5635745D2236FAEF01A4EA8F2D8129FE85813B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bLXq......a`@#..Z...L...F.0..`..A.b......r.l..>.b8..+.W...\...~..........".....N6...Av...?X..[.......\|L\...5...3t.{...O.....B..=T@...z.6..SX..H!.g..2`...".,x.a....fb`.D%.7_...."..R..e..Cb..3..8r.3qQ.../..A..B..\|G.\|..o......(.....l..t.....d..).[......D9.........(.+X..).(%:.`.sr.(.Hr.(....'X..J0..B.s......s.3`b\|.Qt.....L^].J`...Y.E...P..._J...o).....C.#@.GL:b".7..[..,.p%..W.Q.=..@..."/...}..$....Z..jEb.(..=..`.#..P..Z4 _.c9(....]7?..eYp.\ .r......0........"..T.`...4...(HI...f...Hu@......`......c......IEND.B`.

Chrome Cache Entry: 87

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 177, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35625
Entropy (8bit):	7.97105738419603
Encrypted:	false
SSDEEP:	768:frFECoJ8pLnsRmiFEL1MOwfshCmNXGmHN4zL27mWFDjyw/ZbfUiqCjnc06qZjQ:5jfpLnsY1xMOAmCXq4P2qWdjX9M1UL6b
MD5:	1C0F6A975AF7F9F284F791941DBBE5BD
SHA1:	6C77DBDB34DAAF4D5BAD557C69B32F5B619A809E
SHA-256:	11325C3D10908B33A3249BFA0524658C18C1B3A0861B717872D67E62C8E33D45
SHA-512:	6DFF88A1637A77147CEDD1EAE1D92EC84E4013BC13BB5CFF189D6A9FCD83C84A15B28720B26FB3968BFA313EA4E104BD349D030444CD54E828BBB3CF23C44909
Malicious:	false
Reputation:	low
URL:	https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png
Preview:	.PNG........IHDR...X................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME......czaa....IDATx..]yxSU.~.{..67m."...;Z..PTp..u\Y........:.(K....\F.A.6..q.....).M[.....HZ.6mn....y.C.s...y.w.. ..hN.8.n..2P.P.......#!!!!!.u."...l..Y.\|.....gY............oT..'[NBBBBBB....L...;.-.....E.NL..D..."X.P...>..=7.........k.......<..J...#k..-...`..{..f.j...d....p.1=..._..+!!!!!.uA.M.....(..Q...hF>..W...$X T'.w(....Lb.lX........[..Ks.N.........h._Y. @....6.ti....W._.o.... R.,.Q......b.........J........"...7....&...7.n.w..)..q...........[.k5....x......!6..r{....0.........`9,6...P...U.~j.....8....x)...k...........V....<O_1a.Z.z...`....?...X..0..G.F.;%._...$...CMBBBBBb...N..9.gj4h-.>.....}....l}.@5.cZJ..d.`........1p.......\|. j..1.n$VN.....M .....q-.<.NW....0........`.].c..8..L.w.^........p....a...`f.y.i.."...U)...]..(>v..M._.Q....0}....~.^1a..`.8C..rHIHHHHHH.......P.8?R.^..1.c...s..VB...W..&..Is./g..J......."9l$$$$$$$........

Chrome Cache Entry: 88

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 143910
Category:	downloaded
Size (bytes):	27791
Entropy (8bit):	7.98448667913166
Encrypted:	false
SSDEEP:	768:qD3LXuyNjxA8tmYjEBCVe+qyZBGLfGnpc/tkgfEMn2EV:qbLXuubtmYjEDQZBGLenotaM2EV
MD5:	339809279FF5E1D19CAD391583D89179
SHA1:	276172732A3A9D101121A025C91EE2065CCCEB94
SHA-256:	EBE013976E678C3AE22F040AFC34F5D54BF9FE530EFFCC57268287457E990767
SHA-512:	DB3CE057D16A66D3AD62794CD82E1FBD54369DE4430346D692AC317DEDE4547BE789008BA56ABFDA94F285BF5064D5F87B187EDD24083DE46FCD19BEB6D8DFD0
Malicious:	false
Reputation:	low
URL:	https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/style_v2.css
Preview:	...........k..8......?0%.T.t.~...&gj{f.lz.C..5Si.@.D....0.C...}......).z.!.......~....?y..s..D.{.mv...>.ZD.?f....Ix.N.3...d...A....o..5...Y....;I.).^.0H._......Kt^.U.....}..1....)S.....?........~...........H.....9...s.4/.W.vi...'...c.%..O.....=:.v.&8.&...1=.......v.9.R.y....4.....3.1...Tz3Xv..e......x..qY j..$JU..............S.>.uU..H!..^).....R..d.g.. ..a..)E.....O...EL.o...._)..p.?.x.f.uA..e.6..b~#..)...H.>5Q.P.6B_..\|..j0..0..u.....^H....^..9~...Hf.E^...$..`>)...1hD.2..M...p.\|)e.O.).....p.!....C.H.Z.+.......$m.U..{?.&JPd.6.M..qJL..M.{A..B.L..>....LM.%...Hk..TK!.cff..)...="....q_r..\|..e.A[/...g.s.1./f&..I.`.w..`.....}....g.fJ .Lw..2~....rnV................9..s.ya..W...;..3..Y6.....s.e.R.~..7......q../.P<MP..OP.c...#..6M.V..6.:....n..rU...u:.k+...l..W.b4.$.c....i.Ls.y~.9@q..v...&..%."...vY...\|F.s.Y..R~....69%Y){.;.C..>...T=F...3..k..aYd.f. X................=P.y.O8.....C.\....c.. .5....(.........4.3S.0Qj.?...NTM.BR.i.j$.u.[...A.=(?}.1.u./

Chrome Cache Entry: 89

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	88145
Entropy (8bit):	5.291106244832159
Encrypted:	false
SSDEEP:	1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
MD5:	220AFD743D9E9643852E31A135A9F3AE
SHA1:	88523924351BAC0B5D560FE0C5781E2556E7693D
SHA-256:	0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
SHA-512:	6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.4.1.min.js
Preview:	/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var

Chrome Cache Entry: 90

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	609
Entropy (8bit):	7.373509842376379
Encrypted:	false
SSDEEP:	12:6v/7iMXrlEZ4LD9JJf50/ZjE1EfUJl7VEixhr3yo/oqyt9w+:s2qDHFi/dE12UJl7mCr3pwqy
MD5:	92FF7DBE66070560FA88EF4194AA9050
SHA1:	CD7F6064F9ECD62EC13CEA642B2BA4DE87178126
SHA-256:	9F3C18FA322BB276EF4ADA3F388177344F4713044D132EF698DC128CC2664ED8
SHA-512:	0021B77423E37DD93925530DF435236821CB25F0ACB5F7B58EF7A48ADA7C091A0EE6B077F8652009F08D27F48F5635745D2236FAEF01A4EA8F2D8129FE85813B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bLXq......a`@#..Z...L...F.0..`..A.b......r.l..>.b8..+.W...\...~..........".....N6...Av...?X..[.......\|L\...5...3t.{...O.....B..=T@...z.6..SX..H!.g..2`...".,x.a....fb`.D%.7_...."..R..e..Cb..3..8r.3qQ.../..A..B..\|G.\|..o......(.....l..t.....d..).[......D9.........(.+X..).(%:.`.sr.(.Hr.(....'X..J0..B.s......s.3`b\|.Qt.....L^].J`...Y.E...P..._J...o).....C.#@.GL:b".7..[..,.p%..W.Q.=..@..."/...}..$....Z..jEb.(..=..`.#..P..Z4 _.c9(....]7?..eYp.\ .r......0........"..T.`...4...(HI...f...Hu@......`......c......IEND.B`.

Chrome Cache Entry: 91

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (342), with no line terminators
Category:	downloaded
Size (bytes):	348
Entropy (8bit):	5.383619855552355
Encrypted:	false
SSDEEP:	6:hn8FRcJCc4ssncOb+n4mc4sLzA9MhH4N8nZ3X96THFAbVgmMA+25/tKs/G0ZKD:hnM+J0Nb1n+NYkJCVjB+251KM4D
MD5:	6A33137CCA2F3C3E7F86A99CAB174E29
SHA1:	EEBFC4B54C87BC5079D379C95E5535C2DC665BA2
SHA-256:	02D5D26C1BE0B1B17BF65BA5AC9E1D888EA39094625919B2B0F296E911ADC954
SHA-512:	691CC2F6CEB6B0081E9496BC5960AD2002E3B3DD980033322B9D35C0569EAB1745841C9C2B33554361A492A47702C6285CC47C9EFD4404DA82A5A2A5211810A1
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/actualite/rapport-dactivite-2024-de-la-dgfip
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>Page non trouv.e \| impots.gouv.fr</title></head><body><h1>Page non trouv.e</h1><p>L'URL demand.e "/actualite/rapport-dactivite-2024-de-la-dgfip" n'a pas .t. trouv.e.</p></body></html>

Chrome Cache Entry: 92

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	5776
Entropy (8bit):	5.406333618109174
Encrypted:	false
SSDEEP:	96:ZOEMIJOEMiDFZ8OEMXkOEMhYOEMvOEMkyhZcyJzV+zmnWOEMfubqGIFuYUOEMmOb:wIAiXBh1Skuy22bqGIwYR3XqO
MD5:	C840A8EFA9639BA51FFFF865A6D5B3ED
SHA1:	00C77DA03DDCFA49CC08A7229BA8FA3F9AFCCC38
SHA-256:	C3061C3788AD5783EF8A5D10C454BAFE7EB942C48200DCCC852CC6D3C9F303D4
SHA-512:	E73A55A7CB4906133D3C85F7F7F5BC1435FB1AE023A565B446B9A628D2540B7501EECC6D6CDC3276871BC418C16DAAE14FF0C84E9A10A691CC40597400ECDEC1
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-fa

Chrome Cache Entry: 93

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	7.295677631925419
Encrypted:	false
SSDEEP:	48:dqQNn2qODJ3ektQ3mLQNF+um9lUR4a+nUFpYUa:wY27htQ3TNv8GR4OFpYV
MD5:	FD9D710F2BB6E7BFFE7180AF7B6E161E
SHA1:	623587FFD942AF1C9682B27799B30FA17F87316B
SHA-256:	2D1B87D0960A07DC0966F75B1986CA600DEF5B8607144C6B6A617E496E0FFAD6
SHA-512:	5F77A0D600BAE35A573E75A1FD515AE149A031B01C0C0FA68101F219036EF51BA7158A783B6A2A81C6E8A9EE8E5061986A241B83FC0819969D980648AE7DBF66
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F38B721A641711E589C9A697BE9A2657" xmpMM:DocumentID="xmp.did:F38B721B641711E589C9A697BE9A2657"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9D415C75641711E589C9A697BE9A2657" stRef:documentID="xmp.did:9D415C76641711E589C9A697BE9A2657"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx..W_H.Q......>.....LZAa..B..`...\|....!.eJ.eo:.R\|H.@..a.. . ..)i.........~....77._../...?...9.s.....^

Chrome Cache Entry: 94

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	7.793242643873362
Encrypted:	false
SSDEEP:	24:hoZGqByDBT2OxAL5TH1Ee3beNxpz6R+53V7yjMxCmbAWzmGOciBdaB6syZXobS:ucqBybgb1ECGxtf5l7yjMxCr5BduypoO
MD5:	89B9C3344FF7C720F1B806AACFF01665
SHA1:	7C830AD632CE18A52037BA9E6CC5848CD2D77338
SHA-256:	673744A80E07214A8FD23D30B74A224F72B0E8C30D9504EA1F45CC522D07BF85
SHA-512:	15FBFD9A051B4ABBC281FD9B3298A2385D40BC166C428F174AAAD0DCFB9C5C97F529043614F94913FD9079FBD613B56365EA2E2684B7725A391DB3CEAB90A9A1
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(.........6.f....zTXtRaw profile type exif..x.UY..!....9.^0.8.Rn..{^f&..(F..1^.....s...\=h.n.,..h.....c\|.b...Q,.?.../.G...W.c...HoE.^..\|.zU.. ....rOH..`.....m`.!ZNj.S.a.Q..0.\|Y.($I...%..d.E....liX..o.dog.R........'.1.......C9(?..H...k\|.p..,.2............h.{...".g.....<.Z.P.vW.#x..P.G.@%Z.$]S... ..\|...n...E...MBF.2F..(..c..@[..efVf...0.._..m6..3z...!.2...-...Z}CD.@..#A..wZv.....1d..]k...'..$T^......+.;....`....h\|..3$`.. ......F...@.Y.K6\|.......B`..eaM.....(....1.....,.......U.T.Vj..SR..u/@.n..2.}.....%K.K.y..6....7...,i.25....\|NT..k..JB......cH}Ro...:R..Hz.s...3...).R.Mx.e..@5r.:V...J-.....G@..4.C.f..'y".Rp.5w..B....e.....W..F...\|.e....^......Z.$%>2U.......(.JC..=...=ul...e!.....2...V.......sBIT....\|.d.....IDATX...R.0..W.P.Xp.[...\|..u....%.}..u.`...;B`..'+./yzz2.B.c..1....'B.8.....?.su....j..y.(.0...5GJ...t.....4Ma.A..H.d..a.0...R..RJ.B`...v. ..Q.!MSPJA)...*.c.q.c.nnn...c.].a....- ..Y.!.2....o.)B.}>.C.y....4......E.,.0..

Chrome Cache Entry: 95

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegularAscender - Open Sans
Category:	downloaded
Size (bytes):	217360
Entropy (8bit):	6.419276317380006
Encrypted:	false
SSDEEP:	6144:Y6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCl:n9FrIJJaqCNktA+SXfUCl
MD5:	629A55A7E793DA068DC580D184CC0E31
SHA1:	3564ED0B5363DF5CF277C16E0C6BEDC5A682217F
SHA-256:	E64E508B2AA2880F907E470C4550980EC4C0694D103A43F36150AC3F93189BEE
SHA-512:	6C24C71BEE7370939DF8085FA70F1298CFA9BE6D1B9567E2A12B9BB92872A45547CBABCF14A5D93A6D86CD77165EB262BA8530B988BF2C989FADB255C943DF9B
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/themes/custom/pus_inea/dist/fonts/open-sans/regular/OpenSans-Regular.ttf
Preview:	...........0DSIG..D...;....tGDEF.&....7\|....GPOS.7.7..7....8GSUB.+=...7.....OS/2.>.........`cmap)./h........cvt .M..........fpgm~a..........gasp...#..7l....glyft8.K..%.../.head.v....<...6hhea...s...t...$hmtx.5<.........kernT+.~..U@...6loca)......4...Vmaxp.C......... names......x....post.C.l...@..&+prepC...................!..__.<..........51.......LL.......b...........................{...............................V......./.\.......................3.......3.....f..................@. [...(....1ASC.@. ...........X ........H..... ...................#...5...+.3.......h...q.....^.R.^.=.j.V...h...?...T.!.........f.......d...^...+.......u...^...h...j.!...!.?...h...w...h.o...1.y...../.....}.....s...!.....}.......T.#.`.....'...9.......;.}.....;.}.....d.j.m...........h.......{.....R...........3.V.1.........s.^.......s...s.}.s.....b.'.............3.......q.........s.......s.D.....j.............9...1.'.......R...=.h.....H...h.....#.........?...{.....h...!.{...5...d...F...R...h...T...d.....m.....h

Chrome Cache Entry: 96

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 804 x 604, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	199039
Entropy (8bit):	7.9893373863943715
Encrypted:	false
SSDEEP:	3072:+SnuXAX1GSBa0egY3j4Kji42PEJWYDnaMYbkv7ottkZFRclt2GzA3K1anJWDG:/uX4eP3iMJWYOMREfSF13K1HDG
MD5:	38913BCF7484E43BF5472B79DBB57962
SHA1:	3955EBB0F5470042F2DEF0479698CA71EC405BAA
SHA-256:	EA192FCB8D784EAB17A9E9C2A40DABF4DEBDCAC48ADBFD148B52A8425DA118F4
SHA-512:	9A8FD2AD21AD45928E0B31E3C2F1472D1B55EA7104AB8CE84F7EF1E0CE87AA7109AEF959C500A778D0CDB2FEC9A31040776A91BAFC26D42BE7404B7A35152DF3
Malicious:	false
Reputation:	low
URL:	https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG
Preview:	.PNG........IHDR...$...\.......`.....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^...UU......._.:......X %. .".bwww...tww#Hw..~k.}.y/....F..S..>.}....x.Zqssss..%.W.S[..['.V..E...9.../...}&...].........KW5=..=3.g.{.\#..B.8.......e.....&...e..mQ&.nnnnn.5.7q8...8..?..b...2p."...........&..aA......A.........7rW.q2u.JY.~..'.7...p......p8~.X..@..Y".>...<...-.'$.G$-H..K,.n..w].hB(.k]-}.=.....h..l.l(@.l..q8...o..H....7.u.6.%+....e.......z#.&.{DB!..G.....b..72.+....E>S.7.....a.{W....r.#_..?..YKVY.H..IN.................@..X'.>.,...I!1.....F.....B..X.W..fC.>.....{...o..{....D..?If-]... ...C.,q8...o..H....7......2z.R.....}..!T&..(1.pS.....z68.tAb.2.".....w.<L...[>....\..0I&.\as_H........p8~.pA.p8..q.:_ .T...{......\|DA.......#a.\|.#..S..'.#..?^.C....a..==....eM"F2Hi..$............#.....>l.Ri..p.....?m.;....0.+,~.so.&..;Rh.WV....]..'.....csF6l..#..C..J?q8...o..H....7.,....;c.i..@..A.....%..~ *(...dhW..yIF8.bG..E.........rG..2...8g$&....X....

Chrome Cache Entry: 97

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	209
Entropy (8bit):	5.143049113812332
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3ezJLM4KCezocKqD:J0+oxBeRmR9etdzRxy17ez1T
MD5:	18FFB59B61525F781CF9251045BE575D
SHA1:	BD7318B00B15B7A1C8A48524419FA2E5C27A5B6D
SHA-256:	B6682CAB65D3243B5B75EFB7279DBF49491957484780F2BA0A87632CC0E25642
SHA-512:	A032F853ABD9492232E1183D1CB1D14110B623F2E9DEC56B7B64DD576A0317DDA8D51125763E11D6642433C5364B2BD10A994EE4F1514629A4950BBAB3ABA499
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /favicon.ico was not found on this server.</p>.</body></html>.

Chrome Cache Entry: 98

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	4.176616191925469
Encrypted:	false
SSDEEP:	24:Xa6LwORAQ8IBH8R8OfZfPAXRlo8ehTpRAxv34Dsw1O0:Xc+AOqR8KX4RlBcR8oO
MD5:	4C2C39D7CB584994B956B7001FC462E1
SHA1:	82C00353C1CA67D925E65FD6022CD0CCBC0F5C3C
SHA-256:	99AF879888A29FEEEC095725F74E18CD070DE29E7F1B4A35F20746FA45382C21
SHA-512:	FF39C0EC947C7DA6E775DB481A40684AC97B19F1DBBFDFE6CB3BAD5EDDBDC1CC20A9F5648573452A4AD38F69EF84F1C3DF069EC57EF0C8A293D115790F417268
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/themes/custom/pus_inea/favicon.ico
Preview:	............ .h.......(....... ..... .........................................................................................................................h....................................................p].lH(.....(.......................................................zW9.....?.......................................................vS5.....@.......................................................vR3.....A.......................................toj............uQ1.~...?...........................................A0..tmf.c[S.B-..GYa.-P`...}.........................................kT<.[@&.V:..X=!.X>!.]A".^B#.X;..\J5.....................................nJ,.~...@.................z..tb................................rM,.....A.......................................................pK+.....C.......................................................pJ).....4.......................................................kH(.....0...L...N...U...l....{n..............................uc.S2...q`..qa.\|n_.{m

Chrome Cache Entry: 99

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18314)
Category:	downloaded
Size (bytes):	255672
Entropy (8bit):	5.265464932754465
Encrypted:	false
SSDEEP:	3072:Iqa0OgghhA2dXNkCvK4uJ6wm8EkDCnq/kHyW3V66Mr:dgTkCTCy8Exq/MyW3V6pr
MD5:	5178F42F95B57233E26326F6239F865D
SHA1:	D456602A25C6265C428AFB129227018FB6B067DA
SHA-256:	474541BF2681F88D77E4FD59DB190B8ABEF00D31CC23BD97AB4B03687FC3660E
SHA-512:	AEC1EF4A131FFD81E2A344778F5AF75E70DABEF1474EFD4A6B43D5FD07709E37BD3155482C94C923D867B968AC4F6DD9ACB22A993D14F76FB0CC618A645722FE
Malicious:	false
Reputation:	low
URL:	https://www.impots.gouv.fr/sites/default/files/js/js_HbFP6f-zTrnQQIRqSrPEB9t9dK8HwpT9xld110wmT_8.js?scope=footer&delta=0&language=fr&theme=pus_inea&include=eJx1T9FuBCEI_CF7fpJhkd2ji2BEe7FfX3vb5tKHJiQzYWAYNsAzdVtV4_bi6d3D9o_EaBp8eqey-k4BBdznH17IHQ7ygNYoqrUCwp8U6vAEubDGQ2wDefM-hfV4CqwEcW9Q6GHtDA_a9rUYf_CWGcSuSTwpc7eWqoyD1SPgOpTZ9LY3006aX47V6qjJ79AoFWAJbrisUlke8J2aMQhMGz1ldrQPajOaEpr8vqOWr-w0hBqDRlbuz44TNLzHC74AvuSDJg
Preview:	/* @license GNU-GPL-2.0-or-later https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md /./! @drupal/once - v1.0.1 - 2021-06-12 */.var once=function(){"use strict";var n=/[\11\12\14\15\40]+/,e="data-once",t=document;function r(n,t,r){return n[t+"Attribute"](e,r)}function o(e){if("string"!=typeof e)throw new TypeError("once ID must be a string");if(""===e\|\|n.test(e))throw new RangeError("once ID must not be empty or contain spaces");return'[data-once~="'+e+'"]'}function u(n){if(!(n instanceof Element))throw new TypeError("The element must be an instance of Element");return!0}function i(n,e){void 0===e&&(e=t);var r=n;if(null===n)r=[];else{if(!n)throw new TypeError("Selector must not be empty");"string"!=typeof n\|\|e!==t&&!u(e)?n instanceof Element&&(r=[n]):r=e.querySelectorAll(n)}return Array.prototype.slice.call(r)}function c(n,e,t){return e.filter((function(e){var r=u(e)&&e.matches(n);return r&&t&&t(e),r}))}function f(e,t){var o=t.add,u=t.remove,i=[];r(e,"has")&&r(e,"get").tr

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 00:18:03.438760042 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:03.438791037 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:03.782486916 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:12.958328009 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:12.958367109 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:12.958422899 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:12.959484100 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:12.959497929 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.048137903 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:13.048137903 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:13.393985033 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:13.747977972 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.748074055 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.764166117 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.764188051 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.764621973 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.774410963 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.774468899 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.774475098 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.774662971 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.819402933 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.953551054 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.954035997 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:13.954134941 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.954387903 CEST	49713	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:13.954402924 CEST	443	49713	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:14.281703949 CEST	49716	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:14.285398006 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:14.292304993 CEST	80	49716	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:14.292325974 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:14.292398930 CEST	49716	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:14.292500019 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:14.292896986 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:14.298136950 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:15.009807110 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:15.059406996 CEST	443	49706	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:15.063222885 CEST	49706	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:15.064440012 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:15.377979994 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:15.378065109 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:15.378146887 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:15.380424976 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:15.380458117 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.475155115 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.475474119 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.475491047 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.476774931 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.476857901 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.482625961 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.482693911 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.482995033 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.483005047 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.530359030 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.553735018 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:16.553757906 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:16.553822994 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:16.554496050 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:16.554507971 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:16.757438898 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.758189917 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.758235931 CEST	443	49718	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.758308887 CEST	49718	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.762921095 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.762979031 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:16.763278961 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.763705969 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:16.763722897 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.211179018 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:17.211496115 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:17.211513042 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:17.212523937 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:17.212585926 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:17.426450014 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:17.426680088 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:17.472486973 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:17.472501993 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:17.497665882 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.497914076 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:17.497940063 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.498282909 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.498585939 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:17.498642921 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.498852968 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:17.517894983 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:17.539406061 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.904599905 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.905133009 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.905189037 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:17.911878109 CEST	49722	443	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:17.911905050 CEST	443	49722	186.202.135.207	192.168.2.6
Sep 28, 2024 00:18:17.944448948 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:17.944494009 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:17.944928885 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:17.945519924 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:17.945538044 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.204474926 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.204533100 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:18.204682112 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.209686995 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.209703922 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:18.450165987 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.450556040 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.450579882 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.451680899 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.451757908 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.453509092 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.453582048 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.453960896 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.453969955 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.499433041 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.622981071 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.623018026 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.623028040 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.623086929 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.623107910 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.675170898 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.687216997 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.687232018 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.687258959 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.687293053 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.687335014 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.687345028 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.709556103 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.709569931 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.709626913 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.709651947 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.710974932 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.711008072 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.711033106 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.711045027 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.711093903 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.712521076 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.712529898 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.712578058 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.712587118 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.731549978 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.731585026 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.731612921 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.731652975 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:18.731668949 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.787163019 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:18.858972073 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:18.859044075 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.862241030 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.862260103 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:18.862503052 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:18.911523104 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:18.959398985 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:19.063589096 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.064659119 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.064687967 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.065084934 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.065231085 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.065238953 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.065303087 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.065776110 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.065787077 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.066030979 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.066044092 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.076673985 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:19.076719999 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:19.076832056 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:19.077455044 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:19.077465057 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:19.077514887 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:19.078212023 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:19.078227043 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:19.079014063 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:19.079024076 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:19.107419014 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.130925894 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:19.130991936 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:19.131074905 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:19.185156107 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.185173988 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.185214043 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.185230017 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.185278893 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.185291052 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186235905 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186244965 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186260939 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186288118 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.186297894 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186312914 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.186382055 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.186424017 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.186431885 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.187758923 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.187768936 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.187809944 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.187818050 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.187832117 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.213816881 CEST	49724	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:19.213835955 CEST	443	49724	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:19.230848074 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.230858088 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:19.277704954 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.991213083 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:19.991252899 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.088655949 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:20.088692904 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:20.088824987 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:20.089304924 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:20.089323997 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:20.529237986 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.529476881 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.529556036 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.529562950 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.529715061 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.529722929 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.530047894 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.530131102 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.530447006 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.530514002 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.530858994 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.530963898 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.532608032 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.533725023 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.533907890 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.533931971 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.534903049 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.534964085 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.536091089 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.536154032 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.536271095 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.536277056 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.539585114 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.539762974 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.539769888 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.540800095 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.540858984 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.540865898 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.540903091 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.541742086 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.541804075 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.542006016 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.542013884 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:20.577917099 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.579411983 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.596081972 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:20.616717100 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.835867882 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.836708069 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.836733103 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.836750031 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.836771965 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.836807966 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.837483883 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.837521076 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.837560892 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.837565899 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.838272095 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.838305950 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.838310003 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.839060068 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.839103937 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.839111090 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.854988098 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.855000973 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.855046034 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.855087042 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.876080036 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.876101971 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.876157045 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.876167059 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.895016909 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.895087004 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.895097971 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.907944918 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.923371077 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923409939 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923414946 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.923433065 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923460960 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923464060 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.923470974 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923507929 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923513889 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.923518896 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.923554897 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.924360991 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.924408913 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.924436092 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.924448013 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.924453020 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.924482107 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.925362110 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.925404072 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.925436020 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.925441027 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928298950 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928307056 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928337097 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928344965 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.928356886 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928378105 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928388119 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:20.928400993 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.928415060 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.928436041 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:20.963311911 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.963373899 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.963392019 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.964797020 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.964806080 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.964840889 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.964847088 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.964859962 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.964891911 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.969568968 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.969577074 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.969619036 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.969635010 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.969655037 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.981869936 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.981911898 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.981945992 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:20.981954098 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:20.981985092 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.005920887 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.005949020 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.005956888 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.005974054 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.005981922 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.006006002 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.006006956 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.006026030 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.006053925 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.022005081 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.022025108 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.022119045 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.022130966 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.024554968 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.024569988 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.024655104 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.024655104 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.024662018 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.025017977 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.025404930 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.025485039 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.025507927 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.025592089 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.025764942 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.025765896 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.025779963 CEST	443	49729	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.027399063 CEST	49729	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.040333986 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.040383101 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.040544033 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.040682077 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.040709019 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.048930883 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.049122095 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049169064 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049242020 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.049242020 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.049253941 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049585104 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049592972 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049616098 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049643993 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.049649954 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.049675941 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.050383091 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.050390959 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.050462961 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.050463915 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.050471067 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.051254034 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.051289082 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.051315069 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.051321030 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.051347017 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.052166939 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.052263021 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.052268982 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.053196907 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.053272963 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.053278923 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.068767071 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.068972111 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.068980932 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.080897093 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.080929995 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.080995083 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.081027031 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.081027031 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.081037045 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.081059933 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.081079960 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.081294060 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.091600895 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.091751099 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.091759920 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.091790915 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.092051029 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.092051029 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.092061996 CEST	443	49728	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.092086077 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.092185974 CEST	49728	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.113795996 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.113807917 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.113853931 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.113888025 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.113894939 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.113926888 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.114458084 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.114469051 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.135976076 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.135987997 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136020899 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136113882 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.136113882 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.136121988 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136531115 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136539936 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136559010 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.136641979 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.136641979 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.136647940 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137062073 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137072086 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137154102 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.137159109 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137909889 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137942076 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.137973070 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.137978077 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.138062000 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.138748884 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.138895988 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.138901949 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.139097929 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.139374971 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.139379978 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.139942884 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.140113115 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.140117884 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.140728951 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.140873909 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.140881062 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.141593933 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.141722918 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.141727924 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.141741037 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.142046928 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.142052889 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.142591000 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.142707109 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.142713070 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.142786026 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.170984030 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.171015978 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.171159029 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.171879053 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.171895981 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.384902000 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.384995937 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.386656046 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.386665106 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.386904001 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.388171911 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.435404062 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.495971918 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.496372938 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.496388912 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.497354984 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.497451067 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.497893095 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.497893095 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.497947931 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599298000 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599312067 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599533081 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.599555016 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599566936 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599596024 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.599623919 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.599623919 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.599720955 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.608293056 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:21.608330011 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:21.609251976 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:21.609585047 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:21.609596014 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:21.663537025 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.663608074 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.664463043 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.664535046 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.664557934 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.664588928 CEST	49730	443	192.168.2.6	184.28.90.27
Sep 28, 2024 00:18:21.664594889 CEST	443	49730	184.28.90.27	192.168.2.6
Sep 28, 2024 00:18:21.682470083 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.682480097 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.682537079 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.682550907 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.682559967 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.682574987 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.682579041 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.682601929 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.682811975 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.692836046 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.693198919 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.693207026 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.694282055 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.694555044 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.694807053 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.694807053 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.694874048 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.722975969 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.722994089 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.723161936 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.723176003 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.723470926 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.768385887 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.768404007 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.768500090 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.768516064 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.768697977 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.769598961 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.769615889 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.769769907 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.769777060 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.769850016 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.770366907 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.770443916 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.770468950 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.770750999 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.770757914 CEST	443	49732	151.101.130.137	192.168.2.6
Sep 28, 2024 00:18:21.770782948 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.770813942 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.770813942 CEST	49732	443	192.168.2.6	151.101.130.137
Sep 28, 2024 00:18:21.782710075 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.782720089 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.826020956 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.826402903 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.826420069 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.830480099 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.830611944 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.830620050 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.832886934 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.832901955 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.832937002 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.832961082 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.832971096 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.832981110 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.833076000 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.833302975 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.833460093 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.833496094 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.851547956 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.851557970 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.851579905 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.851651907 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.851651907 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.851663113 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.875586033 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.875592947 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:21.905991077 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.923165083 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:21.925614119 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.925625086 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.925648928 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.925739050 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.925739050 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.927129030 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.927138090 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.927161932 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.927216053 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.927216053 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.928673029 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.928680897 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.928703070 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.928762913 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.928762913 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:21.943963051 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.943970919 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:21.944025993 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.025259018 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025273085 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025324106 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025358915 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025379896 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.025388002 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025408983 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.025592089 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.025759935 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.025811911 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.026618958 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.026724100 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.026806116 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.026878119 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.027654886 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.027750969 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.027800083 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.027930021 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.038204908 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.038332939 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.090781927 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090810061 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090816975 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090837955 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090877056 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090898037 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.090903044 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.090919971 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.094775915 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.117810965 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.117858887 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.117912054 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.117925882 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.117969990 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.117979050 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.118108034 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.118176937 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.118412018 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.118470907 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.118545055 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.118607998 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.118854046 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.118930101 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.119076967 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.119149923 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.130661964 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.130770922 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.130912066 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.131037951 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.140319109 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165555954 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165586948 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165663004 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165702105 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165709972 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165730000 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165740013 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.165750027 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165750027 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165750027 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165775061 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.165792942 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.176314116 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.176407099 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.176414967 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.176512003 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.178478003 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.210556984 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.210673094 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.210828066 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.210828066 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.210846901 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.262185097 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.410939932 CEST	49733	443	192.168.2.6	185.15.59.240
Sep 28, 2024 00:18:22.410964012 CEST	443	49733	185.15.59.240	192.168.2.6
Sep 28, 2024 00:18:22.416207075 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.416279078 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.447706938 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.447726965 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.448127985 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.492103100 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.496370077 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.496603012 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.496618032 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.496948004 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.543401957 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.673290968 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.673485041 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.673537016 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.678616047 CEST	49735	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:22.678653002 CEST	443	49735	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:22.764123917 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:22.764142990 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.880922079 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:22.922270060 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:25.858938932 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:25.859044075 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:25.859105110 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.044239044 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.044323921 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.044375896 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.111183882 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:27.111262083 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:27.111341000 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:27.308424950 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.308469057 CEST	443	49734	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.308482885 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.308533907 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.308535099 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.308566093 CEST	49734	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.308573961 CEST	443	49723	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.308620930 CEST	49723	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:27.318603039 CEST	49721	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:18:27.318625927 CEST	443	49721	172.217.16.196	192.168.2.6
Sep 28, 2024 00:18:27.880597115 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.880686045 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:27.880871058 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:28.284848928 CEST	49706	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:28.284989119 CEST	49706	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:28.285572052 CEST	49745	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:28.285644054 CEST	443	49745	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:28.285756111 CEST	49745	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:28.286201000 CEST	49745	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:28.286231041 CEST	443	49745	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:28.291341066 CEST	443	49706	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:28.291357040 CEST	443	49706	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:28.880435944 CEST	443	49745	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:28.880552053 CEST	49745	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:30.324184895 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:30.324218988 CEST	443	49725	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:30.324229956 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:30.324258089 CEST	49725	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:30.856306076 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:30.856406927 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:30.856470108 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:31.166876078 CEST	49726	443	192.168.2.6	50.6.152.208
Sep 28, 2024 00:18:31.166908979 CEST	443	49726	50.6.152.208	192.168.2.6
Sep 28, 2024 00:18:36.166837931 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.166872025 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.167049885 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.167582035 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.167593956 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.972395897 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.972579956 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.977880001 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.977902889 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.978204966 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.980228901 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.980367899 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:36.980381012 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:36.980483055 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:37.023443937 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:37.155250072 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:37.155355930 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:37.155678034 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:37.156877041 CEST	49749	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:37.156893015 CEST	443	49749	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:44.669472933 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:44.669522047 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:44.669728041 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:44.669994116 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:44.670013905 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.746073008 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.751069069 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:45.751110077 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.752358913 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.752427101 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:45.754304886 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:45.754405022 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.754661083 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:45.754669905 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:45.797466993 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.094852924 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.094877005 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.094885111 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.094894886 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.094923019 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.094954967 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.094984055 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.095029116 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.095063925 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.098673105 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.098711014 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.098732948 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.098742962 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.098767996 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.098788977 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.099642992 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.099705935 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.099714041 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.099734068 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.099776983 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.104110003 CEST	49765	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.104130030 CEST	443	49765	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.176547050 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.176587105 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.176644087 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.176856041 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.176867008 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.280004978 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.280045986 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.280288935 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.280765057 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.280783892 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.797447920 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.827173948 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.827193022 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.828453064 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.828535080 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.829181910 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.829252005 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.829664946 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.829672098 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.875349045 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.898216963 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.898628950 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.898643017 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.899038076 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.899496078 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.899564981 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:46.899688959 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:46.947396994 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133171082 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133199930 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133208036 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133224010 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133234024 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133239985 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133306980 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.133306980 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.133322954 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.133368015 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.140224934 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.140258074 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.140324116 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.140330076 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.140379906 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.140398026 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.140945911 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.141033888 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.141040087 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.141087055 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.150748014 CEST	49778	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.150764942 CEST	443	49778	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219089985 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219109058 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219162941 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.219177008 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219222069 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.219228983 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219248056 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.219306946 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.221079111 CEST	49781	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.221093893 CEST	443	49781	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.226448059 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.226474047 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.226531982 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.226782084 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:47.226798058 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.856327057 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:47.905658007 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.035350084 CEST	443	49745	173.222.162.64	192.168.2.6
Sep 28, 2024 00:18:48.036020994 CEST	49745	443	192.168.2.6	173.222.162.64
Sep 28, 2024 00:18:48.120439053 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.120465040 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.121040106 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.121702909 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.121777058 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.122824907 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.163402081 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.308624029 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.308645964 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.308712959 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.308773994 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.308801889 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:48.308846951 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.309670925 CEST	49784	443	192.168.2.6	91.134.109.31
Sep 28, 2024 00:18:48.309701920 CEST	443	49784	91.134.109.31	192.168.2.6
Sep 28, 2024 00:18:51.040869951 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:51.040920973 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:51.040998936 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:51.043600082 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:51.043616056 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.066987038 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.067079067 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.068798065 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.068808079 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.069602966 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.071522951 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.071573973 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.071580887 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.071713924 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.119399071 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.241494894 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.241874933 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.241945028 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.242218971 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:52.242238045 CEST	443	49789	40.113.103.199	192.168.2.6
Sep 28, 2024 00:18:52.242270947 CEST	49789	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:18:59.296214104 CEST	49716	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:18:59.301033020 CEST	80	49716	186.202.135.207	192.168.2.6
Sep 28, 2024 00:19:00.015315056 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:19:00.022504091 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:19:11.480046988 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:11.480093956 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:11.480158091 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:11.480878115 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:11.480900049 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.278527021 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.278701067 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.280510902 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.280523062 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.280791044 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.285084963 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.285270929 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.285276890 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.285412073 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.331397057 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.462169886 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.462245941 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.462685108 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.462685108 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:12.462711096 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:12.462739944 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:14.360270977 CEST	49716	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:19:14.365364075 CEST	80	49716	186.202.135.207	192.168.2.6
Sep 28, 2024 00:19:14.365600109 CEST	49716	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:19:16.566660881 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:16.566709995 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:16.566770077 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:16.567056894 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:16.567070961 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:17.200649023 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:17.200997114 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:17.201014042 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:17.202080011 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:17.202616930 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:17.202790976 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:17.250034094 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:20.001647949 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:19:20.001741886 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:19:21.095860004 CEST	49717	80	192.168.2.6	186.202.135.207
Sep 28, 2024 00:19:21.281047106 CEST	80	49717	186.202.135.207	192.168.2.6
Sep 28, 2024 00:19:27.160115957 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:27.160286903 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:27.160341978 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:29.098459959 CEST	49795	443	192.168.2.6	172.217.16.196
Sep 28, 2024 00:19:29.098484039 CEST	443	49795	172.217.16.196	192.168.2.6
Sep 28, 2024 00:19:37.321516037 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:37.321554899 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:37.321638107 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:37.323282003 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:37.323304892 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.164959908 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.165067911 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.169492006 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.169504881 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.169843912 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.171618938 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.171746969 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.171753883 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.171839952 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.215395927 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.367060900 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.367234945 CEST	443	49797	40.113.103.199	192.168.2.6
Sep 28, 2024 00:19:38.367404938 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.367404938 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.672163010 CEST	49797	443	192.168.2.6	40.113.103.199
Sep 28, 2024 00:19:38.672188997 CEST	443	49797	40.113.103.199	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 00:18:12.516602993 CEST	53	57726	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:12.655240059 CEST	53	61634	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:13.732304096 CEST	53	59342	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:14.037645102 CEST	53417	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:14.037971020 CEST	60329	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:14.229872942 CEST	53	53417	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:14.448559046 CEST	53	60329	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:15.286416054 CEST	61810	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:15.311546087 CEST	53	61810	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:15.350845098 CEST	59705	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:15.475919008 CEST	53	59705	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:16.512686014 CEST	50691	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:16.513446093 CEST	62719	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:16.549216986 CEST	53	50691	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:16.551924944 CEST	53	62719	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:17.917151928 CEST	56483	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:17.917526007 CEST	59854	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:17.935208082 CEST	53	56483	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:17.943670988 CEST	53	59854	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:19.061825037 CEST	51520	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.062177896 CEST	56403	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.066518068 CEST	51917	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.067034006 CEST	56164	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.067727089 CEST	50751	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.068078995 CEST	55420	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:19.075834036 CEST	53	51917	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:19.075892925 CEST	53	56164	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:19.076808929 CEST	53	50751	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:19.076903105 CEST	53	55420	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:20.745143890 CEST	53	58359	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.030427933 CEST	57163	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.030427933 CEST	51635	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.039580107 CEST	53	51635	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.039684057 CEST	53	57163	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.103626013 CEST	58452	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.103931904 CEST	57353	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.113048077 CEST	53	58452	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.113325119 CEST	53	57353	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.146792889 CEST	64529	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.146966934 CEST	54857	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:21.159020901 CEST	53	64529	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.170449018 CEST	53	54857	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:21.906286955 CEST	53	63271	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:22.740923882 CEST	60086	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:22.741070032 CEST	64739	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:22.749463081 CEST	53	60086	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:22.749917030 CEST	53	64739	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:22.751844883 CEST	53638	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:22.761662960 CEST	53	53638	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:27.425718069 CEST	57697	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:27.425964117 CEST	51820	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:32.472137928 CEST	53	50460	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:43.867590904 CEST	59121	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:43.867865086 CEST	53542	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:44.653418064 CEST	54410	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:44.653728008 CEST	54330	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:44.662627935 CEST	53	54410	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:44.696887970 CEST	53	54330	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:46.133399010 CEST	62692	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:46.133721113 CEST	61621	53	192.168.2.6	1.1.1.1
Sep 28, 2024 00:18:46.174129963 CEST	53	62692	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:46.176034927 CEST	53	61621	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:46.233230114 CEST	53	56010	1.1.1.1	192.168.2.6
Sep 28, 2024 00:18:51.542737007 CEST	53	60397	1.1.1.1	192.168.2.6
Sep 28, 2024 00:19:11.942348957 CEST	53	49293	1.1.1.1	192.168.2.6
Sep 28, 2024 00:19:14.368016958 CEST	53	52261	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 28, 2024 00:18:14.448668003 CEST	192.168.2.6	1.1.1.1	c228	(Port unreachable)	Destination Unreachable
Sep 28, 2024 00:18:15.476130009 CEST	192.168.2.6	1.1.1.1	c228	(Port unreachable)	Destination Unreachable
Sep 28, 2024 00:18:44.699265003 CEST	192.168.2.6	1.1.1.1	c249	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 00:18:14.037645102 CEST	192.168.2.6	1.1.1.1	0x4508	Standard query (0)	emailmarketing.locaweb.com.br	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:14.037971020 CEST	192.168.2.6	1.1.1.1	0x1ecb	Standard query (0)	emailmarketing.locaweb.com.br	65	IN (0x0001)	false
Sep 28, 2024 00:18:15.286416054 CEST	192.168.2.6	1.1.1.1	0xf371	Standard query (0)	emailmarketing.locaweb.com.br	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:15.350845098 CEST	192.168.2.6	1.1.1.1	0x2ff8	Standard query (0)	emailmarketing.locaweb.com.br	65	IN (0x0001)	false
Sep 28, 2024 00:18:16.512686014 CEST	192.168.2.6	1.1.1.1	0x3314	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:16.513446093 CEST	192.168.2.6	1.1.1.1	0x40d1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 28, 2024 00:18:17.917151928 CEST	192.168.2.6	1.1.1.1	0xd814	Standard query (0)	fgt.ive.mybluehost.me	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:17.917526007 CEST	192.168.2.6	1.1.1.1	0xc4be	Standard query (0)	fgt.ive.mybluehost.me	65	IN (0x0001)	false
Sep 28, 2024 00:18:19.061825037 CEST	192.168.2.6	1.1.1.1	0x90aa	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.062177896 CEST	192.168.2.6	1.1.1.1	0xea91	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Sep 28, 2024 00:18:19.066518068 CEST	192.168.2.6	1.1.1.1	0x2cee	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.067034006 CEST	192.168.2.6	1.1.1.1	0xb685	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false
Sep 28, 2024 00:18:19.067727089 CEST	192.168.2.6	1.1.1.1	0x798a	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.068078995 CEST	192.168.2.6	1.1.1.1	0x11ae	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 28, 2024 00:18:21.030427933 CEST	192.168.2.6	1.1.1.1	0x5a9c	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.030427933 CEST	192.168.2.6	1.1.1.1	0x1e44	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 28, 2024 00:18:21.103626013 CEST	192.168.2.6	1.1.1.1	0xd720	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.103931904 CEST	192.168.2.6	1.1.1.1	0x5b04	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false
Sep 28, 2024 00:18:21.146792889 CEST	192.168.2.6	1.1.1.1	0x36ea	Standard query (0)	fgt.ive.mybluehost.me	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.146966934 CEST	192.168.2.6	1.1.1.1	0x681e	Standard query (0)	fgt.ive.mybluehost.me	65	IN (0x0001)	false
Sep 28, 2024 00:18:22.740923882 CEST	192.168.2.6	1.1.1.1	0x7bb	Standard query (0)	web-carte-vitale.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:22.741070032 CEST	192.168.2.6	1.1.1.1	0xe233	Standard query (0)	web-carte-vitale.fr	65	IN (0x0001)	false
Sep 28, 2024 00:18:22.751844883 CEST	192.168.2.6	1.1.1.1	0xd1b5	Standard query (0)	web-carte-vitale.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:27.425718069 CEST	192.168.2.6	1.1.1.1	0xa6e3	Standard query (0)	www.impots.gouv.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:27.425964117 CEST	192.168.2.6	1.1.1.1	0x9d6c	Standard query (0)	www.impots.gouv.fr	65	IN (0x0001)	false
Sep 28, 2024 00:18:43.867590904 CEST	192.168.2.6	1.1.1.1	0xa63	Standard query (0)	www.impots.gouv.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:43.867865086 CEST	192.168.2.6	1.1.1.1	0x81c3	Standard query (0)	www.impots.gouv.fr	65	IN (0x0001)	false
Sep 28, 2024 00:18:44.653418064 CEST	192.168.2.6	1.1.1.1	0x951a	Standard query (0)	bmly.impots.gouv.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:44.653728008 CEST	192.168.2.6	1.1.1.1	0x3151	Standard query (0)	bmly.impots.gouv.fr	65	IN (0x0001)	false
Sep 28, 2024 00:18:46.133399010 CEST	192.168.2.6	1.1.1.1	0xb18d	Standard query (0)	bmly.impots.gouv.fr	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:46.133721113 CEST	192.168.2.6	1.1.1.1	0x7ae2	Standard query (0)	bmly.impots.gouv.fr	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 00:18:14.229872942 CEST	1.1.1.1	192.168.2.6	0x4508	No error (0)	emailmarketing.locaweb.com.br		186.202.135.207	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:15.311546087 CEST	1.1.1.1	192.168.2.6	0xf371	No error (0)	emailmarketing.locaweb.com.br		186.202.135.207	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:16.549216986 CEST	1.1.1.1	192.168.2.6	0x3314	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:16.551924944 CEST	1.1.1.1	192.168.2.6	0x40d1	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 28, 2024 00:18:17.935208082 CEST	1.1.1.1	192.168.2.6	0xd814	No error (0)	fgt.ive.mybluehost.me		50.6.152.208	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.070858955 CEST	1.1.1.1	192.168.2.6	0x90aa	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:19.071253061 CEST	1.1.1.1	192.168.2.6	0xea91	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:19.075834036 CEST	1.1.1.1	192.168.2.6	0x2cee	No error (0)	upload.wikimedia.org		185.15.59.240	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.076808929 CEST	1.1.1.1	192.168.2.6	0x798a	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.076808929 CEST	1.1.1.1	192.168.2.6	0x798a	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.076808929 CEST	1.1.1.1	192.168.2.6	0x798a	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:19.076808929 CEST	1.1.1.1	192.168.2.6	0x798a	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.039684057 CEST	1.1.1.1	192.168.2.6	0x5a9c	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.039684057 CEST	1.1.1.1	192.168.2.6	0x5a9c	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.039684057 CEST	1.1.1.1	192.168.2.6	0x5a9c	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.039684057 CEST	1.1.1.1	192.168.2.6	0x5a9c	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.113048077 CEST	1.1.1.1	192.168.2.6	0xd720	No error (0)	upload.wikimedia.org		185.15.59.240	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:21.159020901 CEST	1.1.1.1	192.168.2.6	0x36ea	No error (0)	fgt.ive.mybluehost.me		50.6.152.208	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:22.749463081 CEST	1.1.1.1	192.168.2.6	0x7bb	Name error (3)	web-carte-vitale.fr	none	none	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:22.749917030 CEST	1.1.1.1	192.168.2.6	0xe233	Name error (3)	web-carte-vitale.fr	none	none	65	IN (0x0001)	false
Sep 28, 2024 00:18:22.761662960 CEST	1.1.1.1	192.168.2.6	0xd1b5	Name error (3)	web-carte-vitale.fr	none	none	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:24.357876062 CEST	1.1.1.1	192.168.2.6	0x2cb2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:24.357876062 CEST	1.1.1.1	192.168.2.6	0x2cb2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:27.435048103 CEST	1.1.1.1	192.168.2.6	0xa6e3	No error (0)	www.impots.gouv.fr	www.impots.gouv.fr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:27.447191000 CEST	1.1.1.1	192.168.2.6	0x9d6c	No error (0)	www.impots.gouv.fr	www.impots.gouv.fr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:27.885904074 CEST	1.1.1.1	192.168.2.6	0x11d3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:27.885904074 CEST	1.1.1.1	192.168.2.6	0x11d3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:41.372572899 CEST	1.1.1.1	192.168.2.6	0x8731	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:41.372572899 CEST	1.1.1.1	192.168.2.6	0x8731	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:43.876799107 CEST	1.1.1.1	192.168.2.6	0xa63	No error (0)	www.impots.gouv.fr	www.impots.gouv.fr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:43.892575026 CEST	1.1.1.1	192.168.2.6	0x81c3	No error (0)	www.impots.gouv.fr	www.impots.gouv.fr.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:44.662627935 CEST	1.1.1.1	192.168.2.6	0x951a	No error (0)	bmly.impots.gouv.fr	mineco.ent.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:44.662627935 CEST	1.1.1.1	192.168.2.6	0x951a	No error (0)	mineco.ent.et-gv.fr	gva.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:44.662627935 CEST	1.1.1.1	192.168.2.6	0x951a	No error (0)	gva.et-gv.fr		91.134.109.31	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:44.696887970 CEST	1.1.1.1	192.168.2.6	0x3151	No error (0)	bmly.impots.gouv.fr	mineco.ent.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:44.696887970 CEST	1.1.1.1	192.168.2.6	0x3151	No error (0)	mineco.ent.et-gv.fr	gva.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:46.174129963 CEST	1.1.1.1	192.168.2.6	0xb18d	No error (0)	bmly.impots.gouv.fr	mineco.ent.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:46.174129963 CEST	1.1.1.1	192.168.2.6	0xb18d	No error (0)	mineco.ent.et-gv.fr	gva.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:46.174129963 CEST	1.1.1.1	192.168.2.6	0xb18d	No error (0)	gva.et-gv.fr		91.134.109.31	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:18:46.176034927 CEST	1.1.1.1	192.168.2.6	0x7ae2	No error (0)	bmly.impots.gouv.fr	mineco.ent.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:18:46.176034927 CEST	1.1.1.1	192.168.2.6	0x7ae2	No error (0)	mineco.ent.et-gv.fr	gva.et-gv.fr		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:19:25.026874065 CEST	1.1.1.1	192.168.2.6	0x1e4b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:19:25.026874065 CEST	1.1.1.1	192.168.2.6	0x1e4b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

emailmarketing.locaweb.com.br

fgt.ive.mybluehost.me

https:

code.jquery.com

upload.wikimedia.org

bmly.impots.gouv.fr

fs.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	186.202.135.207	80	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:18:14.292896986 CEST	486	OUT	GET /accounts/194439/messages/3/clicks/14727/3/ HTTP/1.1 Host: emailmarketing.locaweb.com.br Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 28, 2024 00:18:15.009807110 CEST	426	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 27 Sep 2024 22:18:14 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Sep 28, 2024 00:19:00.015315056 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	186.202.135.207	80	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:18:59.296214104 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 34 48 30 6b 57 72 59 45 45 69 4e 31 51 31 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 39 34 63 64 63 36 64 34 35 31 61 65 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: h4H0kWrYEEiN1Q1A.1Context: eab94cdc6d451ae0
2024-09-27 22:18:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:18:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 34 48 30 6b 57 72 59 45 45 69 4e 31 51 31 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 39 34 63 64 63 36 64 34 35 31 61 65 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: h4H0kWrYEEiN1Q1A.2Context: eab94cdc6d451ae0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPT
2024-09-27 22:18:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 34 48 30 6b 57 72 59 45 45 69 4e 31 51 31 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 39 34 63 64 63 36 64 34 35 31 61 65 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: h4H0kWrYEEiN1Q1A.3Context: eab94cdc6d451ae0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:18:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:18:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 33 68 2b 45 74 77 4d 52 6b 71 32 46 7a 75 54 6f 58 69 33 31 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: u3h+EtwMRkq2FzuToXi31w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49718	186.202.135.207	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:16 UTC	714	OUT	GET /accounts/194439/messages/3/clicks/14727/3/ HTTP/1.1 Host: emailmarketing.locaweb.com.br Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:16 UTC	444	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 27 Sep 2024 22:18:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Location: https://emailmarketing.locaweb.com.br/accounts/194396/messages/9/clicks/[id]/8 Cache-Control: no-cache X-Request-Id: 8db1d6af-29bb-4912-8988-39e2e0eebd34 X-Runtime: 0.037639
2024-09-27 22:18:16 UTC	155	IN	Data Raw: 39 30 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 6d 61 69 6c 6d 61 72 6b 65 74 69 6e 67 2e 6c 6f 63 61 77 65 62 2e 63 6f 6d 2e 62 72 2f 61 63 63 6f 75 6e 74 73 2f 31 39 34 33 39 36 2f 6d 65 73 73 61 67 65 73 2f 39 2f 63 6c 69 63 6b 73 2f 5b 69 64 5d 2f 38 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 90<html><body>You are being <a href="https://emailmarketing.locaweb.com.br/accounts/194396/messages/9/clicks/[id]/8">redirected</a>.</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	186.202.135.207	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:17 UTC	712	OUT	GET /accounts/194396/messages/9/clicks/[id]/8 HTTP/1.1 Host: emailmarketing.locaweb.com.br Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:17 UTC	434	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 27 Sep 2024 22:18:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Location: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/ Cache-Control: no-cache X-Request-Id: b55959e0-cf36-4791-a1a7-da72d2220124 X-Runtime: 0.026983
2024-09-27 22:18:17 UTC	145	IN	Data Raw: 38 36 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 67 74 2e 69 76 65 2e 6d 79 62 6c 75 65 68 6f 73 74 2e 6d 65 2f 77 65 62 73 69 74 65 5f 64 35 33 62 63 35 64 31 2f 77 70 2d 61 64 6d 69 6e 2f 41 6d 65 6c 69 2f 41 6d 65 6c 69 2f 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 86<html><body>You are being <a href="https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/">redirected</a>.</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	50.6.152.208	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:18 UTC	702	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/ HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:18 UTC	339	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Cache-Control: max-age=7200 Expires: Sat, 28 Sep 2024 00:18:18 GMT Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-27 22:18:18 UTC	7853	IN	Data Raw: 34 30 30 30 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 66 72 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 69 74 75 6e 65 73 2d 61 70 70 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 2d 69 64 3d 35 30 35 34 38 38 37 37 30 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 Data Ascii: 4000<html lang="fr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="apple-itunes-app" content="app-id=505488770"><link rel="shortcut icon" href="fav.ico" type="image/x
2024-09-27 22:18:18 UTC	8537	IN	Data Raw: 2d 34 2e 34 35 2c 35 2e 37 35 20 6c 20 32 2e 37 38 2c 33 2e 38 38 20 43 20 32 31 39 2c 34 30 20 32 32 30 2e 39 31 2c 32 34 2e 33 31 20 32 31 32 2c 32 34 2e 32 35 20 5a 22 20 69 64 3d 22 70 61 74 68 33 38 22 20 69 6e 6b 73 63 61 70 65 3a 63 6f 6e 6e 65 63 74 6f 72 2d 63 75 72 76 61 74 75 72 65 3d 22 30 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 23 30 63 34 31 39 61 22 2f 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 6d 20 33 34 36 2e 32 2c 33 39 2e 34 35 20 76 20 32 34 20 63 20 2d 32 2e 30 36 2c 32 2e 38 36 20 2d 33 2e 36 37 2c 34 20 2d 36 2e 33 32 2c 34 20 2d 33 2c 30 20 2d 34 2e 34 31 2c 2d 31 2e 36 34 20 2d 34 2e 34 31 2c 2d 36 2e 38 36 20 56 20 33 39 2e 34 35 20 48 20 33 32 34 2e 39 34 20 56 20 36 32 2e 33 20 Data Ascii: -4.45,5.75 l 2.78,3.88 C 219,40 220.91,24.31 212,24.25 Z" id="path38" inkscape:connector-curvature="0" style="fill:#0c419a"/> <path class="cls-2" d="m 346.2,39.45 v 24 c -2.06,2.86 -3.67,4 -6.32,4 -3,0 -4.41,-1.64 -4.41,-6.86 V 39.45 H 324.94 V 62.3
2024-09-27 22:18:18 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-27 22:18:18 UTC	8192	IN	Data Raw: 33 61 36 36 0d 0a 2e 36 32 2c 31 2e 34 36 20 63 20 2d 33 2e 37 34 2c 2d 30 2e 30 31 20 2d 36 2e 36 36 2c 2d 32 2e 36 32 20 2d 36 2e 36 36 2c 2d 37 2e 30 37 20 7a 20 6d 20 39 2c 2d 31 2e 32 39 20 63 20 30 2c 2d 32 2e 30 38 20 2d 30 2e 39 32 2c 2d 33 2e 33 34 20 2d 32 2e 37 36 2c 2d 33 2e 33 34 20 2d 31 2e 35 37 2c 30 20 2d 32 2e 39 35 2c 31 2e 31 38 20 2d 33 2e 32 33 2c 33 2e 33 34 20 7a 22 20 69 64 3d 22 70 61 74 68 38 32 22 20 69 6e 6b 73 63 61 70 65 3a 63 6f 6e 6e 65 63 74 6f 72 2d 63 75 72 76 61 74 75 72 65 3d 22 30 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 23 30 63 34 31 39 61 22 2f 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 6d 20 34 37 38 2e 35 38 2c 31 35 37 2e 34 34 20 68 20 32 2e 35 39 20 6c 20 30 2e Data Ascii: 3a66.62,1.46 c -3.74,-0.01 -6.66,-2.62 -6.66,-7.07 z m 9,-1.29 c 0,-2.08 -0.92,-3.34 -2.76,-3.34 -1.57,0 -2.95,1.18 -3.23,3.34 z" id="path82" inkscape:connector-curvature="0" style="fill:#0c419a"/> <path class="cls-2" d="m 478.58,157.44 h 2.59 l 0.
2024-09-27 22:18:18 UTC	6764	IN	Data Raw: 0d 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 22 20 64 3d 22 6d 20 31 36 38 2e 34 31 2c 37 33 2e 37 37 20 63 20 2d 31 2e 33 31 2c 2d 37 20 2d 37 2e 38 35 2c 2d 31 31 2e 33 35 20 2d 31 31 2e 32 32 2c 2d 31 32 2e 37 38 20 61 20 32 34 2e 30 38 2c 32 34 2e 30 38 20 30 20 30 20 30 20 2d 33 2e 36 39 2c 2d 31 2e 32 38 20 6c 20 2d 31 2e 31 32 2c 2d 30 2e 33 37 20 76 20 30 20 63 20 30 2e 32 34 2c 2d 31 2e 35 32 20 32 2c 2d 31 2e 36 34 20 33 2e 30 36 2c 2d 33 2e 38 31 20 33 2c 2d 36 2e 31 36 20 2d 33 2e 31 36 2c 2d 31 30 2e 35 20 2d 37 2e 37 32 2c 2d 39 2e 35 20 2d 32 2e 31 35 2c 30 2e 34 38 20 2d 33 2e 36 35 2c 31 2e 32 35 20 2d 34 2c 32 2e 38 39 20 2d 30 2e 31 38 2c 30 2e 38 39 20 2d 30 2e 38 37 2c 30 2e 39 32 20 2d 32 2c 32 2e 31 20 2d Data Ascii: <path class="cls-3" d="m 168.41,73.77 c -1.31,-7 -7.85,-11.35 -11.22,-12.78 a 24.08,24.08 0 0 0 -3.69,-1.28 l -1.12,-0.37 v 0 c 0.24,-1.52 2,-1.64 3.06,-3.81 3,-6.16 -3.16,-10.5 -7.72,-9.5 -2.15,0.48 -3.65,1.25 -4,2.89 -0.18,0.89 -0.87,0.92 -2,2.1 -
2024-09-27 22:18:18 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-27 22:18:18 UTC	8192	IN	Data Raw: 33 66 30 35 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 6c 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 20 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 74 6f 50 6f 72 74 61 69 6c 50 75 62 22 20 74 69 74 6c 65 3d 22 52 65 74 6f 75 72 20 61 75 20 70 6f 72 74 61 69 6c 22 3e 41 73 73 75 72 61 6e 63 65 20 4d 61 6c 61 64 69 65 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 61 Data Ascii: 3f05</div> </div> <div class="container"> <div class="row"> <ol class="breadcrumb "> <li><a href="#" id="toPortailPub" title="Retour au portail">Assurance Maladie</a></li> <li class="a
2024-09-27 22:18:18 UTC	7947	IN	Data Raw: 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 39 34 35 22 3e 31 39 34 35 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 39 34 34 22 3e 31 39 34 34 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 39 34 33 22 3e 31 39 34 33 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 39 34 32 22 3e 31 39 34 32 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 39 34 31 22 3e 31 39 34 31 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d Data Ascii: <option value="1945">1945</option><option value="1944">1944</option><option value="1943">1943</option><option value="1942">1942</option><option value="1941">1941</option><option value=
2024-09-27 22:18:18 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-09-27 22:18:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
2024-09-27 22:18:19 UTC	640	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/style_v2.css HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:19 UTC	8192	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:19 GMT Server: Apache Last-Modified: Mon, 23 Sep 2024 13:21:08 GMT Accept-Ranges: bytes Cache-Control: max-age=86400 Expires: Sat, 28 Sep 2024 22:18:19 GMT Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Transfer-Encoding: chunked Content-Type: text/css 1faa k8?0%Tt~&gj{flzC5Si@D0C}.)z!~?ysD{mv>ZD?f.IxN3dAo5Y;I)^0H_Kt^U}1)S?~H9s4/Wvi'c%O=:v&8&1=v9Ry 431Tz3XvexqY j$JUS>uUH!^)Rdg a)EOELo_)p?xfuAe6b~#)H>5QP6B_\|j00u^H^9~HfE^$`>)1hD2Mp\|)eO)p!CHZ+$mU{?&JPd6MqJLM{ABL>LM%HkTK!cff)="q_r\|eA[/gs1/f&I`w`}gfJ Lw2~rnV9syaW;3Y6.seR~7q/P<MPOPc#6MV6:nrUu:k+lWb4$ciLsy~9@qv&%"vY\|FsYR~69%Y){;C>T=F3kaYdf X=PyO8C\c 5 (43S0Qj?NTMBRij$u[A=(?}1u/B)Lgj92SZ"R.2"U>Wi"ot yi~I)UYBf)e<WQ(iKyR0y\b0vH0IPlJ0u&!y6Dc&BnS=;3A><,bo{Qjo\|%/xn&Tjn$I8%@a701rluy[yjDjwiQ!irs6Q)zSIPHfk{[1G`;@a;nO(.$N_@_FBgKJfSC1qk?"OiW%92W^\k32$b1=)(1<X e(d1Q\|%lc>xXL'$arWJ]VJ+6fD FL?m$Oc/5YoC(z!h=.&0j6II\BeSb1Di-W7+p_:R7mID7V<F@G^(`eO"^8.:4e~5_Ayb,$E6u)sM[Fma7S`K6Pa0{}&^b$Uc>m$A7XrQOO8fA,(Ea-MMC2>-mJh0~4M%fB151o)gOQ>IDSJX~niR2R?o6?HnM)5Hf`Y g(b0Vt7zVGk?5>M1?h9@&/TsQ~DK>[oeTBj>:\dDnyG?Wps&Q._}LW 3k\|4HYeB yo[f.TNQlA)y+zmXFnEP^bP.!<6%:eEQA`(I# LrlgFFKqAC!SzHK~g(%plO@VSb;t()YB_K->aNZKj6Fx:568NgN[9/ompz"tvld`~a}DWNRlSeDP'D&+"Ar"!&lg.CyI)"09 ,r@96\^8-y:6`ZiSk7pfg&F>F8seoH6b$IK )^6BbNSdhDIp~$sT:wJmY3SH]m4$tm4bFRi:6(Q6\|&a'Ev}WM)J@;6It);0G+SfBHL"G+HrHne %$Sm;yK}.ah#W@rs4N{6hK#IE)nN,I;g;W$cN{6$6JPT]S",J+N``jmJL(86Qw(mD!}Um<5Um@5R86!am@IuOkI"_OKJZNVhEl Esnav (ulIt+\{/EaBr$#,[vAs<[T0N0/\0EQet6X 1pl$9H)R4+Q9B ArAik6$(z+L>\|5 [W9NtQuOh2'5hm6t^ZxkUA#}IIS-6j6j;:I/l$J!5^gk_XFy$sg"%SfCK#U)SfC)v6RH{U<Hb@1>B:6(aNstuocFmR>6.vJ>"G1>-`>pA:6F6 %$.5(gXaaI389,J 2i>'stzGyg";U6fthcfqJmPIHN$N.{>0uFsEvAD=;6PZ7'-XBG<vjm5N6xh?AnZO6DL BFI)WQm%rl9gm(Q'gG_Vv4B0pM~cMQdrF9=i?tm4O<(m$\J/\|vmIibV1P^VV_;6@y)V6F00tmb%/]\|n&km` N.+m\|Pxju mdT`9E6R=BvloC"V0v8.nf1Q9w^,],wn7)/:R<IwI(sH9Q(y)3rcy\ J`$^SjF%D).+l:\|;\c @63^Y#6] W'$SNc3]J_#;l-gv%$_M2 / 5IVJ?GE\S~9F){EID>?YFR\+W+IUL8N[6jiL9[ %)akgZ!16C! V^@jaCoTE,wbPK.?XYk.<v{Pv6"_)8u6U)@D^;6 `6jum\|R/aU+KQ=OgW_esAVOOmR3Y;C?{KU&D^A;Fhu9+2d~h ?0_So,2\|O90s~{>d={QI^2l\<&JmK93PHW$ fJ=r^3nN(~"R#1$\"M8<tE\|><)qR%cj/uzNH4U`6+%Y)\ 3@]YGQLJA0KP3E^r(A9KLyu^!k_cTVt\k\|0)U=dE]@3"^FoDinTv)[u[6Z"cNs`D0w&_z?DBdBa]1K"AoGsy1tcGz9yoHlKmnUXzxKc`sBPB^adf?IPL!B&/`)4IUp\|i5ZfpSM\{7_YRn0~h?}XW7u\|S'lM]3 &7I:tpW6VC%!=U JQowjlE6A)LN\|qibVF=NC67 67,K_s6~tb"m:#l.rtd"_!wC}1C[AY"lKxoYnYvK^eM5Yb\|Z OnuqzX3%}7o`iq!Xhubuz{[ZUf9dO82Iz]@EfE)R? J2cl>J:0JMi&2Jk4I_mmhEKN4JX)1riFROf[HXzVNQu H!VF(/ f)OJ5yy]IjKNwlSgkm\|oQGR>ks:nWM{oF8jtAM3wW:m=[;pF,9M}6~9Q_egKi(y$/Vq0q4-#e4y8Ix7`H#4l?A{YkRS 'Y$ia7=Gp6Az$>&hSp0C>ualc5/"Q\[H[amGb.M^`-fLi)k."/51zw~A$%J%SI!:1g0A%x&?{F^c'[C],om-oocma 94~{>ORibNq'c yt<N$_MyD['>^2^xZI( 9Kp>$3biq`lR"Q)rW%5D}1<\ldUxjkPh _oizFI)7@E;b%?W0qG3+,knhJ4J!@&HA[o%i5n5}#.g<h6]1<{SbvEJIN(~EJ`+_9. DiSue1Q3{)aPk)hiu%gE1[e@kd3X~6_??wj\r#JJ}Ym0y4kE;3Y-^piB$[]VRJ[6v8u&YjFOr$3k=y+J!MCf=N~O8ncP!~uFPb3gc7$f7^W%0f!23z1xCi{C9dcM]KREUv ~/?mNwU0Da x~h<}C_[DmKu~b3LX=3(A(<y~9V5AO8%mb[#JDUkPoF0WQlM5(+#$z<(1vZ"fr%0m3hTT"9(C)Quu2}A#\| 57h@[]+/L:N~fOU[YgzCP^Xq{om[0o?AF_ Pn}.3nMvoAnA~AaAqAiAyA q8`@qR,jFG]ytmhYIH4;[";q!"O;<$#G>u#3it>B6AnNrsnkLs'4<8&b4ua_^x?I-ng&;jwnI $q:4wPv?4 u~MPi1RYQH(q?;2tB&<rdOt'@&8I;qg91q1Y0Yi@)U`VVhjtfd9xkuGn5A`[u[3/ULmo`\yt:C'a8~\|?O?Na:a\I)Gfj/l%qMXT^Et:sqeEt8Lu:Xrkf-W;hk^f()%Ik_$HV!kEJZ-}(pg`Zy(WG"XEV-Uk\XI)wi/(T>BRsW`b\|!6yi.a#<Z.;6\xF560]ZXd
2024-09-27 22:18:19 UTC	641	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/css/bootstrap.css HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:20 UTC	6376	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:20 GMT Server: Apache Last-Modified: Mon, 23 Sep 2024 13:21:08 GMT Accept-Ranges: bytes Cache-Control: max-age=86400 Expires: Sat, 28 Sep 2024 22:18:20 GMT Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Content-Length: 6004 Content-Type: text/css 8$Ad#6{,B%eH6Rd:9iU<g7s>ck?ZvC}gWp;>Me;??s_Yl?}vlK}8tqb>-rZmjfj_~m;.[ ,RrK-+(:8p?]rnYtK-[VQ51tup~@n)tK-[kch5.e6.qr7.}v82odykvixV.=;>M#/s95-l\l=5s~fzv;CJz=s1<exkN$m/N\,!fr\P"b/861NOL%\h~E>_-;#2d@"}ywT$9PAG)%j\+\\E-R\U8J#X4+VV c8J%q $[Ufn>YV'wqi&\|wh/\|y8ZP.)uKT-)U+J\|BRk_QWT]QWWxZ m0px9dEk\pSNvZ;q}"J.%]$Yh UfPz0 Uijj.>sPsrn]?azoe\|<o?A>/C6mVn%gs{.gc\|Fx %QA2)S&F]^\bTX8W82Aa0U2jG)0+aw[_.=WWKGu3j{6 +~SBW"1D`Q7`JY&`F(,0IT&=HFQ7`VSix5FVP&GhQ72 Z44PNAY&+o~84iabN~rv7+N91:+rMreDGL+Lxh)ADC!gR&ehRR&6LmBEhD&21MeR&UhRaKDEethScK%(m;6b\9?57+0;q}JN(TR.iMIhxxRIHKhJx3NQy1TT_g+x=2f1oO_m9cqkk=v#:a?vSJ/9+,y;++s{.gc\|Fx %QAqj!G8"L!M@L p< <$&T\|Z$nn~z W^1^-(I'VM]K^&E))fcDu` (&SYD bT&`FYQLQiTYAT&E(h#B9eH@!q9u>0DV:DtDNo6ERP&2A`3LmIIIIHD&2Q Meih&&41IETIE-YeM6-[.Lxs=>`yG9djGRAH5%I%!-BZ)B":1SF<SSY97;LOVQa}Of/C6TgVn%=hOs1>@HQ<(I8#R&&F]^\bTX8rdad>N-FS7aV[L=]z+ f$+l@LW%e/DbHnd1"MSQLY`0XIEQ,"M{FC1UH0n(F4jMHneJihMW Pphv8anV"Srb"tW"'7"t)(gB WS&6BML$m"CI(D&2M4ebhM",2R-KEeQtvls~jiEopW0Bav#P2Si \I!L!UgZR)bQ^,CWgV%Eq?l~o)O>?y{j24m3!u]_aV\|q_a\S=hOs1>@HQ<(I8#RF&F]^\bTX8%rdad>N-FS7aV[L=]z+ f$+l@LW%e/DbHnd1"MSQLY`0XIEQ,"M{FC1UH0n(F4jMHneJihMW Pphv8anV"Srb"tW"'7"t)(gB WS&6BML$m"CI(D&2M4ebhM",2R-KEeQtvls~jiEopW0Bav#P2Si \I!L!UgZR)bQMqX#>[^Xm=)r&/3=ea(byI?goSXS=mFC\|[1d,B[-o~m9J_~m;.[ ,RrK-+(ngUp~<n)tK-[kcVNp-[ni9v<[]fEkv]flvI]fDnvx-{K?vS?9Ss)vixw}iuyi]77=5s~fWkk=vVqm=V8s[rs}>Rz)WSbb'O4p pKIZF486E^xsf^L=FX:SAYfn4U&o{G#\|,NKb/1s8{(2Q'`0{EAyPx^GyqtV`V !a@0WT"21VDZ}SM/(,pUEEak8@#pB2H\#Fk@qh1PcMk;%$( T0i`Dc3m;{OM;.Lh@vsm+mBPGQGPnYD4Av+r [S_9[9tulvVM\|sfezFWs~zYz-yl(?gSYU7kN$/1{IZbdI#Y [1vwd\'@;[O~zt"(Bm1d@0HV'%nzG-zIZ<I%'MyZHINT$HT4(%JcbjHE-0H1:SQDQ@R^)t}Xja8D_]`nb9&8xiKJ\KJ,}+_0kLl(W2b,CF,3FIc^vl~s=>+kvC50Sq@E\KtsITT[2HU"MwncWoCWgvkwqn&o)?^m9crezFWs~0-yl?gSYU7kN$/1{I]!Q ,i$1K]&qql\Jby7~a@q5:l+$C A"b6=fl5-q ;jDH'TNEp5-8iSDNRt DDi,QK+pWCGjID1UZU%28bPX0N{~mFTL!M^GpghLvs_1K\RXRb%&VXb5%XcbC/6/cA2:ea12h,Hc3-=Ye^Z]HK%P,AE= ib^so&f}:{_dwV2t{fa]_]v;CJz g}OesW8%.hw.D-X( \,W.)wpGqqr\qwa/SNT0_MCA#IT2rPQGR8I1S:OQ"28IZpFDi,Q]&)pTEgjT8H@7~84bv8rSM;0;6yL]1q4M}1/sIK_\bbI/XQb&Xb%6`WBCBFcx1Cs iZcvg{N\wvjy4.K\|w"y.J<BEwk\|wz^Ty1Mz`ssn\|n.o)OQx/C6lAkk=v9Q?vSngpq_]\m=hc#9"G_p K]^Z%T@dI#Y \R2cTkyd=_-9a[a'2a4ciQ G8d =p,boItD$epI%U$$JcXX:RQ0L"RT)q+T"Wophq k{l5v`wXmW8;;@chb%^}K_,1+L)Jl\|%\|q2)cAcAi1\9?5 t/C>PG5Lh\$P-D\,y.d*RyUHb~U4/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 22:18:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=239203 Date: Fri, 27 Sep 2024 22:18:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49725	50.6.152.208	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:20 UTC	686	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:20 UTC	366	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Mon, 23 Sep 2024 13:21:18 GMT Accept-Ranges: bytes Content-Length: 199039 Cache-Control: max-age=86400 Expires: Sat, 28 Sep 2024 22:18:20 GMT host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Content-Type: image/png
2024-09-27 22:18:20 UTC	7826	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 24 00 00 02 5c 08 06 00 00 00 08 0c 60 1c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 12 74 00 00 12 74 01 de 66 1f 78 00 00 ff a5 49 44 41 54 78 5e ec 9d 05 c0 55 55 d6 fe bf 99 ef fb fe 5f cd 8c 3a a3 8e dd dd 9d e3 a8 a3 82 58 20 25 dd 20 9d 22 06 62 77 77 77 17 b6 d8 8a 74 77 77 23 48 77 bd eb bf 7e 6b 9f 7d ef 79 2f f7 0d 10 07 46 d6 a3 8b 53 bb cf 3e ef 7d 9e 9d ff b6 78 d5 5a 71 73 73 73 73 fb d7 b3 25 1c 57 af 53 5b 93 dc 5b 27 8b 56 af 97 45 ab d6 c8 b0 39 0b e5 ea 2f 87 cb 9e f7 7d 26 bf bb e9 5d f9 b7 1b df 97 7f eb f2 be fc ae 4b 57 35 3d bf f1 3d 33 ce b9 67 cf 93 7b ff 5c 23 de 0f 42 ba 38 bf a9 ab fc fe 96 0f 65 Data Ascii: PNGIHDR$\`sRGBgAMAapHYsttfxIDATx^UU_:X % "bwwwtww#Hw~k}y/FS>}xZqssss%WS[['VE9/}&]KW5==3g{\#B8e
2024-09-27 22:18:20 UTC	8000	IN	Data Raw: 10 84 00 a2 1c 87 68 e4 03 3d 28 69 bf b9 82 24 02 32 45 eb 2f 69 c3 10 4a f9 ce 31 48 37 84 31 8e 0d a7 3c 29 f3 74 3c 10 58 86 49 95 06 ac 1e 46 2b 7a 24 4d 10 48 86 13 c5 32 c2 18 2f 4f da d3 71 d0 82 5b 1a 90 66 48 59 da 2f 3d 35 cc fd 89 80 54 31 69 3d ed 06 61 48 cf 0f d8 5c 41 12 7b 48 a2 20 a1 75 3e 4d a8 31 5a 77 29 83 98 57 de 6d 6e 7a c9 7f 7a e8 4b 71 c8 15 24 cc 97 c8 15 24 00 72 49 19 50 d7 a9 67 0c 25 a3 ac 20 dd 90 c6 28 48 30 08 1f 69 8b 73 3d d2 48 87 89 1b 04 74 14 97 18 3d 51 88 8a 92 86 2d a5 09 1e df 0e e2 88 b9 04 cc 07 89 75 8f 55 90 72 ff 1e 20 40 e2 62 13 f8 87 ac c6 a1 4c a4 83 55 ab 48 57 2e d2 e9 ce 27 48 72 97 fd 85 7c d3 0b 41 5d 8d ee 98 6f c4 f7 c4 e4 71 e2 40 90 90 9e f8 1c 23 ff 45 ed 25 92 0f d4 15 ea 49 5a 94 d2 23 40 Data Ascii: h=(i$2E/iJ1H71<)t<XIF+z$MH2/Oq[fHY/=5T1i=aH\A{H u>M1Zw)WmnzzKq$$rIPg% (H0is=Ht=Q-uUr @bLUHW.'Hr\|A]oq@#E%IZ#@
2024-09-27 22:18:20 UTC	8000	IN	Data Raw: 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 Data Ascii: 8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5
2024-09-27 22:18:20 UTC	8000	IN	Data Raw: 0b c3 ea 99 bd 39 bc b6 3c 3d b4 9e 3e 6f 6a ee 33 e5 95 c4 69 22 2c 73 8f a3 9a bd 8f 6c 7c 58 24 f0 f1 3a 9c 63 e9 f0 62 98 d9 e7 31 9c f0 ce 08 3b 94 61 7c be e5 2c a4 3b a6 87 78 79 ef 94 15 62 f9 e6 61 8f cb 73 13 df b7 49 e0 6f ea b7 f0 c9 cc ef e4 8b d9 3d e4 9b d9 bd 6d c1 84 7e 3f 0f 97 fe 3f 8f b4 1e c0 09 4a ac 27 aa cd 5a 3e c7 26 6a ff bc 66 89 2c 5e bb 5c d6 16 ac b3 af 30 f9 3a 37 46 fa 03 d5 e3 ea 25 4b 64 e6 e8 d1 32 f8 f3 cf e4 9b 67 9e 90 d7 3a 5d 2d 4f d5 ab 2f f7 5c 7a a9 5c 7f c6 69 d2 e6 90 03 a5 e1 8e 3b 48 fd 1d ff 24 f5 d4 ea ff 65 27 69 77 f8 a1 d2 f5 8e 3b 64 ea f0 61 b2 7a e5 8a 4c 58 45 c4 a8 c8 49 4d a2 5e 3e 9a fe 8d 34 ed 7b 63 a6 3c 36 2a 2b 33 ad d7 df b6 96 73 1e a8 2c fb 95 39 5c 0e a9 7c bc 1c 5c f1 78 5b ee f7 90 aa Data Ascii: 9<=>oj3i",sl\|X$:cb1;a\|,;xybasIo=m~??J'Z>&jf,^\0:7F%Kd2g:]-O/\z\i;H$e'iw;dazLXEIM^>4{c<6*+3s,9\\|\x[
2024-09-27 22:18:20 UTC	8000	IN	Data Raw: 2e ff 49 46 cf bc 57 a6 4f b9 2c 21 b5 17 c8 32 25 75 ef 8e aa 25 6d fa b6 34 22 90 3b a1 3d 4d 30 4a b4 a4 b5 93 d5 ab be 18 5d 4d 56 68 d8 41 88 84 16 76 ce 43 4f 09 44 f2 02 99 0f 19 55 c2 ca 30 a4 30 1f a3 70 78 46 1e 35 cc b0 a4 6b e8 11 49 13 67 c8 4b db be 2d a4 f7 b8 ca b6 cc 6e 10 04 08 81 40 9a 6d 98 91 c6 c3 b2 bf ef 68 3c f8 09 e2 46 c3 b1 7c 32 54 29 1b 5f 88 2b b8 a1 2c 20 e5 a4 ad 3e 84 9b bc 25 ee ea a9 50 e8 a0 42 e1 ee 41 8d e4 ae 41 0d e4 c3 51 35 6c f9 e0 48 d8 6d 38 92 c5 1d 44 11 bd 03 b3 a6 5e 2c d3 92 a5 87 59 89 8b d5 ab 10 2e 8f 0f a9 9f 99 dc cf 04 f6 38 8f 03 31 72 73 ff a6 f2 cd d8 6a f2 f3 d4 72 36 cc 2d 92 79 7b 77 7a 4d 7c 69 b3 78 79 66 d7 7a 8e 70 30 f1 10 c4 d1 3a 4b 13 3d 0d e7 cb 20 c4 e0 c0 c6 1a 2f 04 3e 29 e7 24 7f Data Ascii: .IFWO,!2%u%m4";=M0J]MVhAvCODU00pxF5kIgK-n@mh<F\|2T)_+, >%PBAAQ5lHm8D^,Y.81rsjr6-y{wzM\|ixyfzp0:K= />)$
2024-09-27 22:18:20 UTC	8000	IN	Data Raw: 6f bd 54 8e 6d 7e b6 1c 55 ef 54 39 bd f3 85 72 e1 8b b5 a4 52 37 fd a6 7e 68 2f 95 4d 78 14 f6 1b be 8b 70 ff c1 31 2f cb f2 f5 ec 22 9f 9d 45 62 e9 49 fe d6 c5 b4 39 1c 8e ed 1b 2e 48 1c 8e 6d 08 f9 7f 98 f5 ae fe 78 cf 5f b5 50 c6 fe f4 46 46 90 98 38 80 e0 a9 ad 56 82 b7 56 49 6d 20 9b 61 79 55 26 4a 33 99 b8 76 4f 26 3e 43 38 20 1e 90 69 48 43 24 20 81 f4 c5 96 f5 d8 ab 51 95 25 3d f5 59 d8 fd 3d b4 9a d3 e2 df 77 42 65 59 3a 2d b4 f2 47 0b 64 57 d3 a1 44 95 09 ee 93 26 5f 22 f7 0f 6e 90 ec 4b 12 89 4a 07 db e3 82 5d d2 a7 d8 04 72 4d 27 ee c9 83 11 7f f2 11 26 e5 bf a6 44 bc 91 0d d7 8a 04 34 84 11 49 6e bc 66 45 28 26 86 0f 9b a0 82 84 f0 e8 69 a0 2c 08 d3 ca 83 8d 1b 2f 96 1f 95 58 37 85 e8 16 0a 47 4d 09 2f e7 90 7a f6 17 c1 1f 8b 04 40 c0 09 c7 Data Ascii: oTm~UT9rR7~h/Mxp1/"EbI9.Hmx_PFF8VVIm ayU&J3vO&>C8 iHC$ Q%=Y=wBeY:-GdWD&_"nKJ]rM'&D4InfE(&i,/X7GM/z@
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: fe a7 ec 72 dc de b2 d3 a1 bb c9 7e 65 8f 90 b3 ee 2c 9f c9 67 10 24 a1 bc 4a 6b 35 7b 76 94 ab 95 2c 8f 5d 1a 37 14 e4 2b 0b df 20 c8 7e 7b 09 a6 0f 12 e9 f3 bc 0a 8c 5b 6c 82 7a 5a 90 98 60 b0 5e 93 78 1d ad 8b 6c f8 ac 8b cc 79 fd 2a 9b 3f 52 90 88 11 04 4c 56 68 04 b7 e1 5e 14 1d 59 ff 85 05 09 f7 12 3f df de 2b 05 63 be 94 02 9b 9f 91 4d 37 c8 a4 39 17 ea ee cd c9 9f 4b eb fe 77 68 19 84 46 00 5b 24 40 df 67 2c 97 8c a8 d3 ef fc f4 9b 2e 96 83 2b 1f 27 c7 ea 3b 3b ef c9 ea 52 ee d5 06 72 e1 8b b5 e5 f8 16 67 c9 ae c7 ee 25 65 54 b0 54 fa ba 95 ba d5 b2 4f 44 0c e1 86 7a 1a de 4d bb 81 77 e9 df ae 85 b2 7e 43 4c 23 a9 d3 73 2b dc ec df 38 87 c3 b1 fd c2 05 89 c3 b1 4d 41 7f 96 33 63 aa 39 6e d0 ff 92 1f 6c bd bf 6c cd 32 99 bc a0 b7 0c 1b 5f 49 96 4c Data Ascii: r~e,g$Jk5{v,]7+ ~{[lzZ`^xly*?RLVh^Y?+cM79KwhF[$@g,.+';;Rrg%eTTODzMw~CL#s+8MA3c9nll2_IL
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: ec d1 12 b8 7d 42 77 46 97 a9 5a bc 5b b9 80 0c 5e da b7 88 0f f0 f8 75 76 00 0c a7 3d 7a a8 2c c6 6c ab 29 82 04 0b c7 f6 4b a9 08 2a ac 69 90 30 3e 12 80 30 02 b2 08 1c 2c 78 70 1a 9e fe 21 42 88 7e 5d f5 c6 67 a3 65 12 be 35 be af 10 d4 64 51 03 b4 5d 50 8d 40 46 65 7c 3a b7 02 be 9d 55 04 df ce 2e 80 5f 66 e6 c0 88 29 e9 30 74 7c 1a 14 29 f7 1a da b5 7e 09 a3 07 bc 88 25 13 5e c0 8a 89 cf 63 f9 84 e7 b1 62 7c 3c ac 89 78 0e eb c7 3f 83 75 e3 ff 83 0d cc 11 ff c6 fa 88 ff c3 9a f1 cf 62 d1 a4 17 d0 7f 66 56 b4 5a a8 86 b7 2a e4 2b 38 b2 c0 4a ae 8d af 85 40 4b 85 19 ad 50 76 62 53 99 36 55 71 4e 73 84 2c 6a 27 d3 b9 78 b9 db 90 05 ad 11 b2 b0 8d c4 e5 65 6d b5 5d 14 d0 58 ad 86 2c 77 cb 2c 6d 63 e3 90 df 70 95 65 bc 81 22 0b 6a 5c 36 03 1b a7 2e b6 3e Data Ascii: }BwFZ[^uv=z,l)Ki0>0,xp!B~]ge5dQ]P@Fe\|:U._f)0t\|)~%^cb\|<x?ubfVZ+8J@KPvbS6UqNs,j'xem]X,w,mcpe"j\6.>
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 7a da 27 86 bb e0 ce 74 35 68 d7 b8 36 3e b3 ef 74 2d 01 3a ec b6 86 ed 02 7c 8c 26 c6 2e 17 3c ef 1b 44 2f e9 8b 63 2b 46 a1 fb 92 d5 98 bc e7 10 0e 5c ba 82 db 77 48 a0 94 ba f3 db 4b 9d 9b 2f ec 42 a7 f5 df a2 ba d1 64 49 9b c8 d1 80 40 0a 57 c0 de 1e 65 27 36 45 8a 72 e9 91 b1 c5 7b c8 df a3 02 8a 0d ac 89 12 e1 75 50 7c 50 2d bc 91 27 19 32 b7 2b 2c b6 26 aa 15 e1 b1 c4 e9 35 4f 71 53 5b 73 39 b3 4f 2c f3 96 af 75 71 b7 b6 9f fe 5a a4 b2 8e de 1f e7 ae f1 81 a7 98 2f dd 7c 02 5d 43 d7 a0 40 d3 49 78 b5 78 38 e2 f3 4a 59 05 43 f1 72 71 fe 10 3b 0e ed 7f 58 8e 88 05 fb b0 65 df 39 92 2b 22 11 1d 6d 73 72 f2 b1 4e af db 1b a6 0e 5b fe 95 6b 51 62 bc fe 69 d8 5a 54 ec 34 0b 99 6a 8d c5 6b a5 74 4a 18 6b 34 72 d4 8b c0 c7 fd 57 63 ed 0e 5d 29 cf a7 0c 2f Data Ascii: z't5h6>t-:\|&.<D/c+F\wHK/BdI@We'6Er{uP\|P-'2+,&5OqS[s9O,uqZ/\|]C@Ixx8JYCrq;Xe9+"msrN[kQbiZT4jktJk4rWc])/
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 30 6b 5d d6 0c 25 40 53 d9 83 77 92 7a 30 f4 b3 a7 10 fe 19 6f b8 48 40 a5 b7 07 d3 fb 04 60 ee 2f 01 02 38 96 0d f4 60 ed 30 ad 8b 77 6a 98 0b 38 6d 88 f8 17 3e 9e 57 11 b5 97 b4 14 81 cb 0a 61 8e 9d 86 15 d0 9c 73 02 0c e8 68 41 80 9d 26 65 81 89 fd 2a 2c 06 bd c4 2c bc 71 7c 2b d8 49 dc c5 ed 50 66 42 13 54 9a db 8a fc 5a 1e 1b be b3 30 2c f9 12 eb 34 19 2a c7 00 12 9d 3a d3 0e c1 b3 9a 23 69 89 74 22 bc 73 58 c5 79 6d 50 6a 5c 23 94 9d d2 14 21 0b cc be 0f b6 1c 02 46 21 c4 45 7e a9 8a 0c 4d f2 23 23 81 92 a2 fd 6b 22 49 d1 b4 78 b7 5e 5e 14 25 60 91 be 71 6e 24 0d 4a 83 b4 35 73 a0 68 df 2a 28 33 b6 01 b2 b4 2e 88 1c 1f 16 c3 2b e9 13 e1 dd 3a b9 11 3c b3 25 85 d7 c7 b3 09 5f 44 9e af 4a a3 c2 cc e6 28 f0 6d 45 d9 99 9b 77 eb 2e 3f bd 39 b2 b4 2f 22 Data Ascii: 0k]%@Swz0oH@`/8`0wj8m>WashA&e,,q\|+IPfBTZ0,4:#it"sXymPj\#!F!E~M##k"Ix^^%`qn$J5sh*(3.+:<%_DJ(mEw.?9/"
2024-09-27 22:18:22 UTC	670	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/fav.ico HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fgt.ive.mybluehost.me/website_d53bc5d1/wp-admin/Ameli/Ameli/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:22 UTC	460	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 22:18:22 GMT Server: Apache Content-Length: 315 Content-Type: text/html; charset=iso-8859-1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49729	151.101.130.137	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:20 UTC	575	OUT	GET /jquery-3.4.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://fgt.ive.mybluehost.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://fgt.ive.mybluehost.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:20 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 88145 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15851" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2724639 Date: Fri, 27 Sep 2024 22:18:20 GMT X-Served-By: cache-lga21965-LGA, cache-ewr-kewr1740045-EWR X-Cache: HIT, HIT X-Cache-Hits: 1554, 0 X-Timer: S1727475501.790867,VS0,VE1 Vary: Accept-Encoding
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6b 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6b 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 6b 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 65 2c 74 2c 65 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 Data Ascii: th]:this[e]},pushStack:function(e){var t=k.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return k.each(this,e)},map:function(n){return this.pushStack(k.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f 6e 63 65 7d 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 30 3b 69 66 28 64 28 65 29 29 7b 66 6f 72 28 6e 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 65 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 7d 2c 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 22 22 3a 28 65 2b 22 22 29 2e 72 65 70 6c 61 63 65 28 70 2c 22 22 29 7d 2c 6d 61 6b 65 41 72 72 61 79 Data Ascii: ion(e,t){b(e,{nonce:t&&t.nonce})},each:function(e,t){var n,r=0;if(d(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(p,"")},makeArray
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 2c 49 3d 22 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5c 5c 77 2d 5d 7c 5b 5e 5c 30 2d 5c 5c 78 61 30 5d 29 2b 22 2c 57 3d 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 22 2b 49 2b 22 29 28 3f 3a 22 2b 4d 2b 22 2a 28 5b 2a 5e 24 7c 21 7e 5d 3f 3d 29 22 2b 4d 2b 22 2a 28 3f 3a 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 7c 28 22 2b 49 2b 22 29 29 7c 29 22 2b 4d 2b 22 2a 5c 5c Data Ascii: trols\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t\\r\\n\\f]",I="(?:\\\\.\|[\\w-]\|[^\0-\\xa0])+",W="\\["+M+"("+I+")(?:"+M+"([^$\|!~]?=)"+M+"(?:'((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\"\|("+I+"))\|)"+M+"*\\
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c 78 37 66 2d 5c 75 46 46 46 46 5c 77 2d 5d 2f 67 2c 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 22 5c 30 22 3d 3d 3d 65 3f 22 5c 75 66 66 66 64 22 3a 65 2e 73 6c 69 63 65 28 30 2c 2d 31 29 2b 22 5c 5c 22 2b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 65 2e 6c 65 6e 67 74 68 2d 31 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2b 22 20 22 3a 22 5c 5c 22 2b 65 7d 2c 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 54 28 29 7d 2c 61 65 3d 62 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 26 26 22 66 69 65 6c 64 73 65 74 22 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 Data Ascii: },re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 65 29 7b 41 28 74 2c 21 30 29 7d 66 69 6e 61 6c 6c 79 7b 73 3d 3d 3d 6b 26 26 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7d 7d 7d 72 65 74 75 72 6e 20 67 28 74 2e 72 65 70 6c 61 63 65 28 42 2c 22 24 31 22 29 2c 65 2c 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 75 65 28 29 7b 76 61 72 20 72 3d 5b 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 72 2e 70 75 73 68 28 74 2b 22 20 22 29 3e 62 2e 63 61 63 68 65 4c 65 6e 67 74 68 26 26 64 65 6c 65 74 65 20 65 5b 72 2e 73 68 69 66 74 28 29 5d 2c 65 5b 74 2b 22 20 22 5d 3d 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 65 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 6b 5d 3d Data Ascii: uerySelectorAll(c)),n}catch(e){A(t,!0)}finally{s===k&&e.removeAttribute("id")}}}return g(t.replace(B,"$1"),e,n,r)}function ue(){var r=[];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[k]=
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 52 49 2c 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 21 59 2e 74 65 73 74 28 74 7c 7c 6e 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 7c 7c 22 48 54 4d 4c 22 29 7d 2c 54 3d 73 65 2e 73 65 74 44 6f 63 75 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 3d 65 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 3a 6d 3b 72 65 74 75 72 6e 20 72 21 3d 3d 43 26 26 39 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 26 26 72 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 28 61 3d 28 43 3d 72 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 45 3d 21 69 28 43 29 2c 6d 21 3d 3d 43 26 26 28 6e 3d 43 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 6e 2e Data Ascii: RI,n=(e.ownerDocument\|\|e).documentElement;return!Y.test(t\|\|n&&n.nodeName\|\|"HTML")},T=se.setDocument=function(e){var t,n,r=e?e.ownerDocument\|\|e:m;return r!==C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),m!==C&&(n=C.defaultView)&&n.
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 65 74 75 72 6e 5b 5d 7d 7d 29 2c 62 2e 66 69 6e 64 2e 54 41 47 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 65 29 3a 64 2e 71 73 61 3f 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3a 76 6f 69 64 20 30 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 5b 5d 2c 69 3d 30 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 65 29 3b 69 66 28 22 2a 22 3d 3d 3d 65 29 7b 77 68 69 6c 65 28 6e 3d 6f 5b 69 2b 2b 5d 29 31 Data Ascii: eturn[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){while(n=o[i++])1
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 3a 64 69 73 61 62 6c 65 64 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 3a 65 6e 61 62 6c 65 64 22 2c 22 3a 64 69 73 61 62 6c 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 2a 2c 3a 78 22 29 2c 76 2e 70 75 73 68 28 22 2c 2e 2a 3a 22 29 7d 29 29 2c 28 64 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 3d 4b 2e 74 65 73 74 28 63 3d 61 2e 6d 61 74 63 68 65 73 7c 7c 61 2e 77 65 62 6b 69 74 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 61 2e 6d 6f 7a 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 61 2e 6f 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 61 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 29 29 26 26 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d Data Ascii: :disabled").length&&v.push(":enabled",":disabled"),e.querySelectorAll(",:x"),v.push(",.:")})),(d.matchesSelector=K.test(c=a.matches\|\|a.webkitMatchesSelector\|\|a.mozMatchesSelector\|\|a.oMatchesSelector\|\|a.msMatchesSelector))&&ce(function(e){d.disconnectedM
2024-09-27 22:18:20 UTC	1378	IN	Data Raw: 7d 29 2c 43 7d 2c 73 65 2e 6d 61 74 63 68 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 73 65 28 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 74 29 7d 2c 73 65 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 21 3d 3d 43 26 26 54 28 65 29 2c 64 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 26 26 45 26 26 21 41 5b 74 2b 22 20 22 5d 26 26 28 21 73 7c 7c 21 73 2e 74 65 73 74 28 74 29 29 26 26 28 21 76 7c 7c 21 76 2e 74 65 73 74 28 74 29 29 29 74 72 79 7b 76 61 72 20 6e 3d 63 2e 63 61 6c 6c 28 65 2c 74 29 3b 69 66 28 6e 7c 7c 64 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 7c 7c 65 2e 64 6f 63 75 6d 65 6e 74 26 26 31 31 Data Ascii: }),C},se.matches=function(e,t){return se(e,null,null,t)},se.matchesSelector=function(e,t){if((e.ownerDocument\|\|e)!==C&&T(e),d.matchesSelector&&E&&!A[t+" "]&&(!s\|\|!s.test(t))&&(!v\|\|!v.test(t)))try{var n=c.call(e,t);if(n\|\|d.disconnectedMatch\|\|e.document&&11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49728	185.15.59.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:20 UTC	667	OUT	GET /wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fgt.ive.mybluehost.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:21 UTC	1064	IN	HTTP/1.1 200 OK date: Fri, 27 Sep 2024 10:58:42 GMT etag: 1c0f6a975af7f9f284f791941dbbe5bd server: ATS/9.2.5 content-type: image/png content-disposition: inline;filename=UTF-8''ASSURANCE_MALADIE.svg.png last-modified: Sat, 29 Jun 2024 06:42:25 GMT content-length: 35625 age: 40777 x-cache: cp3079 hit, cp3079 hit/22 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp3079" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.33 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-09-27 22:18:21 UTC	13834	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 58 00 00 00 b1 08 06 00 00 00 18 b2 c3 bf 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e8 06 1d 06 2a 18 63 7a 61 61 00 00 80 00 49 44 41 54 78 da ec 5d 79 78 53 55 fa 7e bf 7b 93 d2 36 37 6d 81 22 8a bb e2 be 8b 3b 5a 92 14 50 54 70 1c 05 75 5c 59 92 80 fb e8 b8 eb d8 f1 e7 3a ee 28 4b 12 16 c5 1d 5c 46 d1 41 90 36 01 dc 95 71 df f7 05 10 01 29 cd 4d 5b 9a dc f3 fd fe 48 5a d2 36 6d 6e da a4 8b 9c f7 79 ca 43 92 73 ef d9 cf 79 cf 77 be 85 20 91 15 68 4e ff 38 00 6e 02 fa 32 50 02 50 09 Data Ascii: PNGIHDRXgAMAa cHRMz&u0`:pQ<bKGDtIME*czaaIDATx]yxSU~{67m";ZPTpu\Y:(K\FA6q)M[HZ6mnyCsyw hN8n2PP
2024-09-27 22:18:21 UTC	16320	IN	Data Raw: ab 07 3d fb eb 41 f7 30 3d e8 39 45 0f ba c7 45 42 de 31 20 a4 3b 25 8f 23 c6 05 89 cd b7 00 80 1d 8c 3d 00 3a 03 c4 0f 5b 58 7c af 39 fd c1 84 75 47 f6 14 ca 87 f8 ac 9a cb 57 41 cc 4f 20 61 91 d2 0e 16 17 70 f4 e4 14 fe 59 b2 20 c1 c2 c1 8d ff d7 ab bc 33 00 54 a4 14 24 50 b4 3c db fd 67 18 ea 95 00 56 65 54 5e 25 af 43 7a 58 86 22 fe 92 41 2e a1 ac ec e7 86 69 3d 2c 50 0b eb c6 48 c8 fd 38 73 74 1f 02 1e 03 10 cb 62 b3 6f 26 e2 eb 22 41 cf 35 6d 25 d0 57 4c 58 17 a9 f2 8c 06 f1 38 00 d9 9e f7 ff 23 e6 61 ed 5e 0d b6 94 3e 04 3d 73 98 e9 ce 4e e6 fb 62 01 a2 27 12 51 a4 b7 6e 12 75 cb 27 fc 02 a2 33 60 d6 01 6b 6a cc b7 aa 7c 04 65 3d c8 70 2f 40 a8 22 16 a9 f2 8c 07 61 0a 03 59 1b 07 c4 58 c4 0a 1d 54 13 f4 be d3 de 9c d2 4b 4b 86 31 f8 6e 98 8c 50 90 Data Ascii: =A0=9EEB1 ;%#=:[X\|9uGWAO apY 3T$P<gVeT^%CzX"A.i=,PH8stbo&"A5m%WLX8#a^>=sNb'Qnu'3`kj\|e=p/@"aYXTKK1nP
2024-09-27 22:18:21 UTC	5471	IN	Data Raw: 64 a4 ca 73 8f 5e e5 b9 55 31 8c b2 04 e1 01 11 56 86 83 9e c3 f4 a0 d7 db d4 7f e5 81 11 0c 9c db 78 90 b1 b0 71 80 5e e5 19 1b ae f2 9e ab e4 29 07 24 88 07 00 4c 6c 9f a4 f2 58 00 0d 44 f0 e8 bc 5a d3 6b d8 a6 d7 e9 b3 d2 f6 db d8 f9 aa a2 1a 4f 25 49 b9 bf 26 a8 fb eb 41 cf 50 3d e8 71 08 8b 3a 98 40 93 c3 55 9e f6 54 1e 54 00 6b 58 a1 91 91 a0 47 d3 f3 eb ed 48 22 64 0c 1e d5 f2 81 b8 64 92 67 00 7c bb 92 a7 6c a3 07 bd 07 e8 41 cf 5f 22 35 bc 57 82 d0 36 4a b1 c6 b7 3e a4 ce ba 20 41 ea 1b 25 b4 d7 eb c3 d6 ec 12 0e 79 4e 8c 04 3d bb 12 30 d1 b0 88 33 73 10 37 b2 51 52 d6 27 71 50 ba 59 67 6b 3f 3d e8 19 04 26 67 d2 a1 c2 0a 25 cf 29 09 96 84 44 87 a6 19 ff 35 89 31 bd 96 b4 18 2c 6e 3a a1 29 5b 16 80 16 0b e1 21 8d ff cb e7 86 27 9b 9d 08 99 9e 4a Data Ascii: ds^U1Vxq^)$LlXDZkO%I&AP=q:@UTTkXGH"ddg\|lA_"5W6J> A%yN=03s7QR'qPYgk?=&g%)D51,n:)[!'J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 22:18:21 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=239231 Date: Fri, 27 Sep 2024 22:18:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-27 22:18:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49732	151.101.130.137	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:21 UTC	358	OUT	GET /jquery-3.4.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:21 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 88145 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15851" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 27 Sep 2024 22:18:21 GMT Age: 2724640 X-Served-By: cache-lga21965-LGA, cache-ewr-kewr1740036-EWR X-Cache: HIT, HIT X-Cache-Hits: 1554, 1 X-Timer: S1727475502.549193,VS0,VE1 Vary: Accept-Encoding
2024-09-27 22:18:21 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-09-27 22:18:21 UTC	16384	IN	Data Raw: 2d 29 65 5b 6e 3d 50 28 65 2c 72 5b 69 5d 29 5d 3d 21 28 74 5b 6e 5d 3d 72 5b 69 5d 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 61 28 65 2c 30 2c 74 29 7d 29 3a 61 7d 7d 2c 70 73 65 75 64 6f 73 3a 7b 6e 6f 74 3a 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 5b 5d 2c 69 3d 5b 5d 2c 73 3d 66 28 65 2e 72 65 70 6c 61 63 65 28 42 2c 22 24 31 22 29 29 3b 72 65 74 75 72 6e 20 73 5b 6b 5d 3f 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 3d 73 28 65 2c 6e 75 6c 6c 2c 72 2c 5b 5d 29 2c 61 3d 65 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 61 2d 2d 29 28 69 3d 6f 5b 61 5d 29 26 26 28 65 5b 61 5d 3d 21 28 74 5b 61 5d 3d 69 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 Data Ascii: -)e[n=P(e,r[i])]=!(t[n]=r[i])}):function(e){return a(e,0,t)}):a}},pseudos:{not:le(function(e){var r=[],i=[],s=f(e.replace(B,"$1"));return s[k]?le(function(e,t,n,r){var i,o=s(e,null,r,[]),a=e.length;while(a--)(i=o[a])&&(e[a]=!(t[a]=i))}):function(e,t,n){re
2024-09-27 22:18:21 UTC	16384	IN	Data Raw: 20 30 3d 3d 3d 6e 3f 74 68 69 73 2e 67 65 74 28 65 2c 74 29 3a 28 74 68 69 73 2e 73 65 74 28 65 2c 74 2c 6e 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 74 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 29 7b 6e 3d 28 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 3f 74 2e 6d 61 70 28 56 29 3a 28 74 3d 56 28 74 29 29 69 6e 20 72 3f 5b 74 5d 3a 74 2e 6d 61 74 63 68 28 52 29 7c 7c 5b 5d 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6e 2d 2d 29 64 65 6c 65 74 65 20 72 5b 74 5b 6e 5d 5d 7d 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6b 2e 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 28 Data Ascii: 0===n?this.get(e,t):(this.set(e,t,n),void 0!==n?n:t)},remove:function(e,t){var n,r=e[this.expando];if(void 0!==r){if(void 0!==t){n=(t=Array.isArray(t)?t.map(V):(t=V(t))in r?[t]:t.match(R)\|\|[]).length;while(n--)delete r[t[n]]}(void 0===t\|\|k.isEmptyObject(
2024-09-27 22:18:21 UTC	16384	IN	Data Raw: 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 6b 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 6b 2e 72 65 6d 6f 76 65 45 76 65 6e 74 28 6e 2c 72 2c 74 2e 68 61 6e 64 6c 65 29 3b 6e 5b 51 2e 65 78 70 61 6e 64 6f 5d 3d 76 6f 69 64 20 30 7d 6e 5b 4a 2e 65 78 70 61 6e 64 6f 5d 26 26 28 6e 5b 4a 2e 65 78 70 61 6e 64 6f 5d 3d 76 6f 69 64 20 30 29 7d 7d 7d 29 2c 6b 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 64 65 74 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 57 65 28 74 68 69 73 2c 65 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 57 65 28 74 68 69 73 2c 65 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 5f 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e Data Ascii: n t.events)i[r]?k.event.remove(n,r):k.removeEvent(n,r,t.handle);n[Q.expando]=void 0}n[J.expando]&&(n[J.expando]=void 0)}}}),k.fn.extend({detach:function(e){return We(this,e,!0)},remove:function(e){return We(this,e)},text:function(e){return _(this,function
2024-09-27 22:18:21 UTC	16384	IN	Data Raw: 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 69 3d 67 74 5b 6f 5d 2c 67 74 5b 6f 5d 3d 72 2c 72 3d 6e 75 6c 6c 21 3d 61 28 65 2c 74 2c 6e 29 3f 6f 3a 6e 75 6c 6c 2c 67 74 5b 6f 5d 3d 69 29 2c 72 7d 7d 29 3b 76 61 72 20 76 74 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 79 74 3d 2f 5e 28 3f 3a 61 7c 61 72 65 61 29 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 28 65 2e 6d 61 74 63 68 28 52 29 7c 7c 5b 5d 29 2e 6a 6f 69 6e 28 22 20 22 29 7d 66 75 6e 63 74 69 6f 6e 20 78 74 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 29 7c 7c 22 22 7d 66 75 6e 63 Data Ascii: rCase();return n\|\|(i=gt[o],gt[o]=r,r=null!=a(e,t,n)?o:null,gt[o]=i),r}});var vt=/^(?:input\|select\|textarea\|button)$/i,yt=/^(?:a\|area)$/i;function mt(e){return(e.match(R)\|\|[]).join(" ")}function xt(e){return e.getAttribute&&e.getAttribute("class")\|\|""}func
2024-09-27 22:18:21 UTC	6225	IN	Data Raw: 75 72 6e 20 6b 2e 67 6c 6f 62 61 6c 45 76 61 6c 28 65 29 2c 65 7d 7d 7d 29 2c 6b 2e 61 6a 61 78 50 72 65 66 69 6c 74 65 72 28 22 73 63 72 69 70 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 2e 63 61 63 68 65 26 26 28 65 2e 63 61 63 68 65 3d 21 31 29 2c 65 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 26 26 28 65 2e 74 79 70 65 3d 22 47 45 54 22 29 7d 29 2c 6b 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 22 73 63 72 69 70 74 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 2c 69 3b 69 66 28 6e 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 6e 2e 73 63 72 69 70 74 41 74 74 72 73 29 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 3d 6b 28 22 3c 73 63 72 69 70 74 3e 22 29 2e 61 74 74 72 28 6e 2e 73 63 72 Data Ascii: urn k.globalEval(e),e}}}),k.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET")}),k.ajaxTransport("script",function(n){var r,i;if(n.crossDomain\|\|n.scriptAttrs)return{send:function(e,t){r=k("<script>").attr(n.scr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49734	50.6.152.208	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:21 UTC	406	OUT	GET /website_d53bc5d1/wp-admin/Ameli/Ameli/assets/images/first.PNG HTTP/1.1 Host: fgt.ive.mybluehost.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:21 UTC	366	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Mon, 23 Sep 2024 13:21:18 GMT Accept-Ranges: bytes Content-Length: 199039 Cache-Control: max-age=86400 Expires: Sat, 28 Sep 2024 22:18:21 GMT host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Content-Type: image/png
2024-09-27 22:18:21 UTC	7826	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 24 00 00 02 5c 08 06 00 00 00 08 0c 60 1c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 12 74 00 00 12 74 01 de 66 1f 78 00 00 ff a5 49 44 41 54 78 5e ec 9d 05 c0 55 55 d6 fe bf 99 ef fb fe 5f cd 8c 3a a3 8e dd dd 9d e3 a8 a3 82 58 20 25 dd 20 9d 22 06 62 77 77 77 17 b6 d8 8a 74 77 77 23 48 77 bd eb bf 7e 6b 9f 7d ef 79 2f f7 0d 10 07 46 d6 a3 8b 53 bb cf 3e ef 7d 9e 9d ff b6 78 d5 5a 71 73 73 73 73 fb d7 b3 25 1c 57 af 53 5b 93 dc 5b 27 8b 56 af 97 45 ab d6 c8 b0 39 0b e5 ea 2f 87 cb 9e f7 7d 26 bf bb e9 5d f9 b7 1b df 97 7f eb f2 be fc ae 4b 57 35 3d bf f1 3d 33 ce b9 67 cf 93 7b ff 5c 23 de 0f 42 ba 38 bf a9 ab fc fe 96 0f 65 Data Ascii: PNGIHDR$\`sRGBgAMAapHYsttfxIDATx^UU_:X % "bwwwtww#Hw~k}y/FS>}xZqssss%WS[['VE9/}&]KW5==3g{\#B8e
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 10 84 00 a2 1c 87 68 e4 03 3d 28 69 bf b9 82 24 02 32 45 eb 2f 69 c3 10 4a f9 ce 31 48 37 84 31 8e 0d a7 3c 29 f3 74 3c 10 58 86 49 95 06 ac 1e 46 2b 7a 24 4d 10 48 86 13 c5 32 c2 18 2f 4f da d3 71 d0 82 5b 1a 90 66 48 59 da 2f 3d 35 cc fd 89 80 54 31 69 3d ed 06 61 48 cf 0f d8 5c 41 12 7b 48 a2 20 a1 75 3e 4d a8 31 5a 77 29 83 98 57 de 6d 6e 7a c9 7f 7a e8 4b 71 c8 15 24 cc 97 c8 15 24 00 72 49 19 50 d7 a9 67 0c 25 a3 ac 20 dd 90 c6 28 48 30 08 1f 69 8b 73 3d d2 48 87 89 1b 04 74 14 97 18 3d 51 88 8a 92 86 2d a5 09 1e df 0e e2 88 b9 04 cc 07 89 75 8f 55 90 72 ff 1e 20 40 e2 62 13 f8 87 ac c6 a1 4c a4 83 55 ab 48 57 2e d2 e9 ce 27 48 72 97 fd 85 7c d3 0b 41 5d 8d ee 98 6f c4 f7 c4 e4 71 e2 40 90 90 9e f8 1c 23 ff 45 ed 25 92 0f d4 15 ea 49 5a 94 d2 23 40 Data Ascii: h=(i$2E/iJ1H71<)t<XIF+z$MH2/Oq[fHY/=5T1i=aH\A{H u>M1Zw)WmnzzKq$$rIPg% (H0is=Ht=Q-uUr @bLUHW.'Hr\|A]oq@#E%IZ#@
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 71 38 1c 0e 87 c3 e1 70 38 1c 5b 0d 2e 48 1c 0e 87 c3 e1 70 38 1c 0e c7 56 83 0b 12 87 c3 e1 70 38 1c 0e 87 c3 b1 d5 e0 82 c4 e1 70 38 1c 0e 87 c3 e1 70 6c 35 b8 20 Data Ascii: 8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5 q8p8[.Hp8Vp8p8pl5
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 0b c3 ea 99 bd 39 bc b6 3c 3d b4 9e 3e 6f 6a ee 33 e5 95 c4 69 22 2c 73 8f a3 9a bd 8f 6c 7c 58 24 f0 f1 3a 9c 63 e9 f0 62 98 d9 e7 31 9c f0 ce 08 3b 94 61 7c be e5 2c a4 3b a6 87 78 79 ef 94 15 62 f9 e6 61 8f cb 73 13 df b7 49 e0 6f ea b7 f0 c9 cc ef e4 8b d9 3d e4 9b d9 bd 6d c1 84 7e 3f 0f 97 fe 3f 8f b4 1e c0 09 4a ac 27 aa cd 5a 3e c7 26 6a ff bc 66 89 2c 5e bb 5c d6 16 ac b3 af 30 f9 3a 37 46 fa 03 d5 e3 ea 25 4b 64 e6 e8 d1 32 f8 f3 cf e4 9b 67 9e 90 d7 3a 5d 2d 4f d5 ab 2f f7 5c 7a a9 5c 7f c6 69 d2 e6 90 03 a5 e1 8e 3b 48 fd 1d ff 24 f5 d4 ea ff 65 27 69 77 f8 a1 d2 f5 8e 3b 64 ea f0 61 b2 7a e5 8a 4c 58 45 c4 a8 c8 49 4d a2 5e 3e 9a fe 8d 34 ed 7b 63 a6 3c 36 2a 2b 33 ad d7 df b6 96 73 1e a8 2c fb 95 39 5c 0e a9 7c bc 1c 5c f1 78 5b ee f7 90 aa Data Ascii: 9<=>oj3i",sl\|X$:cb1;a\|,;xybasIo=m~??J'Z>&jf,^\0:7F%Kd2g:]-O/\z\i;H$e'iw;dazLXEIM^>4{c<6*+3s,9\\|\x[
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 2e ff 49 46 cf bc 57 a6 4f b9 2c 21 b5 17 c8 32 25 75 ef 8e aa 25 6d fa b6 34 22 90 3b a1 3d 4d 30 4a b4 a4 b5 93 d5 ab be 18 5d 4d 56 68 d8 41 88 84 16 76 ce 43 4f 09 44 f2 02 99 0f 19 55 c2 ca 30 a4 30 1f a3 70 78 46 1e 35 cc b0 a4 6b e8 11 49 13 67 c8 4b db be 2d a4 f7 b8 ca b6 cc 6e 10 04 08 81 40 9a 6d 98 91 c6 c3 b2 bf ef 68 3c f8 09 e2 46 c3 b1 7c 32 54 29 1b 5f 88 2b b8 a1 2c 20 e5 a4 ad 3e 84 9b bc 25 ee ea a9 50 e8 a0 42 e1 ee 41 8d e4 ae 41 0d e4 c3 51 35 6c f9 e0 48 d8 6d 38 92 c5 1d 44 11 bd 03 b3 a6 5e 2c d3 92 a5 87 59 89 8b d5 ab 10 2e 8f 0f a9 9f 99 dc cf 04 f6 38 8f 03 31 72 73 ff a6 f2 cd d8 6a f2 f3 d4 72 36 cc 2d 92 79 7b 77 7a 4d 7c 69 b3 78 79 66 d7 7a 8e 70 30 f1 10 c4 d1 3a 4b 13 3d 0d e7 cb 20 c4 e0 c0 c6 1a 2f 04 3e 29 e7 24 7f Data Ascii: .IFWO,!2%u%m4";=M0J]MVhAvCODU00pxF5kIgK-n@mh<F\|2T)_+, >%PBAAQ5lHm8D^,Y.81rsjr6-y{wzM\|ixyfzp0:K= />)$
2024-09-27 22:18:21 UTC	8000	IN	Data Raw: 6f bd 54 8e 6d 7e b6 1c 55 ef 54 39 bd f3 85 72 e1 8b b5 a4 52 37 fd a6 7e 68 2f 95 4d 78 14 f6 1b be 8b 70 ff c1 31 2f cb f2 f5 ec 22 9f 9d 45 62 e9 49 fe d6 c5 b4 39 1c 8e ed 1b 2e 48 1c 8e 6d 08 f9 7f 98 f5 ae fe 78 cf 5f b5 50 c6 fe f4 46 46 90 98 38 80 e0 a9 ad 56 82 b7 56 49 6d 20 9b 61 79 55 26 4a 33 99 b8 76 4f 26 3e 43 38 20 1e 90 69 48 43 24 20 81 f4 c5 96 f5 d8 ab 51 95 25 3d f5 59 d8 fd 3d b4 9a d3 e2 df 77 42 65 59 3a 2d b4 f2 47 0b 64 57 d3 a1 44 95 09 ee 93 26 5f 22 f7 0f 6e 90 ec 4b 12 89 4a 07 db e3 82 5d d2 a7 d8 04 72 4d 27 ee c9 83 11 7f f2 11 26 e5 bf a6 44 bc 91 0d d7 8a 04 34 84 11 49 6e bc 66 45 28 26 86 0f 9b a0 82 84 f0 e8 69 a0 2c 08 d3 ca 83 8d 1b 2f 96 1f 95 58 37 85 e8 16 0a 47 4d 09 2f e7 90 7a f6 17 c1 1f 8b 04 40 c0 09 c7 Data Ascii: oTm~UT9rR7~h/Mxp1/"EbI9.Hmx_PFF8VVIm ayU&J3vO&>C8 iHC$ Q%=Y=wBeY:-GdWD&_"nKJ]rM'&D4InfE(&i,/X7GM/z@
2024-09-27 22:18:22 UTC	8000	IN	Data Raw: fe a7 ec 72 dc de b2 d3 a1 bb c9 7e 65 8f 90 b3 ee 2c 9f c9 67 10 24 a1 bc 4a 6b 35 7b 76 94 ab 95 2c 8f 5d 1a 37 14 e4 2b 0b df 20 c8 7e 7b 09 a6 0f 12 e9 f3 bc 0a 8c 5b 6c 82 7a 5a 90 98 60 b0 5e 93 78 1d ad 8b 6c f8 ac 8b cc 79 fd 2a 9b 3f 52 90 88 11 04 4c 56 68 04 b7 e1 5e 14 1d 59 ff 85 05 09 f7 12 3f df de 2b 05 63 be 94 02 9b 9f 91 4d 37 c8 a4 39 17 ea ee cd c9 9f 4b eb fe 77 68 19 84 46 00 5b 24 40 df 67 2c 97 8c a8 d3 ef fc f4 9b 2e 96 83 2b 1f 27 c7 ea 3b 3b ef c9 ea 52 ee d5 06 72 e1 8b b5 e5 f8 16 67 c9 ae c7 ee 25 65 54 b0 54 fa ba 95 ba d5 b2 4f 44 0c e1 86 7a 1a de 4d bb 81 77 e9 df ae 85 b2 7e 43 4c 23 a9 d3 73 2b dc ec df 38 87 c3 b1 fd c2 05 89 c3 b1 4d 41 7f 96 33 63 aa 39 6e d0 ff 92 1f 6c bd bf 6c cd 32 99 bc a0 b7 0c 1b 5f 49 96 4c Data Ascii: r~e,g$Jk5{v,]7+ ~{[lzZ`^xly*?RLVh^Y?+cM79KwhF[$@g,.+';;Rrg%eTTODzMw~CL#s+8MA3c9nll2_IL
2024-09-27 22:18:22 UTC	8000	IN	Data Raw: ec d1 12 b8 7d 42 77 46 97 a9 5a bc 5b b9 80 0c 5e da b7 88 0f f0 f8 75 76 00 0c a7 3d 7a a8 2c c6 6c ab 29 82 04 0b c7 f6 4b a9 08 2a ac 69 90 30 3e 12 80 30 02 b2 08 1c 2c 78 70 1a 9e fe 21 42 88 7e 5d f5 c6 67 a3 65 12 be 35 be af 10 d4 64 51 03 b4 5d 50 8d 40 46 65 7c 3a b7 02 be 9d 55 04 df ce 2e 80 5f 66 e6 c0 88 29 e9 30 74 7c 1a 14 29 f7 1a da b5 7e 09 a3 07 bc 88 25 13 5e c0 8a 89 cf 63 f9 84 e7 b1 62 7c 3c ac 89 78 0e eb c7 3f 83 75 e3 ff 83 0d cc 11 ff c6 fa 88 ff c3 9a f1 cf 62 d1 a4 17 d0 7f 66 56 b4 5a a8 86 b7 2a e4 2b 38 b2 c0 4a ae 8d af 85 40 4b 85 19 ad 50 76 62 53 99 36 55 71 4e 73 84 2c 6a 27 d3 b9 78 b9 db 90 05 ad 11 b2 b0 8d c4 e5 65 6d b5 5d 14 d0 58 ad 86 2c 77 cb 2c 6d 63 e3 90 df 70 95 65 bc 81 22 0b 6a 5c 36 03 1b a7 2e b6 3e Data Ascii: }BwFZ[^uv=z,l)Ki0>0,xp!B~]ge5dQ]P@Fe\|:U._f)0t\|)~%^cb\|<x?ubfVZ+8J@KPvbS6UqNs,j'xem]X,w,mcpe"j\6.>
2024-09-27 22:18:22 UTC	8000	IN	Data Raw: 7a da 27 86 bb e0 ce 74 35 68 d7 b8 36 3e b3 ef 74 2d 01 3a ec b6 86 ed 02 7c 8c 26 c6 2e 17 3c ef 1b 44 2f e9 8b 63 2b 46 a1 fb 92 d5 98 bc e7 10 0e 5c ba 82 db 77 48 a0 94 ba f3 db 4b 9d 9b 2f ec 42 a7 f5 df a2 ba d1 64 49 9b c8 d1 80 40 0a 57 c0 de 1e 65 27 36 45 8a 72 e9 91 b1 c5 7b c8 df a3 02 8a 0d ac 89 12 e1 75 50 7c 50 2d bc 91 27 19 32 b7 2b 2c b6 26 aa 15 e1 b1 c4 e9 35 4f 71 53 5b 73 39 b3 4f 2c f3 96 af 75 71 b7 b6 9f fe 5a a4 b2 8e de 1f e7 ae f1 81 a7 98 2f dd 7c 02 5d 43 d7 a0 40 d3 49 78 b5 78 38 e2 f3 4a 59 05 43 f1 72 71 fe 10 3b 0e ed 7f 58 8e 88 05 fb b0 65 df 39 92 2b 22 11 1d 6d 73 72 f2 b1 4e af db 1b a6 0e 5b fe 95 6b 51 62 bc fe 69 d8 5a 54 ec 34 0b 99 6a 8d c5 6b a5 74 4a 18 6b 34 72 d4 8b c0 c7 fd 57 63 ed 0e 5d 29 cf a7 0c 2f Data Ascii: z't5h6>t-:\|&.<D/c+F\wHK/BdI@We'6Er{uP\|P-'2+,&5OqS[s9O,uqZ/\|]C@Ixx8JYCrq;Xe9+"msrN[kQbiZT4jktJk4rWc])/
2024-09-27 22:18:22 UTC	8000	IN	Data Raw: 30 6b 5d d6 0c 25 40 53 d9 83 77 92 7a 30 f4 b3 a7 10 fe 19 6f b8 48 40 a5 b7 07 d3 fb 04 60 ee 2f 01 02 38 96 0d f4 60 ed 30 ad 8b 77 6a 98 0b 38 6d 88 f8 17 3e 9e 57 11 b5 97 b4 14 81 cb 0a 61 8e 9d 86 15 d0 9c 73 02 0c e8 68 41 80 9d 26 65 81 89 fd 2a 2c 06 bd c4 2c bc 71 7c 2b d8 49 dc c5 ed 50 66 42 13 54 9a db 8a fc 5a 1e 1b be b3 30 2c f9 12 eb 34 19 2a c7 00 12 9d 3a d3 0e c1 b3 9a 23 69 89 74 22 bc 73 58 c5 79 6d 50 6a 5c 23 94 9d d2 14 21 0b cc be 0f b6 1c 02 46 21 c4 45 7e a9 8a 0c 4d f2 23 23 81 92 a2 fd 6b 22 49 d1 b4 78 b7 5e 5e 14 25 60 91 be 71 6e 24 0d 4a 83 b4 35 73 a0 68 df 2a 28 33 b6 01 b2 b4 2e 88 1c 1f 16 c3 2b e9 13 e1 dd 3a b9 11 3c b3 25 85 d7 c7 b3 09 5f 44 9e af 4a a3 c2 cc e6 28 f0 6d 45 d9 99 9b 77 eb 2e 3f bd 39 b2 b4 2f 22 Data Ascii: 0k]%@Swz0oH@`/8`0wj8m>WashA&e,,q\|+IPfBTZ0,4:#it"sXymPj\#!F!E~M##k"Ix^^%`qn$J5sh*(3.+:<%_DJ(mEw.?9/"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49733	185.15.59.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:21 UTC	426	OUT	GET /wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:22 UTC	1064	IN	HTTP/1.1 200 OK date: Fri, 27 Sep 2024 10:58:42 GMT etag: 1c0f6a975af7f9f284f791941dbbe5bd server: ATS/9.2.5 content-type: image/png content-disposition: inline;filename=UTF-8''ASSURANCE_MALADIE.svg.png last-modified: Sat, 29 Jun 2024 06:42:25 GMT content-length: 35625 age: 40778 x-cache: cp3079 hit, cp3079 hit/23 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp3079" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.33 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-09-27 22:18:22 UTC	13834	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 58 00 00 00 b1 08 06 00 00 00 18 b2 c3 bf 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e8 06 1d 06 2a 18 63 7a 61 61 00 00 80 00 49 44 41 54 78 da ec 5d 79 78 53 55 fa 7e bf 7b 93 d2 36 37 6d 81 22 8a bb e2 be 8b 3b 5a 92 14 50 54 70 1c 05 75 5c 59 92 80 fb e8 b8 eb d8 f1 e7 3a ee 28 4b 12 16 c5 1d 5c 46 d1 41 90 36 01 dc 95 71 df f7 05 10 01 29 cd 4d 5b 9a dc f3 fd fe 48 5a d2 36 6d 6e da a4 8b 9c f7 79 ca 43 92 73 ef d9 cf 79 cf 77 be 85 20 91 15 68 4e ff 38 00 6e 02 fa 32 50 02 50 09 Data Ascii: PNGIHDRXgAMAa cHRMz&u0`:pQ<bKGDtIME*czaaIDATx]yxSU~{67m";ZPTpu\Y:(K\FA6q)M[HZ6mnyCsyw hN8n2PP
2024-09-27 22:18:22 UTC	16320	IN	Data Raw: ab 07 3d fb eb 41 f7 30 3d e8 39 45 0f ba c7 45 42 de 31 20 a4 3b 25 8f 23 c6 05 89 cd b7 00 80 1d 8c 3d 00 3a 03 c4 0f 5b 58 7c af 39 fd c1 84 75 47 f6 14 ca 87 f8 ac 9a cb 57 41 cc 4f 20 61 91 d2 0e 16 17 70 f4 e4 14 fe 59 b2 20 c1 c2 c1 8d ff d7 ab bc 33 00 54 a4 14 24 50 b4 3c db fd 67 18 ea 95 00 56 65 54 5e 25 af 43 7a 58 86 22 fe 92 41 2e a1 ac ec e7 86 69 3d 2c 50 0b eb c6 48 c8 fd 38 73 74 1f 02 1e 03 10 cb 62 b3 6f 26 e2 eb 22 41 cf 35 6d 25 d0 57 4c 58 17 a9 f2 8c 06 f1 38 00 d9 9e f7 ff 23 e6 61 ed 5e 0d b6 94 3e 04 3d 73 98 e9 ce 4e e6 fb 62 01 a2 27 12 51 a4 b7 6e 12 75 cb 27 fc 02 a2 33 60 d6 01 6b 6a cc b7 aa 7c 04 65 3d c8 70 2f 40 a8 22 16 a9 f2 8c 07 61 0a 03 59 1b 07 c4 58 c4 0a 1d 54 13 f4 be d3 de 9c d2 4b 4b 86 31 f8 6e 98 8c 50 90 Data Ascii: =A0=9EEB1 ;%#=:[X\|9uGWAO apY 3T$P<gVeT^%CzX"A.i=,PH8stbo&"A5m%WLX8#a^>=sNb'Qnu'3`kj\|e=p/@"aYXTKK1nP
2024-09-27 22:18:22 UTC	5471	IN	Data Raw: 64 a4 ca 73 8f 5e e5 b9 55 31 8c b2 04 e1 01 11 56 86 83 9e c3 f4 a0 d7 db d4 7f e5 81 11 0c 9c db 78 90 b1 b0 71 80 5e e5 19 1b ae f2 9e ab e4 29 07 24 88 07 00 4c 6c 9f a4 f2 58 00 0d 44 f0 e8 bc 5a d3 6b d8 a6 d7 e9 b3 d2 f6 db d8 f9 aa a2 1a 4f 25 49 b9 bf 26 a8 fb eb 41 cf 50 3d e8 71 08 8b 3a 98 40 93 c3 55 9e f6 54 1e 54 00 6b 58 a1 91 91 a0 47 d3 f3 eb ed 48 22 64 0c 1e d5 f2 81 b8 64 92 67 00 7c bb 92 a7 6c a3 07 bd 07 e8 41 cf 5f 22 35 bc 57 82 d0 36 4a b1 c6 b7 3e a4 ce ba 20 41 ea 1b 25 b4 d7 eb c3 d6 ec 12 0e 79 4e 8c 04 3d bb 12 30 d1 b0 88 33 73 10 37 b2 51 52 d6 27 71 50 ba 59 67 6b 3f 3d e8 19 04 26 67 d2 a1 c2 0a 25 cf 29 09 96 84 44 87 a6 19 ff 35 89 31 bd 96 b4 18 2c 6e 3a a1 29 5b 16 80 16 0b e1 21 8d ff cb e7 86 27 9b 9d 08 99 9e 4a Data Ascii: ds^U1Vxq^)$LlXDZkO%I&AP=q:@UTTkXGH"ddg\|lA_"5W6J> A%yN=03s7QR'qPYgk?=&g%)D51,n:)[!'J

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49735	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:22 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 71 44 4b 38 4f 55 77 4e 50 55 43 45 78 66 6e 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 65 36 62 35 62 39 64 33 62 66 63 39 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: qDK8OUwNPUCExfnx.1Context: 18e6b5b9d3bfc9f
2024-09-27 22:18:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:18:22 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 71 44 4b 38 4f 55 77 4e 50 55 43 45 78 66 6e 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 65 36 62 35 62 39 64 33 62 66 63 39 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 4c Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: qDK8OUwNPUCExfnx.2Context: 18e6b5b9d3bfc9f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPTL
2024-09-27 22:18:22 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 71 44 4b 38 4f 55 77 4e 50 55 43 45 78 66 6e 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 65 36 62 35 62 39 64 33 62 66 63 39 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: qDK8OUwNPUCExfnx.3Context: 18e6b5b9d3bfc9f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:18:22 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:18:22 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 43 57 54 72 72 41 50 78 55 32 2b 37 54 4c 2b 55 4d 46 6c 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FCWTrrAPxU2+7TL+UMFlRQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49749	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 75 52 68 34 5a 52 73 61 45 47 68 49 56 48 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 30 37 39 34 35 38 35 66 30 34 34 31 64 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4uRh4ZRsaEGhIVHv.1Context: d70794585f0441de
2024-09-27 22:18:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:18:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 75 52 68 34 5a 52 73 61 45 47 68 49 56 48 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 30 37 39 34 35 38 35 66 30 34 34 31 64 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4uRh4ZRsaEGhIVHv.2Context: d70794585f0441de<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPT
2024-09-27 22:18:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 75 52 68 34 5a 52 73 61 45 47 68 49 56 48 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 30 37 39 34 35 38 35 66 30 34 34 31 64 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4uRh4ZRsaEGhIVHv.3Context: d70794585f0441de<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:18:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:18:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 6a 4c 43 31 77 50 69 33 30 61 71 49 6c 70 61 4a 67 53 48 51 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CjLC1wPi30aqIlpaJgSHQA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49765	91.134.109.31	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:45 UTC	531	OUT	GET /dwD747.js?2 HTTP/1.1 Host: bmly.impots.gouv.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.impots.gouv.fr/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:46 UTC	325	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:45 GMT Server: EWS Accept-Ranges: none Content-Length: 38271 Connection: Close Cache-Control: max-age=3600, private Expires: Fri, 27 Sep 2024 23:18:45 GMT X-Content-Type-Options: nosniff X-Robots-Tag: noindex X-XSS-Protection: 0 Content-Type: application/javascript
2024-09-27 22:18:46 UTC	16059	IN	Data Raw: 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 6f 45 61 21 3d 3d 27 6f 62 6a 65 63 74 27 29 7b 69 66 28 77 69 6e 64 6f 77 2e 65 66 6c 61 73 68 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 77 69 6e 64 6f 77 2e 65 66 6c 61 73 68 3d 30 7d 69 66 28 77 69 6e 64 6f 77 2e 45 41 5f 70 61 72 61 6d 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 77 69 6e 64 6f 77 2e 45 41 5f 70 61 72 61 6d 3d 27 27 7d 76 61 72 20 5f 6f 45 61 3d 77 69 6e 64 6f 77 2e 5f 6f 45 61 3d 7b 73 65 72 76 65 72 3a 27 62 6d 6c 79 2e 69 6d 70 6f 74 73 2e 67 6f 75 76 2e 66 72 27 2c 61 70 61 74 68 3a 27 27 2c 76 65 72 73 69 6f 6e 3a 27 35 2e 35 2e 36 27 2c 69 61 74 74 72 3a 27 20 68 65 69 67 68 74 3d 22 32 22 20 77 69 64 74 68 3d 22 32 22 20 73 74 79 6c 65 3d 22 62 6f 72 64 65 72 3a 6e 6f 6e 65 22 Data Ascii: if(typeof window._oEa!=='object'){if(window.eflash===undefined){window.eflash=0}if(window.EA_param===undefined){window.EA_param=''}var _oEa=window._oEa={server:'bmly.impots.gouv.fr',apath:'',version:'5.5.6',iattr:' height="2" width="2" style="border:none"
2024-09-27 22:18:46 UTC	14020	IN	Data Raw: 24 58 28 75 2c 31 2c 73 72 76 29 29 7b 6f 2e 67 6c 6f 61 64 6a 73 28 75 29 7d 6f 2e 76 24 43 3d 30 7d 2c 67 69 6e 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 74 67 2c 73 29 7b 74 67 3d 5f 6f 45 61 2e 65 6c 74 62 79 69 64 28 74 67 29 3b 69 66 28 74 67 29 7b 74 72 79 7b 77 68 69 6c 65 28 74 67 2e 66 69 72 73 74 43 68 69 6c 64 29 7b 74 67 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 67 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 0a 74 67 2e 69 6e 6e 65 72 48 54 4d 4c 3d 73 3b 72 65 74 75 72 6e 20 31 7d 63 61 74 63 68 28 65 29 7b 5f 6f 45 61 2e 6c 6f 67 28 27 67 69 6e 6a 65 63 74 27 2c 65 29 7d 7d 7d 2c 66 24 30 3a 66 75 6e 63 74 69 6f 6e 28 74 67 2c 63 61 6c 6c 2c 74 70 2c 6e 2c 66 2c 76 2c 6e 62 29 7b 76 61 72 20 75 72 6c 3d 27 27 2c 63 6e 61 6d 65 3d 27 27 2c 6f 3d Data Ascii: $X(u,1,srv)){o.gloadjs(u)}o.v$C=0},ginject:function(tg,s){tg=_oEa.eltbyid(tg);if(tg){try{while(tg.firstChild){tg.removeChild(tg.firstChild)}tg.innerHTML=s;return 1}catch(e){_oEa.log('ginject',e)}}},f$0:function(tg,call,tp,n,f,v,nb){var url='',cname='',o=
2024-09-27 22:18:46 UTC	8192	IN	Data Raw: 3b 69 66 28 21 6f 2e 66 24 41 4c 28 73 72 76 29 29 7b 69 66 28 64 29 7b 6f 2e 76 63 61 6c 6c 28 32 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 64 2c 73 72 76 29 7d 65 6c 73 65 7b 74 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2d 3d 31 3b 69 66 28 6f 2e 66 24 41 4c 28 73 72 76 29 29 7b 63 3d 30 7d 65 6c 73 65 20 69 66 28 64 29 7b 6f 2e 76 63 61 6c 6c 28 32 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 64 2c 73 72 76 29 3b 63 3d 30 7d 69 66 28 21 63 29 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 74 29 7d 7d 2c 76 29 7d 7d 69 66 28 6f 2e 76 24 58 29 7b 72 65 74 75 72 6e 7d 6f 2e 76 24 58 3d 31 3b 6f 2e 6f 6e 6c 6f 61 64 28 5f 6f 45 61 2e 66 24 33 29 7d 2c 0a 74 63 66 76 32 6c 6f 61 64 3a 66 75 6e 63 74 69 6f 6e 28 73 72 76 29 7b 76 Data Ascii: ;if(!o.f$AL(srv)){if(d){o.vcall(2);o.collector(d,srv)}else{t=setInterval(function(){c-=1;if(o.f$AL(srv)){c=0}else if(d){o.vcall(2);o.collector(d,srv);c=0}if(!c){clearInterval(t)}},v)}}if(o.v$X){return}o.v$X=1;o.onload(_oEa.f$3)},tcfv2load:function(srv){v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49778	91.134.109.31	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:46 UTC	354	OUT	GET /dwD747.js?2 HTTP/1.1 Host: bmly.impots.gouv.fr Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:47 UTC	325	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:46 GMT Server: EWS Accept-Ranges: none Content-Length: 38271 Connection: Close Cache-Control: max-age=3600, private Expires: Fri, 27 Sep 2024 23:18:46 GMT X-Content-Type-Options: nosniff X-Robots-Tag: noindex X-XSS-Protection: 0 Content-Type: application/javascript
2024-09-27 22:18:47 UTC	16059	IN	Data Raw: 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 6f 45 61 21 3d 3d 27 6f 62 6a 65 63 74 27 29 7b 69 66 28 77 69 6e 64 6f 77 2e 65 66 6c 61 73 68 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 77 69 6e 64 6f 77 2e 65 66 6c 61 73 68 3d 30 7d 69 66 28 77 69 6e 64 6f 77 2e 45 41 5f 70 61 72 61 6d 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 77 69 6e 64 6f 77 2e 45 41 5f 70 61 72 61 6d 3d 27 27 7d 76 61 72 20 5f 6f 45 61 3d 77 69 6e 64 6f 77 2e 5f 6f 45 61 3d 7b 73 65 72 76 65 72 3a 27 62 6d 6c 79 2e 69 6d 70 6f 74 73 2e 67 6f 75 76 2e 66 72 27 2c 61 70 61 74 68 3a 27 27 2c 76 65 72 73 69 6f 6e 3a 27 35 2e 35 2e 36 27 2c 69 61 74 74 72 3a 27 20 68 65 69 67 68 74 3d 22 32 22 20 77 69 64 74 68 3d 22 32 22 20 73 74 79 6c 65 3d 22 62 6f 72 64 65 72 3a 6e 6f 6e 65 22 Data Ascii: if(typeof window._oEa!=='object'){if(window.eflash===undefined){window.eflash=0}if(window.EA_param===undefined){window.EA_param=''}var _oEa=window._oEa={server:'bmly.impots.gouv.fr',apath:'',version:'5.5.6',iattr:' height="2" width="2" style="border:none"
2024-09-27 22:18:47 UTC	14020	IN	Data Raw: 24 58 28 75 2c 31 2c 73 72 76 29 29 7b 6f 2e 67 6c 6f 61 64 6a 73 28 75 29 7d 6f 2e 76 24 43 3d 30 7d 2c 67 69 6e 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 74 67 2c 73 29 7b 74 67 3d 5f 6f 45 61 2e 65 6c 74 62 79 69 64 28 74 67 29 3b 69 66 28 74 67 29 7b 74 72 79 7b 77 68 69 6c 65 28 74 67 2e 66 69 72 73 74 43 68 69 6c 64 29 7b 74 67 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 67 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 0a 74 67 2e 69 6e 6e 65 72 48 54 4d 4c 3d 73 3b 72 65 74 75 72 6e 20 31 7d 63 61 74 63 68 28 65 29 7b 5f 6f 45 61 2e 6c 6f 67 28 27 67 69 6e 6a 65 63 74 27 2c 65 29 7d 7d 7d 2c 66 24 30 3a 66 75 6e 63 74 69 6f 6e 28 74 67 2c 63 61 6c 6c 2c 74 70 2c 6e 2c 66 2c 76 2c 6e 62 29 7b 76 61 72 20 75 72 6c 3d 27 27 2c 63 6e 61 6d 65 3d 27 27 2c 6f 3d Data Ascii: $X(u,1,srv)){o.gloadjs(u)}o.v$C=0},ginject:function(tg,s){tg=_oEa.eltbyid(tg);if(tg){try{while(tg.firstChild){tg.removeChild(tg.firstChild)}tg.innerHTML=s;return 1}catch(e){_oEa.log('ginject',e)}}},f$0:function(tg,call,tp,n,f,v,nb){var url='',cname='',o=
2024-09-27 22:18:47 UTC	8192	IN	Data Raw: 3b 69 66 28 21 6f 2e 66 24 41 4c 28 73 72 76 29 29 7b 69 66 28 64 29 7b 6f 2e 76 63 61 6c 6c 28 32 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 64 2c 73 72 76 29 7d 65 6c 73 65 7b 74 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2d 3d 31 3b 69 66 28 6f 2e 66 24 41 4c 28 73 72 76 29 29 7b 63 3d 30 7d 65 6c 73 65 20 69 66 28 64 29 7b 6f 2e 76 63 61 6c 6c 28 32 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 64 2c 73 72 76 29 3b 63 3d 30 7d 69 66 28 21 63 29 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 74 29 7d 7d 2c 76 29 7d 7d 69 66 28 6f 2e 76 24 58 29 7b 72 65 74 75 72 6e 7d 6f 2e 76 24 58 3d 31 3b 6f 2e 6f 6e 6c 6f 61 64 28 5f 6f 45 61 2e 66 24 33 29 7d 2c 0a 74 63 66 76 32 6c 6f 61 64 3a 66 75 6e 63 74 69 6f 6e 28 73 72 76 29 7b 76 Data Ascii: ;if(!o.f$AL(srv)){if(d){o.vcall(2);o.collector(d,srv)}else{t=setInterval(function(){c-=1;if(o.f$AL(srv)){c=0}else if(d){o.vcall(2);o.collector(d,srv);c=0}if(!c){clearInterval(t)}},v)}}if(o.v$X){return}o.v$X=1;o.onload(_oEa.f$3)},tcfv2load:function(srv){v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49781	91.134.109.31	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:46 UTC	836	OUT	GET /col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0& HTTP/1.1 Host: bmly.impots.gouv.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.impots.gouv.fr/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:18:47 UTC	698	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:47 GMT Server: EWS Accept-Ranges: none Content-Length: 4000 Connection: Close Pragma: private, no-cache, no-cache=Set-Cookie, proxy-revalidate Cache-Control: max-age=0, private Strict-Transport-Security: max-age=604800 X-Content-Type-Options: nosniff X-Robots-Tag: noindex X-XSS-Protection: 0 Content-Type: application/javascript Set-Cookie: etuix=5HF39n_PrWPHaN8M8eTVKEbmWX5YZoE25LIgBVBVsdnQjMVu.bqAdA--; expires=Sat, 25 Oct 2025 22:18:47 GMT; domain=.impots.gouv.fr; path=/; SameSite=None; secure; HttpOnly Set-Cookie: etuix=; domain=bmly.impots.gouv.fr; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; SameSite=None; secure; HttpOnly
2024-09-27 22:18:47 UTC	4000	IN	Data Raw: 2f 2a 20 23 35 31 32 30 30 33 35 38 31 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 0a 6f 2e 70 6d 74 63 72 65 63 20 09 3d 20 30 3b 6f 2e 72 63 6f 6c 6c 65 63 74 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 76 61 72 20 6f 20 3d 20 5f 6f 45 61 3b 6f 2e 70 6d 74 63 72 65 63 20 3d 20 31 3b 6f 2e 72 65 63 75 72 73 65 28 31 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 20 61 20 29 3b 7d 3b 6f 2e 70 6d 64 65 6e 79 61 6c 6c 20 3d 20 30 3b 6f 2e 74 63 66 76 32 64 68 09 3d 20 30 3b 6f 2e 74 63 66 76 32 63 76 68 09 3d 20 30 3b 6f 2e 70 6d 74 63 66 76 32 74 68 61 77 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 76 61 72 20 68 2c 20 6f 20 3d 20 5f 6f 45 61 2c 20 64 20 3d 20 6f 2e 74 63 66 76 32 64 2c 20 63 76 2c 20 74 2c 20 77 63 76 20 3d 20 30 3b 76 61 72 Data Ascii: /* #512003581 */(function(o){o.pmtcrec = 0;o.rcollector = function(a) {var o = _oEa;o.pmtcrec = 1;o.recurse(1);o.collector( a );};o.pmdenyall = 0;o.tcfv2dh= 0;o.tcfv2cvh= 0;o.pmtcfv2thaw = function() {var h, o = _oEa, d = o.tcfv2d, cv, t, wcv = 0;var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49784	91.134.109.31	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:48 UTC	731	OUT	GET /col14a/-/1570568516?evariant=2-4&pggrp=actualite&sd=24&urlp=13574_resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&url=https%3A%2F%2Fwww.impots.gouv.fr%2Factualite%2Fresultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1&ss=1280x1024&fra=0& HTTP/1.1 Host: bmly.impots.gouv.fr Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: etuix=5HF39n_PrWPHaN8M8eTVKEbmWX5YZoE25LIgBVBVsdnQjMVu.bqAdA--
2024-09-27 22:18:48 UTC	390	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:18:48 GMT Server: EWS Accept-Ranges: none Content-Length: 4000 Connection: Close Pragma: private, no-cache, no-cache=Set-Cookie, proxy-revalidate Cache-Control: max-age=0, private Strict-Transport-Security: max-age=604800 X-Content-Type-Options: nosniff X-Robots-Tag: noindex X-XSS-Protection: 0 Content-Type: application/javascript
2024-09-27 22:18:48 UTC	4000	IN	Data Raw: 2f 2a 20 23 36 33 33 33 39 35 32 38 39 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 0a 6f 2e 70 6d 74 63 72 65 63 20 09 3d 20 30 3b 6f 2e 72 63 6f 6c 6c 65 63 74 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 61 29 20 7b 76 61 72 20 6f 20 3d 20 5f 6f 45 61 3b 6f 2e 70 6d 74 63 72 65 63 20 3d 20 31 3b 6f 2e 72 65 63 75 72 73 65 28 31 29 3b 6f 2e 63 6f 6c 6c 65 63 74 6f 72 28 20 61 20 29 3b 7d 3b 6f 2e 70 6d 64 65 6e 79 61 6c 6c 20 3d 20 30 3b 6f 2e 74 63 66 76 32 64 68 09 3d 20 30 3b 6f 2e 74 63 66 76 32 63 76 68 09 3d 20 30 3b 6f 2e 70 6d 74 63 66 76 32 74 68 61 77 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 76 61 72 20 68 2c 20 6f 20 3d 20 5f 6f 45 61 2c 20 64 20 3d 20 6f 2e 74 63 66 76 32 64 2c 20 63 76 2c 20 74 2c 20 77 63 76 20 3d 20 30 3b 76 61 72 Data Ascii: /* #633395289 */(function(o){o.pmtcrec = 0;o.rcollector = function(a) {var o = _oEa;o.pmtcrec = 1;o.recurse(1);o.collector( a );};o.pmdenyall = 0;o.tcfv2dh= 0;o.tcfv2cvh= 0;o.pmtcfv2thaw = function() {var h, o = _oEa, d = o.tcfv2d, cv, t, wcv = 0;var

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49789	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:18:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6a 4a 2f 64 36 53 35 6d 31 55 47 67 6c 36 55 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 64 65 62 30 63 62 62 32 30 61 65 33 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: jJ/d6S5m1UGgl6Uy.1Context: a28deb0cbb20ae30
2024-09-27 22:18:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:18:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6a 4a 2f 64 36 53 35 6d 31 55 47 67 6c 36 55 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 64 65 62 30 63 62 62 32 30 61 65 33 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: jJ/d6S5m1UGgl6Uy.2Context: a28deb0cbb20ae30<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPT
2024-09-27 22:18:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6a 4a 2f 64 36 53 35 6d 31 55 47 67 6c 36 55 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 64 65 62 30 63 62 62 32 30 61 65 33 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: jJ/d6S5m1UGgl6Uy.3Context: a28deb0cbb20ae30<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:18:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:18:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 54 72 4f 30 2f 70 50 4a 6b 36 64 75 56 71 6c 38 58 38 51 39 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CTrO0/pPJk6duVql8X8Q9g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49793	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:19:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 66 31 6c 6b 39 70 4d 32 6b 71 63 70 76 38 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 36 33 31 37 36 35 61 62 33 37 38 35 64 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: sf1lk9pM2kqcpv8+.1Context: 50631765ab3785df
2024-09-27 22:19:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:19:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 66 31 6c 6b 39 70 4d 32 6b 71 63 70 76 38 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 36 33 31 37 36 35 61 62 33 37 38 35 64 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: sf1lk9pM2kqcpv8+.2Context: 50631765ab3785df<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPT
2024-09-27 22:19:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 66 31 6c 6b 39 70 4d 32 6b 71 63 70 76 38 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 30 36 33 31 37 36 35 61 62 33 37 38 35 64 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: sf1lk9pM2kqcpv8+.3Context: 50631765ab3785df<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:19:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:19:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 5a 35 6f 2b 70 78 44 53 30 69 6c 36 35 4d 46 49 4a 57 6f 74 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: DZ5o+pxDS0il65MFIJWotg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49797	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:19:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 44 4f 4f 41 6e 72 6f 75 55 6d 44 70 32 71 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 64 37 39 31 64 37 66 35 35 36 64 31 38 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: VDOOAnrouUmDp2qt.1Context: 9ad791d7f556d182
2024-09-27 22:19:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:19:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 56 44 4f 4f 41 6e 72 6f 75 55 6d 44 70 32 71 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 64 37 39 31 64 37 66 35 35 36 64 31 38 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 78 47 63 38 55 58 43 2f 33 75 4a 46 4d 66 51 56 6a 31 55 6f 4e 31 58 64 52 66 55 70 56 53 76 52 75 68 77 50 69 77 6e 6f 43 46 36 70 69 53 6a 76 38 32 51 6f 4f 45 4b 46 6a 4a 63 55 30 35 6b 51 45 65 71 51 51 36 4d 62 63 4d 43 38 45 71 4f 39 49 2b 33 4f 7a 6a 4b 55 75 41 30 4e 50 4b 69 64 4e 76 79 61 56 71 44 36 7a 50 50 54 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: VDOOAnrouUmDp2qt.2Context: 9ad791d7f556d182<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdxGc8UXC/3uJFMfQVj1UoN1XdRfUpVSvRuhwPiwnoCF6piSjv82QoOEKFjJcU05kQEeqQQ6MbcMC8EqO9I+3OzjKUuA0NPKidNvyaVqD6zPPT
2024-09-27 22:19:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 44 4f 4f 41 6e 72 6f 75 55 6d 44 70 32 71 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 64 37 39 31 64 37 66 35 35 36 64 31 38 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: VDOOAnrouUmDp2qt.3Context: 9ad791d7f556d182<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:19:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:19:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 76 4f 63 58 51 52 39 30 55 4f 64 5a 68 79 46 52 6f 73 79 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NvOcXQR90UOdZhyFRosyMg.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2688, Parent PID: 5884

General

Target ID:	0
Start time:	18:18:05
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7092, Parent PID: 2688

General

Target ID:	2
Start time:	18:18:10
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1904,i,14735054992420749611,13514269811391121098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6828, Parent PID: 5884

General

Target ID:	3
Start time:	18:18:12
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly