Edit tour

Windows Analysis Report
http://www.timesheetz.net/EtzWeb/u/015bcc8ebe

Overview

General Information

Sample URL:	http://www.timesheetz.net/EtzWeb/u/015bcc8ebe
Analysis ID:	1539661
Tags:	urlscan
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,3178922573065967647,11451009141796564964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.timesheetz.net/EtzWeb/u/015bcc8ebe" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /report/v4?s=qrM0O3VTNCHveizXbj1pSPe94v8rsXg6uTinvaMWs0XP9ipPaBF3le6wFvXuHDCLc5wf3f8tKeNwfI%2F%2BrCxwgiFGsqVzAvU3Wfw2%2FwYtq8u2bhxx4IiAb54b0WPwbi5xyn%2Bx3g%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 414Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_73.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: http://www.google-analytics.com
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_69.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: chromecache_74.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53543
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60157
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:53543 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/26@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,3178922573065967647,11451009141796564964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.timesheetz.net/EtzWeb/u/015bcc8ebe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,3178922573065967647,11451009141796564964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://stats.g.doubleclick.net/j/collect?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
www.timesheetz.net	104.26.10.58	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
dc.services.visualstudio.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.timesheetz.net/Static/images/Branding/favicon.png	false	unknown
https://www.timesheetz.net/EtzWeb/u/015bcc8ebe	false	unknown
https://www.timesheetz.net/EtzWeb/Css/bootstrap.css	false	unknown
https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSigned	false	unknown
https://www.timesheetz.net/Static/images/Branding/error-page.png	false	unknown
https://www.timesheetz.net/EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	chromecache_73.2.dr	false		unknown
https://www.google.%/ads/ga-audiences?	chromecache_74.2.dr	false		unknown
https://stats.g.doubleclick.net/j/collect?	chromecache_71.2.dr, chromecache_74.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/analytics/web/inpage/pub/inpage.js?	chromecache_71.2.dr, chromecache_74.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.11.58	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.69.202	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.8
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539661
Start date and time:	2024-10-23 00:12:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.timesheetz.net/EtzWeb/u/015bcc8ebe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/26@14/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 172.217.16.206, 108.177.15.84, 34.104.35.123, 142.250.186.170, 142.250.186.67, 152.199.19.161, 142.250.185.200, 142.250.186.168, 20.50.88.234, 192.229.221.95, 40.69.42.241, 20.242.39.171, 20.50.88.238, 52.165.164.15, 131.107.255.255, 216.58.212.163
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, gig-ai-g-prod-westeurope-6-app-v4-tag.westeurope.cloudapp.azure.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, dns.msftncsi.com, az416426.vo.msecnd.net, fe3cr.delivery.mp.microsoft.com, ssl.google-analytics.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, dc.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, update.googleapis.com, dc.applicationinsights.microsoft.com, gig-ai-g-prod-westeurope-3-app-v4-tag.westeurope.cloudapp.azure.com, clients.l.google.com, cs9.wpc.v0cdn.net, gig-ai-prod-westeurope-global.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.timesheetz.net/EtzWeb/u/015bcc8ebe

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 21:13:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9823840626531153
Encrypted:	false
SSDEEP:	48:8R0dKT2yDHxidAKZdA1oehwiZUklqehLy+3:8RBjuMy
MD5:	141150B37483AC392130E4C62930B869
SHA1:	9EED56982FD3868C1F3894253CB23DA5E10BC144
SHA-256:	EE61E99BC0409F4B8925992754C324975AFCB50105AD0F40AEEA43B2EBD7E17D
SHA-512:	8293362632DCB9D4A31AAF0092D9B28E4CC28B031C8ABFAD8162191339677BAA7336D75336B72982C06D268BC2D8E9EDC6F16C7862A9134723CD2FC3F8012FD5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....`(..$..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 21:13:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9973450037774714
Encrypted:	false
SSDEEP:	48:830dKT2yDHxidAKZdA1leh/iZUkAQkqeh8y+2:83BjM9Q5y
MD5:	1F188E139BBCF7A004083A595F32CB46
SHA1:	8A5A50C73B61E38AED1B65AC0755300CF1644C59
SHA-256:	25CF0DCF7A0ADAB8EF4F5F58075057F537E00C0B1880388F404842F890BD8F05
SHA-512:	032131C1B8F6DE4B4531E79D170ECF5B8940172E1F977474E8E056CAB075C88A8CEBCC5FF102264CD56A3DAAE469656696CD9C03AFF0675FC08D5B73738D8C2D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....WF...$..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007377968015051
Encrypted:	false
SSDEEP:	48:8H0dKT2ybHxidAKZdA14t5eh7sFiZUkmgqeh7sKy+BX:8HBjsnwy
MD5:	49EBB298057BC97D262509ED2A7EA678
SHA1:	747A02ECE4DAC25D0CB152BC2B3D3C724094BFD6
SHA-256:	C7166C973EF372DD2B753E5A9A445EE9988B5E98FD556257D3B16E161EF2E312
SHA-512:	1A1066AD17F929A0FB6FB90F3A9902DAFE24BF33D3D231DB80FF3063E54EB4FEE69AE03865B311B2014BBF160AD3E8B48DAC3EAAF34B63852FCAD307A4645678
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 21:13:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995602389553292
Encrypted:	false
SSDEEP:	48:8+0dKT2yDHxidAKZdA16ehDiZUkwqehoy+R:8+BjHiy
MD5:	89A6D0BD05718437CCD02ABB3443123C
SHA1:	9A827EDAB6D1537740E5FD60490038204EC8DC59
SHA-256:	997FD53B460C2CB455E066F64B83DE1C073C82CB9DF2505A987A6A60E2946BDA
SHA-512:	7264D0D3878E3DB88BA3F7CC1A6EC3CE020F7ACA6B50BAB8D196261DF0262177E3E1861F725979E8CF7FB3DCBED37541F357C4089B274CF0E947105225351E42
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....f....$..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 21:13:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985643606019199
Encrypted:	false
SSDEEP:	48:8Qb0dKT2yDHxidAKZdA1UehBiZUk1W1qehuy+C:8uBjX9Oy
MD5:	4112BFB4FD675C8D6F5AED8C7BF96A6B
SHA1:	22FFFEF8F02EE610378F6CB3D5364AA681E4E466
SHA-256:	51FAD24099931018DD2CFC489175BA83F45C866B2ADF03BC66BBEC2E12E0DE14
SHA-512:	83B29C04EF33CE70FB06F4B17F13664C9B3AB00718E22F4530AA67A1091B464CE17464400ACBC9D5F620D0BFF62361311554C748782A3A4D11BA97EEBC0A6B31
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....~."..$..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 21:13:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9974305662047467
Encrypted:	false
SSDEEP:	48:8K0dKT2yDHxidAKZdA1duTrehOuTbbiZUk5OjqehOuTbwy+yT+:8KBjgTYTbxWOvTbwy7T
MD5:	E9D2F05F8484E697AA1C3D45528BF6C0
SHA1:	09D660B172D9278166EA81FCFEAC2C80E8AD1DD2
SHA-256:	F4E78F80CB80654B0323FA1F1B6735217A374F4EAF5B16AA51AB797989CAC705
SHA-512:	93C1B17414D02935843973B14447CA72898517CEEC9C54E637712B2C01BF2B838F4B5D0245C9730CFFF93BF4EA982286BEE3BFDFC1925F1D017E974FD45A820D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........$..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IVY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>\|.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.988119248989337
Encrypted:	false
SSDEEP:	384:1stcBfAVaR8i6XzMsb4fcjakBudFyBqrgeU0hipgwfqj09nOt/a:1k0F6Xz1bFjaPbyBqr9hIgkM3Fa
MD5:	8655D20BBCC8CDBFAB17B6BE6CF55DF3
SHA1:	90EDBFA9A7DABB185487B4774076F82EB6412270
SHA-256:	E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
SHA-512:	47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Preview:	wOF2......H...........H..........................\|.....h.`?STAT^..0..\|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I..h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J\|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=\|......uOGA{.7.....h....q.d.4$.x<.....^0\|...@....@Q[RC.0....b....'...RID

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2295
Entropy (8bit):	7.888481039029385
Encrypted:	false
SSDEEP:	48:7+lCXmsxnSTlnKNCXYL8Z/xQHb8ku6vNRJaD1/tsNErQj1:7+PTlKNC5JQ7zNRJ6Zt54
MD5:	7067FD3F2CDF4DA8858C5DD1695C8314
SHA1:	385BE7A93E70A5A6A44C5B4283DABFCBE11FE83B
SHA-256:	A93F734D47E37E634E7B24741867CD7A08EB62DCE5E7D4C55A93EFBB52322AE0
SHA-512:	7BFA149AA95D6A6CAAE5986185DFB12299C51D74E7EBFA974349EF6A57CEFF4EC6DB10451A9B24AEEB9850ECE8B65FF4C38B3BCEE3E9D92DF066F83069E9B2DC
Malicious:	false
Reputation:	low
URL:	https://www.timesheetz.net/Static/images/Branding/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Wkl.W.>wfvg......N.G.&.m.$.....D.T..........@.B..@......m)R#..TU..U..E....6DJp.....S;Y?v...7.3k..MA...3w.=..\|..3...Q.......B....P.....,..T...k..p.e.y...PK.U...N..=..i..0.`.G..PLh..9.%!....\.~.F+[..&..=P....N....4'(.g.....X...=..x.B".^.....FB..5........X..oD0...{.:.:.bsfOg<{r ........m........w'..6V...E....F,2.p^...7i.>..4t..F.G...(..!...;...g.S....s,X..:........%........_...E.V..-{X....6..............^...<.2bD...+........\V=.;..2.[;V....~f...OGj..j)gX...h.!.5..F.^.....>5...e.U...8;zPS.W\..e..^......X......(......2DUI.a.t.<.c..3.^Il.@.../]>.x)....".i.#..#%1L........'..PT ...m.4.D.m.u.. p.q.~..-VJ.KoE8".D$.....O./..D}..,8.l.S.....g..B...((.X2.....-.D...I69....:U...x'=..>.YEM.3.._.>..`..........^.Vs....v..<g...s.]..SF.i..S.mPR.%...e..,.\|.P....40.X..K.._..:TU!T.;.vm.V..[-.N1.X9"J..,......o....Qs..+.A/N.......]].Q.....X...zd...<.G.....D\|.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	5973
Entropy (8bit):	5.385847419693263
Encrypted:	false
SSDEEP:	96:ZOEMJJOEMiDFZ8OEMXkOEMhYOEMlOEM5y+aZjzBrWOEMfubqGIFuV4UOEMmOEMZ0:wJAiXBh1s5qb2bqGIwV4R3ZqF
MD5:	207F621B4209616283D091A5A0F8CD49
SHA1:	D34E96207B74C7446771ED458DDB74AE78121E93
SHA-256:	5780DCB011235F74EBD060A2E1D7E214E3BD12E13982BF4BD7FBE052D3D55F63
SHA-512:	91EA88B5F95863ABBB93E69AF3D7F68BD0D5C3716C5294869A64D5C08C573DA8FE1695279B397D7E7765431863013AC7AFB6DA00559C49AA49E6D4E87580C306
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Open+Sans:400
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-fa

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (701), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	3674
Entropy (8bit):	5.001955129564551
Encrypted:	false
SSDEEP:	48:jJUxcqKtE+Uh1BqeOZsJExDcwFdBNWaFYGI/PHaEjt5Z2rwUnf832NlqNT1q1C00:jSqqWUhrlOZIExnFhXFHIHHpDufxS2Cf
MD5:	5948CB8C9BC20DA508B1B8800FD6BC47
SHA1:	616B41DE534F67FF730F0451D1007E0B6C721F6A
SHA-256:	9871B15D011CC9EE61A2A17461E8A9C3A30FFF060CDA7B3A7835C3181A2659FE
SHA-512:	1CABF40B6662B11C6407D5B3DFFF758EF953C8754E8E1E14AC7E3FD649B4E10DCF8888AF6BBA35D29C5B28D373A39C8FD28B575CA91AC15A7C36791B4FC0676C
Malicious:	false
Reputation:	low
URL:	https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSigned
Preview:	<!DOCTYPE html>.<html lang="en">.<head ID="Head1">.<meta charset="utf-8" />.<title>Already Signed</title>.<meta name="viewport" content="width=device-width, initial-scale=1.0" />.<meta name="author" content="ETZ Timesheet Solutions (www.etztimesheetsolutions.co.uk)" />.<link href="/EtzWeb/Css/bootstrap.css" rel="stylesheet" />.<link href="https://fonts.googleapis.com/css?family=Open+Sans:400" rel="stylesheet" type="text/css">.<style type="text/css">.. body {.. font-family: 'Open Sans', sans-serif;.. font-weight: 400;.. color: #666;.. font-size: 18px;.. line-height: 150%;.. }.... a, a:hover, a:active, a:visited {.. color: #00C1D5;.. text-decoration: underline;.. }.... h1 {.. margin: 0 0 0.6em;.. font-size: 45px;.. font-weight: 400;.. letter-spacing: -2px;.. line-height: 120%;.. color: #333;.. }....

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	downloaded
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	low
URL:	https://ssl.google-analytics.com/ga.js
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 362 x 373, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	45601
Entropy (8bit):	7.991163263888932
Encrypted:	true
SSDEEP:	768:xvVEJt9/giCE1axZstTT2nGesjP/A4fMa3y1G7NunWqQT91nxoSVIPS7bn+YeH7E:xdUTCE1axZ7GRYgFi1guty9roS+PS7bt
MD5:	75A38FAB4C0056C8FCC5E3E35B177FB6
SHA1:	A915C4EF168A9F2226C9E5CA73252F9D0F82199A
SHA-256:	109182AF3E58897F7E4B4E637A366DA087D5BA18F4CC9CF6ED5215F2DACCC4BB
SHA-512:	FF3AC8F86B151A411BDE28E63938CBFD68024232FC67DBE550BDD1D5EEDADE0705CF73D5104FB82A3022BE08977799E4BABB0CBE849EF5C8DD4F1631DE1D7CC1
Malicious:	false
Reputation:	low
URL:	https://www.timesheetz.net/Static/images/Branding/error-page.png
Preview:	.PNG........IHDR...j...u......X......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....$.y&.gU{..o1....Cx...).$A..N.E.D.$J.+..P..joc....;.VRHZCI.(jehE.......f0..<o.w....l..TuW...rPxm..de~..a.sp.[.....o..p.[......<..Cws..h.g^..!9..I..:.......L.G./y..2...p%..{B.0.......9..Z..a..?.O....}f...........(.^:...w)y..Gw..y`.........Rv.$...' >;....j.6....=...U..E..z-..Kx......,.s...k..r.\Qo.6.........H.@VW....3k.3T.{.$..bb.E....BR..o.!....C.5.<_.n.y.....A.?Kh...)X.n...aOx.bJR.o..:.c..f....+...d.,.;.........s..8...._7s....x.[..\.m......O.x..Y.>o..0...g2....Y.?....k.A....a......xv...............7..]..>...}....'..d....<.mewp...c0..........}`..q......8..}'}#p!y.L..Ql......6aCK....i...:~7..wS........b.h..>oj;."{......... ..N..uNe../~N.../.a..#..........p19..#..#...J.+4%.S35.N..1..3..v..uu\|.x..8(..Ome....;..a....8...#..Vd&c..x..p.I.-*...=.b......[...h.1....~.?..^K....3.h....g..!.J.@..h....i\|..M...(l...Zxo.F.Q7[x...l..v.[:U

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65394)
Category:	downloaded
Size (bytes):	82674
Entropy (8bit):	5.15247930397309
Encrypted:	false
SSDEEP:	768:6IfIxI7/SInIgUWA2jIlcIrVqJPKII7OcJI3IyILJssAvJi+IEaI+I/x0:v/fA2rJ2Oc5Jsz0
MD5:	9D8C44E108A57D87EA32CBE24B45A9CA
SHA1:	6AA07A3923DE22C29ED4C9AA13A62C71BE855D17
SHA-256:	6A162A45E772AF6A807C46C6C9CCA06D5ADFC04AFA082CB129B1FA5391AE77F3
SHA-512:	AEFB8B8AFC577236BBE98EF4292A4C294D9F91298ECB921EECB360E935B3526E1465BB7F7AD1E6746C7F8565E5929299AFC4663B5D5D8A564F9826F1456C6A37
Malicious:	false
Reputation:	low
URL:	https://www.timesheetz.net/EtzWeb/Css/bootstrap.css
Preview:	/! Bootstrap v2.0.4.. Copyright 2012 Twitter, Inc.* Licensed under the Apache License v2.0.* http://www.apache.org/licenses/LICENSE-2.0.. Designed and built with all the love in the world @twitter by @mdo and @fat./article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block}audio,canvas,video{display:inline-block;display:inline;zoom:1}audio:not([controls]){display:none}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}#map_canvas img{max-width:none}button,input,select,textarea{margin:0;font-size:100%;vertical-align:middle}button,input{overflow:visible;line-height:normal}button::-moz-focus-inner,input::-moz-focus-inner{padding:0;bor

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	dropped
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	low
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 362 x 373, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	45601
Entropy (8bit):	7.991163263888932
Encrypted:	true
SSDEEP:	768:xvVEJt9/giCE1axZstTT2nGesjP/A4fMa3y1G7NunWqQT91nxoSVIPS7bn+YeH7E:xdUTCE1axZ7GRYgFi1guty9roS+PS7bt
MD5:	75A38FAB4C0056C8FCC5E3E35B177FB6
SHA1:	A915C4EF168A9F2226C9E5CA73252F9D0F82199A
SHA-256:	109182AF3E58897F7E4B4E637A366DA087D5BA18F4CC9CF6ED5215F2DACCC4BB
SHA-512:	FF3AC8F86B151A411BDE28E63938CBFD68024232FC67DBE550BDD1D5EEDADE0705CF73D5104FB82A3022BE08977799E4BABB0CBE849EF5C8DD4F1631DE1D7CC1
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...j...u......X......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....$.y&.gU{..o1....Cx...).$A..N.E.D.$J.+..P..joc....;.VRHZCI.(jehE.......f0..<o.w....l..TuW...rPxm..de~..a.sp.[.....o..p.[......<..Cws..h.g^..!9..I..:.......L.G./y..2...p%..{B.0.......9..Z..a..?.O....}f...........(.^:...w)y..Gw..y`.........Rv.$...' >;....j.6....=...U..E..z-..Kx......,.s...k..r.\Qo.6.........H.@VW....3k.3T.{.$..bb.E....BR..o.!....C.5.<_.n.y.....A.?Kh...)X.n...aOx.bJR.o..:.c..f....+...d.,.;.........s..8...._7s....x.[..\.m......O.x..Y.>o..0...g2....Y.?....k.A....a......xv...............7..]..>...}....'..d....<.mewp...c0..........}`..q......8..}'}#p!y.L..Ql......6aCK....i...:~7..wS........b.h..>oj;."{......... ..N..uNe../~N.../.a..#..........p19..#..#...J.+4%.S35.N..1..3..v..uu\|.x..8(..Ome....;..a....8...#..Vd&c..x..p.I.-*...=.b......[...h.1....~.?..^K....3.h....g..!.J.@..h....i\|..M...(l...Zxo.F.Q7[x...l..v.[:U

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	96705
Entropy (8bit):	5.228470338380378
Encrypted:	false
SSDEEP:	1536:EVpXOWPGHRGUvJEzxPNLgyLuG6XV3yV/QtJ+j1YeO4PFWYit:EVoWPGHRGUvJEzxOMQV3yV/ERaNWYit
MD5:	1DD63DE72CF1F702324245441844BE13
SHA1:	58A8BDCDCB398AF7DB424357DF70DF18E7B30E9D
SHA-256:	5201C813C37A4168CC5C20C701D4391FD0A55625F97EB9F263A74FB52B52FD0E
SHA-512:	532D1E907B433AB97785CF632D9637A957152BAF0BA57879C856CBAA469BFFECA22C4F99485679539944B27068D39E70F7D44282594F999142454DA57329A11B
Malicious:	false
Reputation:	low
URL:	https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Preview:	"use strict";var AI,Microsoft,__extends=this&&this.__extends\|\|function(){var i=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])};return function(e,t){function n(){this.constructor=e}i(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}}();function _endsWith(e,t){var n=e.length,i=n-t.length;return e.substring(0<=i?i:0,n)===t}!function(e){e.ApplicationInsights\|\|(e.ApplicationInsights={})}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){},(e.Telemetry\|\|(e.Telemetry={})).Base=t}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){this.ver=1,this.sampleRate=100,this.tags={}},(e.Telemetry\|\|(e.Telemetry={})).Envelope=t}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Context={})}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Co

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	96705
Entropy (8bit):	5.228470338380378
Encrypted:	false
SSDEEP:	1536:EVpXOWPGHRGUvJEzxPNLgyLuG6XV3yV/QtJ+j1YeO4PFWYit:EVoWPGHRGUvJEzxOMQV3yV/ERaNWYit
MD5:	1DD63DE72CF1F702324245441844BE13
SHA1:	58A8BDCDCB398AF7DB424357DF70DF18E7B30E9D
SHA-256:	5201C813C37A4168CC5C20C701D4391FD0A55625F97EB9F263A74FB52B52FD0E
SHA-512:	532D1E907B433AB97785CF632D9637A957152BAF0BA57879C856CBAA469BFFECA22C4F99485679539944B27068D39E70F7D44282594F999142454DA57329A11B
Malicious:	false
Reputation:	low
Preview:	"use strict";var AI,Microsoft,__extends=this&&this.__extends\|\|function(){var i=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])};return function(e,t){function n(){this.constructor=e}i(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}}();function _endsWith(e,t){var n=e.length,i=n-t.length;return e.substring(0<=i?i:0,n)===t}!function(e){e.ApplicationInsights\|\|(e.ApplicationInsights={})}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){},(e.Telemetry\|\|(e.Telemetry={})).Base=t}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){this.ver=1,this.sampleRate=100,this.tags={}},(e.Telemetry\|\|(e.Telemetry={})).Envelope=t}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Context={})}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Co

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	7.888481039029385
Encrypted:	false
SSDEEP:	48:7+lCXmsxnSTlnKNCXYL8Z/xQHb8ku6vNRJaD1/tsNErQj1:7+PTlKNC5JQ7zNRJ6Zt54
MD5:	7067FD3F2CDF4DA8858C5DD1695C8314
SHA1:	385BE7A93E70A5A6A44C5B4283DABFCBE11FE83B
SHA-256:	A93F734D47E37E634E7B24741867CD7A08EB62DCE5E7D4C55A93EFBB52322AE0
SHA-512:	7BFA149AA95D6A6CAAE5986185DFB12299C51D74E7EBFA974349EF6A57CEFF4EC6DB10451A9B24AEEB9850ECE8B65FF4C38B3BCEE3E9D92DF066F83069E9B2DC
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Wkl.W.>wfvg......N.G.&.m.$.....D.T..........@.B..@......m)R#..TU..U..E....6DJp.....S;Y?v...7.3k..MA...3w.=..\|..3...Q.......B....P.....,..T...k..p.e.y...PK.U...N..=..i..0.`.G..PLh..9.%!....\.~.F+[..&..=P....N....4'(.g.....X...=..x.B".^.....FB..5........X..oD0...{.:.:.bsfOg<{r ........m........w'..6V...E....F,2.p^...7i.>..4t..F.G...(..!...;...g.S....s,X..:........%........_...E.V..-{X....6..............^...<.2bD...+........\V=.;..2.[;V....~f...OGj..j)gX...h.!.5..F.^.....>5...e.U...8;zPS.W\..e..^......X......(......2DUI.a.t.<.c..3.^Il.@.../]>.x)....".i.#..#%1L........'..PT ...m.4.D.m.u.. p.q.~..-VJ.KoE8".D$.....O./..D}..,8.l.S.....g..B...((.X2.....-.D...I69....:U...x'=..>.YEM.3.._.>..`..........^.Vs....v..<g...s.]..SF.i..S.mPR.%...e..,.\|.P....40.X..K.._..:TU!T.;.vm.V..[-.N1.X9"J..,......o....Qs..+.A/N.......]].Q.....X...zd...<.G.....D\|.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 00:13:04.121871948 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.121893883 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.122013092 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.122193098 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.123310089 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.123332977 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.123393059 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.123936892 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.124007940 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.125561953 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.125873089 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.126590967 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.126651049 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.127011061 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.132270098 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.133335114 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.133368969 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.133981943 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.134466887 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.356173038 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.356234074 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.356251001 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.356296062 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.357374907 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.357391119 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.357439041 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.360227108 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.360282898 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.360824108 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.361066103 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.361520052 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.365534067 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.365653038 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.366111994 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.366399050 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.366827965 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.518553019 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.518579960 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.518809080 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.519107103 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.519364119 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.519424915 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.520931959 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.520996094 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.521058083 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.521723986 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.521759033 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.522417068 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.523294926 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.523819923 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.527220011 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.527232885 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.527878046 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.529604912 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.529618025 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.539925098 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 23, 2024 00:13:04.682539940 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.682559967 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.682693005 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.682723045 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.683094978 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.683104038 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.683151960 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.684309959 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.684385061 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.685388088 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.685446024 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.686089993 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.686947107 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.687388897 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.690736055 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.690784931 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.691384077 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.692244053 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.692697048 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.843997955 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.844010115 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.844017029 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.844024897 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.844129086 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.845783949 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.845796108 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.845875978 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.848180056 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.848329067 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.848933935 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.849097967 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.849670887 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:04.853617907 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.853631973 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.854279041 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.854475975 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:04.855065107 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.021246910 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.021261930 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.021271944 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.021480083 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.021528006 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.021621943 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.022646904 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.022948027 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.023013115 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.023355007 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.025598049 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.025943041 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.026180983 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.026540995 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.026725054 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.030993938 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.031302929 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.031404972 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.031869888 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.032430887 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.184431076 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.184444904 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.184523106 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.184696913 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.185914993 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.185925961 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.185997009 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.188710928 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.188913107 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.189198971 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.189457893 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.189927101 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.194524050 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.194534063 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.194542885 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.195187092 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.195348978 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.347373009 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.347409964 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.347517014 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.347819090 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.349555016 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.349584103 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.349639893 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.352755070 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.352880955 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.353909016 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.355077982 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.356015921 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.358124971 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.358181000 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.359195948 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.360435963 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.361390114 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.510902882 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.510997057 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.511039972 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.511171103 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.511614084 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.511673927 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.512916088 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.513360977 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.513416052 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.516618967 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.518548965 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.519689083 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.520831108 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.520996094 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.522044897 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.524235964 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.525095940 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.526355028 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.526428938 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.675606012 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.677222013 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.677381039 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.678406954 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.680110931 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.680124998 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.680197001 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.680237055 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.680294037 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.680457115 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.681117058 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.683839083 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.684648037 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.685604095 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.685792923 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.686438084 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.689373016 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.690062046 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.805613995 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 23, 2024 00:13:05.838644028 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.838655949 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.838835001 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.839178085 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.839943886 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.840022087 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.842107058 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.842187881 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.842535019 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.844048023 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.844084024 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.844093084 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.844115019 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.844219923 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.846128941 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.846244097 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:05.847600937 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.847675085 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.847795963 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.851418972 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:05.851547003 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.003468990 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.003494978 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.003505945 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.003519058 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.003654957 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.006688118 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.006762981 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.006828070 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.006906986 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.008105040 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.008163929 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.008374929 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.010225058 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.010483980 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.013793945 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.014039993 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.015888929 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.016043901 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.133778095 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 23, 2024 00:13:06.164951086 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:06.167064905 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.167114019 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.167201996 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.167290926 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.167849064 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.167912006 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.168994904 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.169153929 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.169203043 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.171329975 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.171379089 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.172054052 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.172420025 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.172844887 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.176824093 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.176938057 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.177484989 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.177814960 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.178194046 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.330678940 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.330699921 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.330831051 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.330984116 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.332065105 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.332115889 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.332129002 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.332429886 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.332479954 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.334867001 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.334917068 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.335890055 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.335973024 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.336628914 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.340193987 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.340313911 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.341155052 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.341294050 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.344711065 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.498739958 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.498761892 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.498770952 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.498825073 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.499690056 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.499744892 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.499953985 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.499967098 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.499975920 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.500014067 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.501977921 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.502046108 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.502135992 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.502208948 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.502247095 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.502613068 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.502783060 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.505013943 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.505410910 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.505711079 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.508502960 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.510380030 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.510656118 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.511337042 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.539901972 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:06.664134026 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.664181948 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.664243937 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.664259911 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.664530039 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.664580107 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.665780067 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.665868998 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.665920973 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.670011044 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.670094013 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.670695066 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.674392939 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.675501108 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.676215887 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.680188894 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.828113079 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.828135014 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.828196049 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.828900099 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.828923941 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.828970909 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:06.845149040 CEST	443	49704	13.107.253.45	192.168.2.8
Oct 23, 2024 00:13:06.899239063 CEST	49704	443	192.168.2.8	13.107.253.45
Oct 23, 2024 00:13:14.281374931 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 23, 2024 00:13:15.524900913 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:15.524946928 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:15.525027037 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:15.525232077 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:15.525243044 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:15.767179966 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:16.142333031 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:16.152456999 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.199853897 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.267919064 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.267946005 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.269201994 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.269268990 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.287199974 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.287360907 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.287369013 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.335329056 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.335463047 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.335489035 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.382077932 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.581017971 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.581125021 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.581819057 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.581819057 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.584794044 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.584830999 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.584912062 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.585141897 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.585158110 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:16.765322924 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 23, 2024 00:13:16.892966032 CEST	49711	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:16.892982006 CEST	443	49711	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.195847034 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.196127892 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.196141958 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.196460009 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.196924925 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.196974993 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.197228909 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.243335962 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.652725935 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:17.652774096 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:17.652944088 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:17.653148890 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:17.653162956 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:17.713403940 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.713515043 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.713771105 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.715677977 CEST	49714	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.715703964 CEST	443	49714	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.716522932 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.716563940 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.716640949 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.716881037 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:17.716897011 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:17.950051069 CEST	443	49705	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:17.950154066 CEST	49705	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:18.339811087 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.340667009 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.340698957 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.341072083 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.343801022 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.343902111 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.343939066 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.387329102 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.393229008 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.501354933 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.501590014 CEST	443	49716	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.501702070 CEST	49716	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.507320881 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.507369995 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.507457972 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.507636070 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:18.507652044 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:18.513917923 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:18.513951063 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:18.514022112 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:18.514215946 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:18.514229059 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:18.523293972 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:18.523538113 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:18.523565054 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:18.524609089 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:18.524691105 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:18.525664091 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:18.525729895 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:18.528220892 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:18.528259039 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:18.528342962 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:18.530244112 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:18.530261993 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:18.580450058 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:18.580476046 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:18.627221107 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:19.123996973 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.124320030 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.124349117 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.125437021 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.125499964 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.125874996 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.125946999 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.126099110 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.126111984 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.131793976 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.132181883 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.132200003 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.133436918 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.133500099 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.134903908 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.134990931 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.135122061 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.135134935 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.173737049 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.189601898 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.279891014 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.280324936 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.280405045 CEST	443	49718	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.280478001 CEST	49718	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.281390905 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.281445026 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.281528950 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.281774998 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.281788111 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.384622097 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.384701967 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.389014006 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.389038086 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.389445066 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.439340115 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.447793007 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.495341063 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.603082895 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.603182077 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.603825092 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.603856087 CEST	443	49717	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.603867054 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.603905916 CEST	49717	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.606072903 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.606159925 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.606261015 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.606538057 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:19.606571913 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:19.888719082 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.888793945 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.888863087 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.889055967 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.889070034 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.889096022 CEST	49719	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.889102936 CEST	443	49719	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.900336027 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.900641918 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.900666952 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.901864052 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.901938915 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.902373075 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.902441978 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.902595997 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:19.902604103 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:19.953037024 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.953080893 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.953311920 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.953706980 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:19.953718901 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:19.956208944 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:20.048592091 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:20.049179077 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:20.049231052 CEST	443	49720	35.190.80.1	192.168.2.8
Oct 23, 2024 00:13:20.049376011 CEST	49720	443	192.168.2.8	35.190.80.1
Oct 23, 2024 00:13:20.223169088 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.224158049 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.224196911 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.225342989 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.225792885 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.225984097 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.226057053 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.267344952 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.744072914 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.744398117 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.744504929 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.752976894 CEST	49721	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.753002882 CEST	443	49721	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.755449057 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.755472898 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.755697966 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.756222963 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:20.756254911 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:20.794904947 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:20.794995070 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:20.796657085 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:20.796668053 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:20.797007084 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:20.798631907 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:20.839337111 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:21.041970015 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:21.042048931 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:21.042975903 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:21.047020912 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:21.047041893 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:21.047053099 CEST	49722	443	192.168.2.8	184.28.90.27
Oct 23, 2024 00:13:21.047059059 CEST	443	49722	184.28.90.27	192.168.2.8
Oct 23, 2024 00:13:21.362215996 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.362643957 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.362654924 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.363018990 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.363467932 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.363517046 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.363722086 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.407336950 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.410274029 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.853367090 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.853416920 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.853445053 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.853492975 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.853508949 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.853549957 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.853554010 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.853600025 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.855293989 CEST	49723	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.855309010 CEST	443	49723	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.918710947 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.918744087 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:21.918845892 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.919965982 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:21.919979095 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:22.542049885 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:22.547435045 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:22.547462940 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:22.547889948 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:22.591077089 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.017007113 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.017242908 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.020205021 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.063347101 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165132999 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165201902 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165250063 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165273905 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.165302992 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165345907 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.165352106 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165582895 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165630102 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.165635109 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165821075 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.165864944 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.165868998 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.218856096 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.218864918 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.267333031 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.281795979 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.281887054 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.281917095 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.281932116 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.281944990 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.281980991 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.282706022 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.282753944 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.282780886 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.282788992 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.282793999 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.282835007 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.283447981 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.283484936 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.283509970 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.283525944 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.283529997 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.283570051 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.283572912 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284389019 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284421921 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284446955 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.284451008 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284475088 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284495115 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.284498930 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.284539938 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.285243988 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.285535097 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.285582066 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.285587072 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.330003023 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.399167061 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399229050 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399255991 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399276018 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.399311066 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399358988 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.399363995 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399394989 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399425983 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.399425983 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399436951 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.399466991 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.399471998 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.400121927 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.400163889 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.400167942 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.400181055 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.400226116 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.400229931 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.400263071 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.400994062 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.401036978 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.401041031 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.401139021 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.401966095 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.402012110 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.402858019 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.402887106 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.402901888 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.402906895 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.402942896 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.402961016 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.403004885 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.404584885 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.404633045 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.404637098 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.404664993 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.404706001 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.405675888 CEST	49724	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.405690908 CEST	443	49724	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.477684975 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.477734089 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:23.477788925 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.478919029 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:23.478934050 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.107542038 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.107815981 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.107851982 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.108165979 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.108553886 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.108613014 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.108736992 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.151338100 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267728090 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267771959 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267796040 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267819881 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.267827034 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267837048 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.267872095 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.267882109 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.268004894 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.268450022 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.268491983 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.268516064 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.268717051 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.268724918 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.268773079 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.386562109 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.386742115 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.386766911 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.386791945 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.386818886 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.386862993 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.387187958 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.387229919 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.387262106 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.387284994 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.387294054 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.387509108 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.388081074 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388151884 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388195992 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.388204098 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388824940 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388850927 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388879061 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.388881922 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388890982 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.388926029 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.388935089 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.389070988 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.389828920 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.389868021 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.389894962 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.390074968 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.390083075 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.390302896 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.390733957 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.445111036 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.505904913 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.505944014 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.505965948 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.506016016 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.506038904 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.506052971 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.506103992 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.506467104 CEST	49728	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:24.506486893 CEST	443	49728	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:24.684403896 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:24.684422016 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:24.684504032 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:24.685115099 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:24.685126066 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.159657001 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:25.159770966 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:25.159893990 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:25.301765919 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.349756956 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.349781036 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.351022005 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.351169109 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.364640951 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.364770889 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.364824057 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.407337904 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.409852982 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.409893036 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.455921888 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.509016037 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:25.509059906 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:25.515829086 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515871048 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515896082 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515922070 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515943050 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515945911 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.515973091 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.515985966 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.516088009 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.516288042 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.516338110 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.516371012 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.516381025 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.564836979 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.564846992 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.609669924 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.632992983 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633205891 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633287907 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.633304119 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633654118 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633690119 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633711100 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.633722067 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.633857965 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.634428978 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.634490967 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.634619951 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.634625912 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635107994 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635169983 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.635174990 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635775089 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635808945 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635838032 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.635843039 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.635915995 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.636564016 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.636647940 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.636696100 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.636701107 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.637381077 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.637432098 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.637437105 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.638312101 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.638372898 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.638380051 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.689927101 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.750375986 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.750442028 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.750499010 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.750526905 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.750541925 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.750577927 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:25.750579119 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.750658989 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.787055969 CEST	49731	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:25.787081957 CEST	443	49731	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:26.371596098 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:26.371680975 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:26.417171955 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:26.417237997 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:26.418209076 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:26.470695972 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.038049936 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.038113117 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.038184881 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.039172888 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.039200068 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.272031069 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.315334082 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557214975 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557243109 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557250977 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557281971 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557296991 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557307959 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557327986 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.557363033 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.557385921 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.557579041 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.559075117 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.559151888 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.559165001 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.559181929 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.559231997 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.612354040 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.612389088 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.612406015 CEST	49732	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:13:27.612412930 CEST	443	49732	20.12.23.50	192.168.2.8
Oct 23, 2024 00:13:27.654989004 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.655778885 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.655795097 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.656354904 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.657536983 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.657625914 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:27.657762051 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:27.703321934 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:28.162209988 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:28.162271976 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:28.162370920 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:28.162404060 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:28.162421942 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:28.163618088 CEST	49738	443	192.168.2.8	172.67.69.202
Oct 23, 2024 00:13:28.163630962 CEST	443	49738	172.67.69.202	192.168.2.8
Oct 23, 2024 00:13:28.241787910 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.241835117 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.241897106 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.242114067 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.242129087 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.528386116 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:28.528450966 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:28.528496027 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:28.538772106 CEST	49715	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:13:28.538808107 CEST	443	49715	216.58.206.68	192.168.2.8
Oct 23, 2024 00:13:28.851460934 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.852493048 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.852524996 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.852859020 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.853296995 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.853367090 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:28.856754065 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:28.899327040 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.005328894 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.005374908 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.005429983 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:29.005445957 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.005496979 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.005603075 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:29.008186102 CEST	49741	443	192.168.2.8	104.26.11.58
Oct 23, 2024 00:13:29.008204937 CEST	443	49741	104.26.11.58	192.168.2.8
Oct 23, 2024 00:13:29.112323999 CEST	49705	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:29.112421036 CEST	49705	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:29.114670038 CEST	49744	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:29.114707947 CEST	443	49744	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:29.118567944 CEST	49744	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:29.118567944 CEST	49744	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:29.118599892 CEST	443	49744	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:29.119688988 CEST	443	49705	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:29.119702101 CEST	443	49705	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:29.135447979 CEST	53541	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.142878056 CEST	53	53541	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:29.142942905 CEST	53541	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.143023014 CEST	53541	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.150356054 CEST	53	53541	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:29.742868900 CEST	53	53541	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:29.743643999 CEST	53541	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.751240015 CEST	53	53541	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:29.751297951 CEST	53541	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.806541920 CEST	443	49744	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:29.806624889 CEST	49744	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:49.005147934 CEST	443	49744	23.206.229.226	192.168.2.8
Oct 23, 2024 00:13:49.005213022 CEST	49744	443	192.168.2.8	23.206.229.226
Oct 23, 2024 00:13:55.782507896 CEST	49703	80	192.168.2.8	87.248.204.0
Oct 23, 2024 00:13:55.788374901 CEST	80	49703	87.248.204.0	192.168.2.8
Oct 23, 2024 00:13:55.788434982 CEST	49703	80	192.168.2.8	87.248.204.0
Oct 23, 2024 00:14:05.929411888 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:05.929464102 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:05.929534912 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:05.930850029 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:05.930860043 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:06.791563034 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:06.791650057 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:06.793252945 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:06.793263912 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:06.793847084 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:06.795479059 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:06.839332104 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.079133987 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.079183102 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.079197884 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.079279900 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.079319954 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.079340935 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.079371929 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.081304073 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.081348896 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.081382036 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.081387997 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.081409931 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.081432104 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.081456900 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.084101915 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.084120989 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:07.084131002 CEST	53543	443	192.168.2.8	20.12.23.50
Oct 23, 2024 00:14:07.084136963 CEST	443	53543	20.12.23.50	192.168.2.8
Oct 23, 2024 00:14:15.809628963 CEST	60155	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:14:15.816903114 CEST	53	60155	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:15.818957090 CEST	60155	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:14:15.819104910 CEST	60155	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:14:15.825932980 CEST	53	60155	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:16.425532103 CEST	53	60155	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:16.434778929 CEST	60155	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:14:16.442145109 CEST	53	60155	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:16.442363024 CEST	60155	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:14:17.888001919 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:17.888077021 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:17.888309956 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:17.891016960 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:17.891051054 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:18.747338057 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:18.747724056 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:18.747752905 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:18.748107910 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:18.748631001 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:18.748688936 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:18.798505068 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:28.754472017 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:28.754549026 CEST	443	60157	216.58.206.68	192.168.2.8
Oct 23, 2024 00:14:28.754729986 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:30.127666950 CEST	60157	443	192.168.2.8	216.58.206.68
Oct 23, 2024 00:14:30.127687931 CEST	443	60157	216.58.206.68	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 00:13:13.929586887 CEST	53	52822	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:13.945375919 CEST	53	55958	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:15.176773071 CEST	53	49561	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:15.493110895 CEST	53868	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:15.495455980 CEST	61348	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:15.500644922 CEST	61156	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:15.500854015 CEST	58451	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:15.508861065 CEST	53	53868	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:15.510540009 CEST	53	61348	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:15.512140989 CEST	53	61156	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:15.659348011 CEST	53	58451	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:17.643944025 CEST	51058	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:17.644138098 CEST	52618	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:17.651269913 CEST	53	51058	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:17.651392937 CEST	53	52618	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:18.503370047 CEST	65056	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:18.503592968 CEST	56044	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:18.512587070 CEST	53	65056	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:18.513272047 CEST	53	56044	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:21.928169012 CEST	53	58657	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:23.486484051 CEST	53	59628	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:24.639527082 CEST	50034	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:24.640161037 CEST	58468	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:24.657465935 CEST	53	58468	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:24.683480978 CEST	53	50034	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:25.573118925 CEST	53	61704	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:26.887648106 CEST	51216	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:26.887842894 CEST	63096	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.135052919 CEST	53	60968	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:29.926734924 CEST	57135	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:29.926940918 CEST	54426	53	192.168.2.8	1.1.1.1
Oct 23, 2024 00:13:32.261559010 CEST	53	55606	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:50.993952990 CEST	53	56348	1.1.1.1	192.168.2.8
Oct 23, 2024 00:13:54.964627028 CEST	138	138	192.168.2.8	192.168.2.255
Oct 23, 2024 00:14:13.032747984 CEST	53	52334	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:13.823713064 CEST	53	61003	1.1.1.1	192.168.2.8
Oct 23, 2024 00:14:15.808389902 CEST	53	54947	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 23, 2024 00:13:15.659434080 CEST	192.168.2.8	1.1.1.1	c246	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 00:13:15.493110895 CEST	192.168.2.8	1.1.1.1	0xb0ad	Standard query (0)	www.timesheetz.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.495455980 CEST	192.168.2.8	1.1.1.1	0xa486	Standard query (0)	www.timesheetz.net	65	IN (0x0001)	false
Oct 23, 2024 00:13:15.500644922 CEST	192.168.2.8	1.1.1.1	0x81f	Standard query (0)	www.timesheetz.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.500854015 CEST	192.168.2.8	1.1.1.1	0x5f17	Standard query (0)	www.timesheetz.net	65	IN (0x0001)	false
Oct 23, 2024 00:13:17.643944025 CEST	192.168.2.8	1.1.1.1	0x3b95	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:17.644138098 CEST	192.168.2.8	1.1.1.1	0x4efe	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 23, 2024 00:13:18.503370047 CEST	192.168.2.8	1.1.1.1	0x300d	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:18.503592968 CEST	192.168.2.8	1.1.1.1	0xd08	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 23, 2024 00:13:24.639527082 CEST	192.168.2.8	1.1.1.1	0x826d	Standard query (0)	www.timesheetz.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:24.640161037 CEST	192.168.2.8	1.1.1.1	0x5ef2	Standard query (0)	www.timesheetz.net	65	IN (0x0001)	false
Oct 23, 2024 00:13:26.887648106 CEST	192.168.2.8	1.1.1.1	0x83f8	Standard query (0)	dc.services.visualstudio.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:26.887842894 CEST	192.168.2.8	1.1.1.1	0xaeec	Standard query (0)	dc.services.visualstudio.com	65	IN (0x0001)	false
Oct 23, 2024 00:13:29.926734924 CEST	192.168.2.8	1.1.1.1	0x17dc	Standard query (0)	dc.services.visualstudio.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:29.926940918 CEST	192.168.2.8	1.1.1.1	0xd0cc	Standard query (0)	dc.services.visualstudio.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 00:13:15.508861065 CEST	1.1.1.1	192.168.2.8	0xb0ad	No error (0)	www.timesheetz.net		104.26.10.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.508861065 CEST	1.1.1.1	192.168.2.8	0xb0ad	No error (0)	www.timesheetz.net		172.67.69.202	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.508861065 CEST	1.1.1.1	192.168.2.8	0xb0ad	No error (0)	www.timesheetz.net		104.26.11.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.510540009 CEST	1.1.1.1	192.168.2.8	0xa486	No error (0)	www.timesheetz.net			65	IN (0x0001)	false
Oct 23, 2024 00:13:15.512140989 CEST	1.1.1.1	192.168.2.8	0x81f	No error (0)	www.timesheetz.net		172.67.69.202	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.512140989 CEST	1.1.1.1	192.168.2.8	0x81f	No error (0)	www.timesheetz.net		104.26.11.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.512140989 CEST	1.1.1.1	192.168.2.8	0x81f	No error (0)	www.timesheetz.net		104.26.10.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:15.659348011 CEST	1.1.1.1	192.168.2.8	0x5f17	No error (0)	www.timesheetz.net			65	IN (0x0001)	false
Oct 23, 2024 00:13:17.651269913 CEST	1.1.1.1	192.168.2.8	0x3b95	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:17.651392937 CEST	1.1.1.1	192.168.2.8	0x4efe	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 23, 2024 00:13:18.512587070 CEST	1.1.1.1	192.168.2.8	0x300d	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:24.657465935 CEST	1.1.1.1	192.168.2.8	0x5ef2	No error (0)	www.timesheetz.net			65	IN (0x0001)	false
Oct 23, 2024 00:13:24.683480978 CEST	1.1.1.1	192.168.2.8	0x826d	No error (0)	www.timesheetz.net		104.26.11.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:24.683480978 CEST	1.1.1.1	192.168.2.8	0x826d	No error (0)	www.timesheetz.net		172.67.69.202	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:24.683480978 CEST	1.1.1.1	192.168.2.8	0x826d	No error (0)	www.timesheetz.net		104.26.10.58	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:26.898134947 CEST	1.1.1.1	192.168.2.8	0x83f8	No error (0)	dc.services.visualstudio.com	dc.applicationinsights.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.898134947 CEST	1.1.1.1	192.168.2.8	0x83f8	No error (0)	dc.applicationinsights.azure.com	global.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.898134947 CEST	1.1.1.1	192.168.2.8	0x83f8	No error (0)	global.in.ai.monitor.azure.com	global.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.898134947 CEST	1.1.1.1	192.168.2.8	0x83f8	No error (0)	global.in.ai.privatelink.monitor.azure.com	dc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.898134947 CEST	1.1.1.1	192.168.2.8	0x83f8	No error (0)	westeurope-global.in.applicationinsights.azure.com	gig-ai-prod-westeurope-global.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.948389053 CEST	1.1.1.1	192.168.2.8	0xaeec	No error (0)	dc.services.visualstudio.com	dc.applicationinsights.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.948389053 CEST	1.1.1.1	192.168.2.8	0xaeec	No error (0)	dc.applicationinsights.azure.com	global.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.948389053 CEST	1.1.1.1	192.168.2.8	0xaeec	No error (0)	global.in.ai.monitor.azure.com	global.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.948389053 CEST	1.1.1.1	192.168.2.8	0xaeec	No error (0)	global.in.ai.privatelink.monitor.azure.com	dc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:26.948389053 CEST	1.1.1.1	192.168.2.8	0xaeec	No error (0)	westeurope-global.in.applicationinsights.azure.com	gig-ai-prod-westeurope-global.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:27.627008915 CEST	1.1.1.1	192.168.2.8	0x8788	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:27.627008915 CEST	1.1.1.1	192.168.2.8	0x8788	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934917927 CEST	1.1.1.1	192.168.2.8	0x17dc	No error (0)	dc.services.visualstudio.com	dc.applicationinsights.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934917927 CEST	1.1.1.1	192.168.2.8	0x17dc	No error (0)	dc.applicationinsights.azure.com	global.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934917927 CEST	1.1.1.1	192.168.2.8	0x17dc	No error (0)	global.in.ai.monitor.azure.com	global.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934917927 CEST	1.1.1.1	192.168.2.8	0x17dc	No error (0)	global.in.ai.privatelink.monitor.azure.com	dc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934917927 CEST	1.1.1.1	192.168.2.8	0x17dc	No error (0)	westeurope-global.in.applicationinsights.azure.com	gig-ai-prod-westeurope-global.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934998035 CEST	1.1.1.1	192.168.2.8	0xd0cc	No error (0)	dc.services.visualstudio.com	dc.applicationinsights.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934998035 CEST	1.1.1.1	192.168.2.8	0xd0cc	No error (0)	dc.applicationinsights.azure.com	global.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934998035 CEST	1.1.1.1	192.168.2.8	0xd0cc	No error (0)	global.in.ai.monitor.azure.com	global.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934998035 CEST	1.1.1.1	192.168.2.8	0xd0cc	No error (0)	global.in.ai.privatelink.monitor.azure.com	dc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 00:13:29.934998035 CEST	1.1.1.1	192.168.2.8	0xd0cc	No error (0)	westeurope-global.in.applicationinsights.azure.com	gig-ai-prod-westeurope-global.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.timesheetz.net

a.nel.cloudflare.com

fs.microsoft.com

https:

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:16 UTC	680	OUT	GET /EtzWeb/u/015bcc8ebe HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 22:13:16 UTC	1147	IN	HTTP/1.1 302 Found Date: Tue, 22 Oct 2024 22:13:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; Path=/; SameSite=None; Secure Set-Cookie: ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; Path=/ Set-Cookie: ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj; path=/; HttpOnly; SameSite=Lax Cache-Control: private location: https://www.timesheetz.net/EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 x-aspnetmvc-version: 5.2 x-aspnet-version: 4.0.30319 request-context: appId=cid-v1:d1f3bff8-463d-4a3f-a072-0c81d02ba231 access-control-expose-headers: Request-Context x-powered-by: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IpGdNMCw%2Bnv3ZM7NrTLSEI1k%2FJ%2FBmkk3bkV3bV2fB3p2q6UlgE%2FjfzzX6KRJ6dJtgtphC%2B57hLwlXNHfPL7zKAs2Vy6FSag5mdL%2FDIOiBZ%2F14%2B9CV3DhEWwBAsVVjr0cL3N9nQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd5693cba6b23-DFW
2024-10-22 22:13:16 UTC	197	IN	Data Raw: 62 66 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 69 6d 65 73 68 65 65 74 7a 2e 6e 65 74 2f 45 74 7a 57 65 62 2f 73 2f 33 35 30 38 33 32 33 36 2f 37 66 36 38 64 35 61 61 30 34 33 63 34 30 30 62 61 62 64 34 31 66 36 32 62 37 37 34 66 64 36 34 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: bf<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.timesheetz.net/EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64">here</a>.</h2></body></html>
2024-10-22 22:13:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:17 UTC	889	OUT	GET /EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:17 UTC	942	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 22 Oct 2024 22:13:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: public, no-store, max-age=0 expires: Tue, 22 Oct 2024 22:13:17 GMT last-modified: Tue, 22 Oct 2024 22:13:17 GMT location: /EtzWeb/Error/AlreadyEtzSigned vary: * x-aspnetmvc-version: 5.2 x-aspnet-version: 4.0.30319 request-context: appId=cid-v1:d1f3bff8-463d-4a3f-a072-0c81d02ba231 access-control-expose-headers: Request-Context x-powered-by: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qrM0O3VTNCHveizXbj1pSPe94v8rsXg6uTinvaMWs0XP9ipPaBF3le6wFvXuHDCLc5wf3f8tKeNwfI%2F%2BrCxwgiFGsqVzAvU3Wfw2%2FwYtq8u2bhxx4IiAb54b0WPwbi5xyn%2Bx3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd56eed034740-DFW
2024-10-22 22:13:17 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 45 74 7a 57 65 62 2f 45 72 72 6f 72 2f 41 6c 72 65 61 64 79 45 74 7a 53 69 67 6e 65 64 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/EtzWeb/Error/AlreadyEtzSigned">here</a>.</h2></body></html>
2024-10-22 22:13:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:18 UTC	868	OUT	GET /EtzWeb/Error/AlreadyEtzSigned HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49717	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:19 UTC	858	OUT	GET /EtzWeb/u/015bcc8ebe HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:19 UTC	860	IN	HTTP/1.1 302 Found Date: Tue, 22 Oct 2024 22:13:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private location: https://www.timesheetz.net/EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 x-aspnetmvc-version: 5.2 x-aspnet-version: 4.0.30319 request-context: appId=cid-v1:d1f3bff8-463d-4a3f-a072-0c81d02ba231 access-control-expose-headers: Request-Context x-powered-by: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qa2NiurA7Y%2FpiytmymHnyE8YTJCNKAS65z3V1ZIojJ7opW0OQJjgws8KHiNA1hYsVmNC5Une38i%2BLugeotSPH1TjrjXKuCggVEskLyXZoyFqUbi4sn%2F3HykcEFHByIw37pv4bA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd57b0f7d2cbe-DFW
2024-10-22 22:13:19 UTC	197	IN	Data Raw: 62 66 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 69 6d 65 73 68 65 65 74 7a 2e 6e 65 74 2f 45 74 7a 57 65 62 2f 73 2f 33 35 30 38 33 32 33 36 2f 37 66 36 38 64 35 61 61 30 34 33 63 34 30 30 62 61 62 64 34 31 66 36 32 62 37 37 34 66 64 36 34 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: bf<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.timesheetz.net/EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64">here</a>.</h2></body></html>
2024-10-22 22:13:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49718	35.190.80.1	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:19 UTC	547	OUT	OPTIONS /report/v4?s=qrM0O3VTNCHveizXbj1pSPe94v8rsXg6uTinvaMWs0XP9ipPaBF3le6wFvXuHDCLc5wf3f8tKeNwfI%2F%2BrCxwgiFGsqVzAvU3Wfw2%2FwYtq8u2bhxx4IiAb54b0WPwbi5xyn%2Bx3g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.timesheetz.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 22:13:19 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Tue, 22 Oct 2024 22:13:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-22 22:13:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=153173 Date: Tue, 22 Oct 2024 22:13:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49720	35.190.80.1	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:19 UTC	486	OUT	POST /report/v4?s=qrM0O3VTNCHveizXbj1pSPe94v8rsXg6uTinvaMWs0XP9ipPaBF3le6wFvXuHDCLc5wf3f8tKeNwfI%2F%2BrCxwgiFGsqVzAvU3Wfw2%2FwYtq8u2bhxx4IiAb54b0WPwbi5xyn%2Bx3g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 414 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 22:13:19 UTC	414	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 38 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 36 39 2e 32 30 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 69 6d 65 73 68 65 65 74 7a 2e 6e 65 74 2f Data Ascii: [{"age":1,"body":{"elapsed_time":785,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.69.202","status_code":0,"type":"abandoned"},"type":"network-error","url":"https://www.timesheetz.net/
2024-10-22 22:13:20 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 22 Oct 2024 22:13:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49721	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:20 UTC	889	OUT	GET /EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:20 UTC	944	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 22 Oct 2024 22:13:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: public, no-store, max-age=0 expires: Tue, 22 Oct 2024 22:13:20 GMT last-modified: Tue, 22 Oct 2024 22:13:20 GMT location: /EtzWeb/Error/AlreadyEtzSigned vary: * x-aspnetmvc-version: 5.2 x-aspnet-version: 4.0.30319 request-context: appId=cid-v1:d1f3bff8-463d-4a3f-a072-0c81d02ba231 access-control-expose-headers: Request-Context x-powered-by: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mo3W%2FLKVua%2BiTOsvJKwkAyuVzAOqydJV%2BjYrTTCJ1slLdkwlNBt%2BH2C4QTl0rqcih26w5byzEA08tGar9ijgNq9Cz4QqWx79hPXwA85v1AxTD89o1d%2F1OnK3L6RTdeSxaUnJOg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd581d81b2e61-DFW
2024-10-22 22:13:20 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 45 74 7a 57 65 62 2f 45 72 72 6f 72 2f 41 6c 72 65 61 64 79 45 74 7a 53 69 67 6e 65 64 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/EtzWeb/Error/AlreadyEtzSigned">here</a>.</h2></body></html>
2024-10-22 22:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49722	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-22 22:13:21 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=153141 Date: Tue, 22 Oct 2024 22:13:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-22 22:13:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49723	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:21 UTC	868	OUT	GET /EtzWeb/Error/AlreadyEtzSigned HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:21 UTC	793	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private vary: Accept-Encoding x-aspnetmvc-version: 5.2 x-aspnet-version: 4.0.30319 request-context: appId=cid-v1:d1f3bff8-463d-4a3f-a072-0c81d02ba231 access-control-expose-headers: Request-Context x-powered-by: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WEMFZKz%2FUCpUvptvS%2FXxM6IKKYZx83VvYPBS%2BcFKCDUCCwdfB3oSf7wVNJ3gDgmwlZXqAgYPYB3uVBntwRU73tua4QCUNSY6iWVblaGL%2BRQuFOQkvwuMGtukD7DrQ1yKbqX7WA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd588f846e5f2-DFW
2024-10-22 22:13:21 UTC	576	IN	Data Raw: 65 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 49 44 3d 22 48 65 61 64 31 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 41 6c 72 65 61 64 79 20 53 69 67 6e 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 54 5a 20 54 69 6d 65 73 68 65 65 74 20 53 6f 6c 75 74 69 6f 6e 73 20 28 77 77 77 2e 65 74 7a 74 69 6d 65 73 68 65 65 74 73 Data Ascii: e5a<!DOCTYPE html><html lang="en"><head ID="Head1"><meta charset="utf-8" /><title>Already Signed</title><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="author" content="ETZ Timesheet Solutions (www.etztimesheets
2024-10-22 22:13:21 UTC	1369	IN	Data Raw: 20 23 36 36 36 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 61 2c 20 61 3a 68 6f 76 65 72 2c 20 61 3a 61 63 74 69 76 65 2c 20 61 3a 76 69 73 69 74 65 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 43 31 44 35 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 30 2e 36 65 6d 3b 0d 0a Data Ascii: #666; font-size: 18px; line-height: 150%; } a, a:hover, a:active, a:visited { color: #00C1D5; text-decoration: underline; } h1 { margin: 0 0 0.6em;
2024-10-22 22:13:21 UTC	1369	IN	Data Raw: 61 74 65 45 6c 65 6d 65 6e 74 28 65 29 2c 20 69 2c 20 75 3b 20 66 6f 72 20 28 6f 2e 73 72 63 20 3d 20 63 6f 6e 66 69 67 2e 75 72 6c 20 7c 7c 20 22 2f 2f 61 7a 34 31 36 34 32 36 2e 76 6f 2e 6d 73 65 63 6e 64 2e 6e 65 74 2f 73 63 72 69 70 74 73 2f 61 2f 61 69 2e 30 2e 6a 73 22 2c 20 72 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 65 29 5b 30 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 29 2c 20 74 2e 63 6f 6f 6b 69 65 20 3d 20 72 2e 63 6f 6f 6b 69 65 2c 20 74 2e 71 75 65 75 65 20 3d 20 5b 5d 2c 20 69 20 3d 20 5b 22 45 76 65 6e 74 22 2c 20 22 45 78 63 65 70 74 69 6f 6e 22 2c 20 22 4d 65 74 72 69 63 22 2c 20 22 50 61 67 65 56 69 65 77 22 2c 20 22 54 72 61 63 65 22 5d 3b 20 69 2e 6c 65 6e 67 74 68 3b 29 20 Data Ascii: ateElement(e), i, u; for (o.src = config.url \|\| "//az416426.vo.msecnd.net/scripts/a/ai.0.js", r.getElementsByTagName(e)[0].parentNode.appendChild(o), t.cookie = r.cookie, t.queue = [], i = ["Event", "Exception", "Metric", "PageView", "Trace"]; i.length;)
2024-10-22 22:13:21 UTC	367	IN	Data Raw: 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 09 20 20 20 20 20 20 20 20 2f 2f 20 63 75 73 74 6f 6d 20 67 6f 6f 67 6c 65 20 74 72 61 63 6b 65 72 20 65 76 65 6e 74 0d 0a 09 20 20 20 20 20 20 20 20 76 61 72 20 70 6c 65 6e 64 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 09 20 20 20 20 20 20 20 20 76 61 72 20 70 6c 6c 6f 61 64 20 3d 20 70 6c 65 6e 64 2e 67 65 74 54 69 6d 65 28 29 20 2d 20 70 6c 73 74 61 72 74 2e 67 65 74 54 69 6d 65 28 29 3b 0d 0a 09 20 20 20 20 20 20 20 20 76 61 72 20 75 73 65 72 20 3d 20 22 55 6e 6b 6e 6f 77 6e 22 3b 0d 0a 09 20 20 20 20 20 20 20 20 76 61 72 20 66 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 3b 0d 0a 09 20 20 20 20 20 20 20 20 5f 67 61 71 2e 70 75 73 68 28 5b 27 5f 74 72 61 63 6b 45 76 Data Ascii: ction () { // custom google tracker event var plend = new Date(); var plload = plend.getTime() - plstart.getTime(); var user = "Unknown"; var fn = document.location.pathname; _gaq.push(['_trackEv
2024-10-22 22:13:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49724	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:23 UTC	766	OUT	GET /EtzWeb/Css/bootstrap.css HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSigned Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:23 UTC	724	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:23 GMT Content-Type: text/css Content-Length: 82674 Connection: close Cf-Bgj: minify Cf-Polished: origSize=104863 etag: "06032bb6e9fd91:0" last-modified: Thu, 15 Jun 2023 09:49:52 GMT vary: Accept-Encoding x-powered-by: ASP.NET CF-Cache-Status: HIT Age: 1306 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BDClUWkU92TYGill6qvxF98wujpbrQgbVahoP3XnwNbCQoa%2F%2F0INZHX6ZmSsFw2SIzXjFKA7MDNxW2N40dyPc%2B4YsTN2bdZtMkFBcH9tdtBvq6a0lkas6pDBYBhnHddFva3zLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd5934c803ac7-DFW
2024-10-22 22:13:23 UTC	645	IN	Data Raw: 2f 2a 21 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 32 2e 30 2e 34 0a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 32 20 54 77 69 74 74 65 72 2c 20 49 6e 63 0a 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 20 76 32 2e 30 0a 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 61 63 68 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4c 49 43 45 4e 53 45 2d 32 2e 30 0a 2a 0a 2a 20 44 65 73 69 67 6e 65 64 20 61 6e 64 20 62 75 69 6c 74 20 77 69 74 68 20 61 6c 6c 20 74 68 65 20 6c 6f 76 65 20 69 6e 20 74 68 65 20 77 6f 72 6c 64 20 40 74 77 69 74 74 65 72 20 62 79 20 40 6d 64 6f 20 61 6e 64 20 40 66 61 74 2e 2a 2f 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 64 65 74 61 69 6c 73 2c 66 69 67 63 61 70 74 69 6f 6e 2c Data Ascii: /! Bootstrap v2.0.4** Copyright 2012 Twitter, Inc* Licensed under the Apache License v2.0* http://www.apache.org/licenses/LICENSE-2.0** Designed and built with all the love in the world @twitter by @mdo and @fat.*/article,aside,details,figcaption,
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 73 75 70 7b 74 6f 70 3a 2d 2e 35 65 6d 7d 73 75 62 7b 62 6f 74 74 6f 6d 3a 2d 2e 32 35 65 6d 7d 69 6d 67 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 62 6f 72 64 65 72 3a 30 3b 2d 6d 73 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 6d 6f 64 65 3a 62 69 63 75 62 69 63 7d 23 6d 61 70 5f 63 61 6e 76 61 73 20 69 6d 67 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 Data Ascii: ;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}#map_canvas img{max-width:none}button,input,select,textarea{margin:0;font-size:100%;vertical-align:middle}button,input
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 79 3a 74 61 62 6c 65 3b 63 6f 6e 74 65 6e 74 3a 22 22 7d 2e 72 6f 77 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 5b 63 6c 61 73 73 2a 3d 73 70 61 6e 5d 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 6e 61 76 62 61 72 2d 66 69 78 65 64 2d 74 6f 70 20 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 6e 61 76 62 61 72 2d 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 39 34 30 70 78 7d 2e 73 70 61 6e 31 32 7b 77 69 64 74 68 3a 39 34 30 70 78 7d 2e 73 70 61 6e 31 31 7b 77 69 64 74 68 3a 38 36 30 70 78 7d 2e 73 70 61 6e 31 30 7b 77 69 64 74 68 3a 37 38 30 70 78 7d 2e 73 70 61 6e 39 7b 77 69 64 74 68 3a 37 30 30 70 78 7d 2e 73 70 61 6e 38 7b 77 69 Data Ascii: y:table;content:""}.row:after{clear:both}[class*=span]{float:left;margin-left:20px}.container,.navbar-fixed-top .container,.navbar-fixed-bottom .container{width:940px}.span12{width:940px}.span11{width:860px}.span10{width:780px}.span9{width:700px}.span8{wi
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 35 30 39 39 25 3b 2a 77 69 64 74 68 3a 37 34 2e 34 31 34 38 39 33 36 30 39 36 33 38 33 25 7d 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 73 70 61 6e 38 7b 77 69 64 74 68 3a 36 35 2e 39 35 37 34 34 36 38 30 31 39 39 39 39 39 25 3b 2a 77 69 64 74 68 3a 36 35 2e 39 30 34 32 35 35 33 31 32 36 33 38 32 38 25 7d 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 73 70 61 6e 37 7b 77 69 64 74 68 3a 35 37 2e 34 34 36 38 30 38 35 30 35 25 3b 2a 77 69 64 74 68 3a 35 37 2e 33 39 33 36 31 37 30 31 35 36 33 38 33 25 7d 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 73 70 61 6e 36 7b 77 69 64 74 68 3a 34 38 2e 39 33 36 31 37 30 32 30 37 39 39 39 39 39 25 3b 2a 77 69 64 74 68 3a 34 38 2e 38 38 32 39 37 38 37 31 38 36 33 38 32 39 25 7d 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 73 70 61 6e 35 7b 77 69 64 74 68 Data Ascii: 5099%;width:74.4148936096383%}.row-fluid .span8{width:65.95744680199999%;width:65.90425531263828%}.row-fluid .span7{width:57.446808505%;width:57.3936170156383%}.row-fluid .span6{width:48.93617020799999%;width:48.88297871863829%}.row-fluid .span5{width
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 69 7a 65 3a 31 34 70 78 7d 68 34 20 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 68 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 63 6f 6c 6f 72 3a 23 39 39 39 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 7d 2e 70 61 67 65 2d 68 65 61 64 65 72 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 37 70 78 3b 6d 61 72 67 69 6e 3a 31 38 70 78 20 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 7d 2e 70 61 67 65 2d 68 65 61 64 65 72 20 68 31 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 7d 75 6c 2c 6f 6c 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 39 70 78 20 32 35 70 78 7d 75 6c 20 75 6c 2c 75 6c Data Ascii: ize:14px}h4 small{font-size:12px}h5{font-size:12px}h6{font-size:11px;color:#999;text-transform:uppercase}.page-header{padding-bottom:17px;margin:18px 0;border-bottom:1px solid #eee}.page-header h1{line-height:1}ul,ol{padding:0;margin:0 0 9px 25px}ul ul,ul
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 2c 62 6c 6f 63 6b 71 75 6f 74 65 3a 62 65 66 6f 72 65 2c 62 6c 6f 63 6b 71 75 6f 74 65 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 7d 61 64 64 72 65 73 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 7d 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 7d 63 69 74 65 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 63 6f 64 65 2c 70 72 65 7b 70 61 64 64 69 6e 67 3a 30 20 33 70 78 20 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4d 65 6e 6c 6f 2c 4d 6f 6e 61 63 6f 2c 43 6f 6e 73 6f 6c 61 73 2c 63 6f 75 72 69 65 72 20 6e 65 77 2c 6d 6f 6e 6f 73 70 61 63 65 3b 66 6f 6e 74 2d Data Ascii: ,blockquote:before,blockquote:after{content:""}address{display:block;margin-bottom:18px;font-style:normal;line-height:18px}small{font-size:100%}cite{font-style:normal}code,pre{padding:0 3px 2px;font-family:Menlo,Monaco,Consolas,courier new,monospace;font-
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 65 78 74 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f 72 64 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 64 61 74 65 74 69 6d 65 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 64 61 74 65 74 69 6d 65 2d 6c 6f 63 61 6c 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 64 61 74 65 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 6d 6f 6e 74 68 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 74 69 6d 65 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 77 65 65 6b 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 65 6d 61 69 6c 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 75 72 6c 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 6c 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 63 6f 6c 6f 72 5d 2c 2e 75 6e 65 64 69 Data Ascii: ext],input[type=password],input[type=datetime],input[type=datetime-local],input[type=date],input[type=month],input[type=time],input[type=week],input[type=number],input[type=email],input[type=url],input[type=search],input[type=tel],input[type=color],.unedi
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 3d 72 65 73 65 74 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 7b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 75 6e 65 64 69 74 61 62 6c 65 2d 74 65 78 74 61 72 65 61 7b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 7d 73 65 6c 65 63 74 2c 69 6e 70 75 74 5b 74 79 70 65 3d 66 69 6c 65 5d 7b 68 65 69 67 68 74 3a 32 38 70 78 3b 2a 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 7d 73 65 6c 65 63 74 7b 77 69 64 74 68 3a 32 32 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 62 62 62 7d 73 65 6c 65 63 74 5b 6d 75 6c 74 69 70 6c 65 5d 2c 73 65 6c 65 63 74 5b Data Ascii: =reset],input[type=button],input[type=radio],input[type=checkbox]{width:auto}.uneditable-textarea{width:auto;height:auto}select,input[type=file]{height:28px;*margin-top:4px;line-height:28px}select{width:220px;border:1px solid #bbb}select[multiple],select[
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 72 65 70 65 6e 64 20 2e 75 6e 65 64 69 74 61 62 6c 65 2d 69 6e 70 75 74 5b 63 6c 61 73 73 2a 3d 73 70 61 6e 5d 2c 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 69 6e 70 75 74 2d 70 72 65 70 65 6e 64 20 5b 63 6c 61 73 73 2a 3d 73 70 61 6e 5d 2c 2e 72 6f 77 2d 66 6c 75 69 64 20 2e 69 6e 70 75 74 2d 61 70 70 65 6e 64 20 5b 63 6c 61 73 73 2a 3d 73 70 61 6e 5d 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 69 6e 70 75 74 2c 74 65 78 74 61 72 65 61 2c 2e 75 6e 65 64 69 74 61 62 6c 65 2d 69 6e 70 75 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 69 6e 70 75 74 2e 73 70 61 6e 31 32 2c 74 65 78 74 61 72 65 61 2e 73 70 61 6e 31 32 2c 2e 75 6e 65 64 69 74 61 62 6c 65 2d 69 6e 70 75 74 2e 73 70 61 6e 31 32 7b 77 69 64 74 68 3a 39 33 30 70 78 7d 69 6e 70 75 Data Ascii: repend .uneditable-input[class=span],.row-fluid .input-prepend [class=span],.row-fluid .input-append [class*=span]{display:inline-block}input,textarea,.uneditable-input{margin-left:0}input.span12,textarea.span12,.uneditable-input.span12{width:930px}inpu
2024-10-22 22:13:23 UTC	1369	IN	Data Raw: 2e 77 61 72 6e 69 6e 67 20 2e 68 65 6c 70 2d 62 6c 6f 63 6b 2c 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 2e 68 65 6c 70 2d 69 6e 6c 69 6e 65 7b 63 6f 6c 6f 72 3a 23 63 30 39 38 35 33 7d 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 2e 63 68 65 63 6b 62 6f 78 2c 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 2e 72 61 64 69 6f 2c 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 69 6e 70 75 74 2c 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 73 65 6c 65 63 74 2c 2e 63 6f 6e 74 72 6f 6c 2d 67 72 6f 75 70 2e 77 61 72 6e 69 6e 67 20 74 65 78 74 61 72 65 61 7b 63 6f 6c 6f 72 3a 23 63 30 39 38 35 33 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 63 30 Data Ascii: .warning .help-block,.control-group.warning .help-inline{color:#c09853}.control-group.warning .checkbox,.control-group.warning .radio,.control-group.warning input,.control-group.warning select,.control-group.warning textarea{color:#c09853;border-color:#c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49728	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:24 UTC	825	OUT	GET /Static/images/Branding/error-page.png HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSigned Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:24 UTC	664	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:24 GMT Content-Type: image/png Content-Length: 45601 Connection: close last-modified: Fri, 21 Oct 2022 11:48:02 GMT etag: "0c543f942e5d81:0" x-powered-by: ASP.NET CF-Cache-Status: HIT Age: 1307 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujDctTz%2BZTAZnoiPPGfMoUb%2B9s1y9S1UVSNzCJmx7%2FBI%2F7cyrF5gWzKu4l8GUXqy9xWFIe7Z%2BhSAT14Qj0lHAV%2BzJuh%2FrmqXOENabhSSpBt2F1ffAs%2BVSiHZsW6Yb2f6rK4yAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd59a2c2d2cc9-DFW
2024-10-22 22:13:24 UTC	705	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 6a 00 00 01 75 08 06 00 00 00 c1 58 a0 ad 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 b1 b3 49 44 41 54 78 da ec bd 07 b0 24 c7 79 26 f8 67 55 7b f3 bc 1b 6f 31 18 03 cc 00 43 78 80 0e 14 29 12 24 41 8a de 88 4e 10 45 86 44 85 24 4a 1b 2b ad bb 50 ec c5 6a 6f 63 b5 b1 ba b8 3b de 9e 56 52 48 5a 43 49 94 28 6a 65 68 45 81 1e 84 07 88 c1 0c 66 30 ee cd 3c 6f da 77 97 cd fb ff 6c f3 da 54 75 57 db d7 dd af 72 50 78 6d aa cb 64 65 7e f9 e5 97 bf 61 9c 73 70 8b 5b dc e2 16 b7 f4 6f 91 dc 2a 70 8b 5b dc e2 96 fe 2e 9e e2 8b b7 3c f3 fb 43 77 73 13 be 68 cd 67 5e c9 03 21 39 00 8c 49 a0 Data Ascii: PNGIHDRjuXgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATx$y&gU{o1Cx)$ANED$J+Pjoc;VRHZCI(jehEf0<owlTuWrPxmde~asp[o*p[.<Cwshg^!9I
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 7d 27 7d 23 70 21 79 1d 4c bc a6 51 6c 03 bb b0 8d ad e4 36 61 43 4b 8a eb 99 c3 f7 69 ac df a5 dc 3a 7e 37 89 d7 77 53 1c e3 10 b6 a1 11 dc ff 62 e2 ba 68 97 0a 3e 6f 6a 3b 87 22 7b f0 ef 92 d8 e7 d6 91 fd d8 f6 d6 20 80 d7 4e d7 b5 8a 75 4e 65 16 f7 2f 7e 4e c5 c0 7f 2f c7 af 61 bb dc 23 ea 83 9e cd 91 91 bd b0 8a ed b0 d4 d7 bc a3 70 31 39 0f 07 23 bb c0 23 cb b0 81 ed 4a 1c 2b 34 25 ee 53 33 35 d1 4e 8e e0 31 e8 b9 d3 33 de c4 76 b7 81 75 75 7c e4 80 78 ce c0 38 28 ba 2a 8e 4f 6d 65 16 fb 10 f5 3b 2a aa a1 61 9f 94 c5 eb 38 fe 06 9f 23 c8 d8 56 64 26 63 dd 98 e2 78 d8 2e 70 1f 49 fc 2d 2a 05 fe c2 3d 0c 62 f9 83 e3 8f d6 02 b5 5b dc d2 a3 c2 68 dc a2 31 b3 b0 f9 05 7e e6 3f f3 14 5e 4b 85 8d 15 de 33 1c 68 c6 10 c4 0f 67 8c dc 21 ec 88 4a 1b 40 ed f5 Data Ascii: }'}#p!yLQl6aCKi:~7wSbh>oj;"{ NuNe/~N/a#p19##J+4%S35N13vuu\|x8(Ome;a8#Vd&cx.pI-*=b[h1~?^K3hg!J@
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: c8 db 23 90 7b b4 ce 8d 87 b1 a3 3f 12 53 92 b7 3f bd f1 f2 0c 82 f4 3e dc 67 3c a3 2b c2 8d 5b 80 31 cb bb 69 23 df 26 29 c4 ad c8 5e 03 77 c1 38 46 2a 93 48 74 53 2f 0c 9c e6 38 33 d8 38 fe 85 b8 92 3c 71 25 b5 70 5b 40 f6 7f 74 c4 1b 26 76 7d 0e 9f db df e0 33 7b 2e 0f f5 ee 3a a4 0b d4 6e e9 fb 92 d4 d3 30 e6 8d 8e 84 e4 e0 fd 9b 90 bc ed 62 f2 fa 2e c5 d4 ee ca ea ca dd 71 2d 15 8a 6b 69 01 e0 14 1f 81 80 99 62 39 b8 9d bb 3f 19 77 7e f0 a4 d7 f9 81 93 62 b5 a4 79 96 21 60 1f f6 30 cf 61 d5 d4 28 e6 ca ca a6 92 b8 db 2f fb 9f 0a 48 be cb 21 4f e0 19 7c b6 2f 19 c2 f3 dd 2d 2e 50 bb a5 bf 1e 22 93 7d c8 8c c9 c9 64 0a 59 f1 7d c8 a2 df b9 a9 26 4f 2f 67 d7 83 c4 b0 8b 12 06 05 9c aa 98 71 bb 20 dd f7 a5 f8 84 f2 01 88 b6 2c 6a 28 c8 d5 1a 98 33 f8 5c Data Ascii: #{?S?>g<+[1i#&)^w8F*HtS/838<q%p[@t&v}3{.:n0b.q-kib9?w~by!`0a(/H!O\|/-.P"}dY}&O/gq ,j(3\
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 64 d9 1e e6 15 80 7d 35 b5 b0 67 3e b3 fc db 7b 43 33 9f cc 19 da bf c7 af ff 1e f2 da b5 eb 30 e3 02 f5 40 cd 52 c8 bc e9 bd 06 37 ce 5e 4c dc 78 db a6 92 18 cf 1a 8a 98 4e 4a 8c 01 b8 9a 9e 5b 06 b1 61 17 f4 6b 02 6b c3 50 c6 16 32 6b 77 a6 f4 ec ef ec 0e 4c dd 6d 02 ff 5f b8 cb d3 b8 65 c0 5d 6c 74 81 ba cf 4b 18 b7 23 8a a9 7e 78 3e b3 f2 d8 f5 d4 f2 34 35 ea e2 42 a1 5b dc 32 0c cc ba 10 20 8c c2 ab 52 56 f5 c3 49 35 f3 8b fb 23 b3 27 11 9f bf 82 bb 7c 15 b7 79 17 ac 5d a0 ee bb 86 8b 2c 83 58 f4 54 4a cf 3d a8 18 fa 6f 6e 28 c9 7b 36 d4 b8 48 85 e5 2f 38 ac b8 a5 e5 0a de de e2 c2 8d 3d 78 48 32 02 08 02 b6 9e 0e 9d 8b 5d 7e 64 26 30 f1 48 c6 50 bf 10 95 03 ff 17 7e 7d 05 37 37 9f 63 07 a7 e9 6e 69 a3 1c 8a ee 61 8c 49 fb 24 26 fd e7 e7 63 af 7c e1 Data Ascii: d}5g>{C30@R7^LxNJ[akkP2kwLm_e]ltK#~x>45B[2 RVI5#'\|y],XTJ=on({6H/8=xH2]~d&0HP~}77cniaI$&c\|
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 43 73 81 7a 87 4a 1d 04 d0 b7 5c 4f 2f 3f b6 9c db f8 a5 94 96 89 50 ee 37 5f de fd 75 38 64 0e 66 fd c6 89 bc d1 14 30 db fd 86 35 7f cd fd 82 d5 bc 99 13 db 80 b9 15 80 37 0d de cc 5e 5a 61 ac 1e 68 17 3e e5 36 92 48 1f 82 36 c5 ca a1 82 60 4d 97 76 87 97 79 ff 0f 89 49 c1 b4 9e fd 9f 93 be 51 17 a8 77 5a a1 11 da e0 c6 ed 37 b3 ab bf 71 25 75 f3 03 49 35 13 a0 36 eb 61 f2 e0 80 b4 1d 30 d8 98 d3 31 d6 22 30 33 87 4c 99 b5 86 b0 6c 70 aa b7 79 30 b7 60 b5 cc e2 73 6e b5 6f 11 e0 79 ad 79 9f 15 70 57 5b 90 f0 32 94 67 cc c6 9d bd 4f 75 6c ea 87 19 3d 07 d7 d3 4b c7 54 53 fb 97 21 4f 40 9f f5 4f 7c 13 2f 78 73 a7 02 f5 50 c7 a3 26 40 66 35 cb 67 cc a7 98 da 1d 37 33 6b 9f 3b 17 bb f2 a1 44 01 a4 a5 61 d5 a3 7b 19 2f d9 8d d1 6c dd c3 1a d5 89 d5 77 52 87 Data Ascii: CszJ\O/?P7_u8df057^Zah>6H6`MvyIQwZ7q%uI56a01"03Llpy0`snoyypW[2gOul=KTS!O@O\|/xsP&@f5g73k;Da{/lwR
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 3e 3c b4 d2 c7 a0 0f 38 38 e6 9f de 54 52 ff 66 21 b3 76 36 6d 64 20 28 fb fa 9b 49 d7 a8 1b cc 5a aa 68 46 e6 a8 91 4d 9a c3 73 ab 9d 9c e9 ce 1d 96 36 fa 11 18 78 27 ee 85 59 d2 0b cb 9f b0 c6 d2 48 43 d9 98 d9 e8 d3 ac f6 f4 dc e6 60 25 95 83 b1 32 99 84 f7 8d 19 1f 2f b0 6a 8e a4 0c fb 7e 44 66 d2 a7 0f 45 76 99 51 4f e8 3f e2 35 2e bb 40 dd 3f 85 42 6e 9d 48 eb b9 7f 75 25 bd 70 67 52 4f 23 48 fb fb 53 93 b6 73 5a 69 14 d9 8e 35 b1 48 d8 ea 02 a1 a3 08 78 1d 02 64 d6 9d fa ec 2a 08 77 cd e1 a6 4a 54 ae 06 6e be d5 26 ea 39 df d8 2e 40 f2 da 67 5b 71 9c ea c0 4f 16 a0 cd ca 81 be 70 24 db c5 46 be 5d 5d 8b 41 c4 13 a4 d8 20 51 bc a8 4f 1d 1f 3d a8 84 e5 d0 bf c7 af d2 30 04 9a f5 a0 03 b5 8c 80 7c 26 67 28 bf fe 62 ec d5 47 14 43 0d 7a fb 75 e1 d0 92 Data Ascii: ><88TRf!v6md (IZhFMs6x'YHC`%2/j~DfEvQO?5.@?BnHu%pgRO#HSsZi5Hxd*wJTn&9.@g[qOp$F]]A QO=0\|&g(bGCzu
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: dc 0b 59 64 20 80 9c b7 ee eb 52 d3 be aa 3d 12 cb 0f d8 94 93 91 85 a5 08 af c5 72 27 0c bb f4 b9 85 1c 52 3d b8 54 ba c0 57 c6 b3 e4 bc f7 60 ad 18 0a 9b cf 2c bd 2d 20 f9 97 f7 46 a6 fe 85 c9 79 62 60 80 ba 9f 0c c0 8b d7 22 31 e9 e8 8d cc f2 e7 af a6 16 4e 1b dc 94 fb ce 14 cf 6a 2a c0 a1 b1 19 5b 71 9f 2a a6 d2 52 63 1d 80 ac 1c 6e e9 c1 20 c1 db f8 4d b3 c7 b0 6a b7 4e c1 b6 0f da 2b 39 c4 c4 94 54 f8 0a bb f9 ce 88 37 70 75 d4 1b f9 02 07 33 dd cf cc a2 2f ad 3e 48 37 92 99 ec 59 cd 6d be fb 5c fc ea fb f1 23 7f 5f 98 e1 55 39 ab 6c c5 ec 2d 63 d3 55 f1 7a 99 95 2a d1 40 06 61 36 33 58 ab 63 95 e6 a6 cc f9 b5 57 9c cf 4a 42 61 ad 55 8b 7d 8c ea 1d 0a a0 ad c6 fe 6e f0 ec aa 4c f3 eb 3c 0c 3b a0 ac ba a8 02 c9 66 60 13 14 ac c1 e1 98 8d f9 28 b3 fb Data Ascii: Yd R=r'R=TW`,- Fyb`"1Nj[qRcn MjN+9T7pu3/>H7Ym\#_U9l-cUz*@a63XcWJBaU}nL<;f`(
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 1c 65 4f 2a 97 3e 7a f9 4f 02 29 ac 98 ea 5b ae a4 16 3e 9a d1 95 51 af 24 6f 0f 48 b7 33 c7 90 aa f6 97 ba 7c 3e b7 b8 65 d0 e5 92 e2 5f d6 bf fd 84 50 c8 27 7b 61 4d 89 1f 9b cf 2c 7d 1a df ef 02 72 66 ec 07 58 e2 3d de 0c 6e 1e 47 46 fd bf c5 b4 64 44 e7 fa f6 69 e4 35 d1 ec b6 e4 0e 66 e7 e6 6d e5 c2 2b 35 26 80 d6 71 0d 98 b3 98 0d 76 52 87 53 0f f2 4e 4c bb eb 48 1b 9d 96 4e b6 55 37 e9 f2 b5 74 cd 05 df ca 7d bb 19 29 04 9a 91 42 6a 35 17 d6 8c 55 4f d1 8d dc 6e b6 6a 21 b4 30 a9 77 4d 81 cc 83 d3 7a 06 d6 72 b1 db 13 5a fa 33 6c 9b 63 f7 97 e0 05 67 16 3d d8 b8 f8 8b 7c 7a 14 6f fe 2d 57 92 8b 77 1b dc 90 a4 6d 06 e9 0a d7 70 a8 93 8d a5 41 a3 ac 87 87 95 a0 ef 40 8f b6 90 3a 9c 80 6e 37 01 a0 23 87 eb 17 4f c0 3e ba 87 ae e8 d9 cd 3c 33 1b a0 6c Data Ascii: eO*>zO)[>Q$oH3\|>e_P'{aM,}rfX=nGFdDi5fm+5&qvRSNLHNU7t})Bj5UOnj!0wMzrZ3lcg=\|zo-WwmpA@:n7#O><3l
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 5d f5 34 ac 06 da 5b 5d 8f 43 de 00 a4 59 8f 41 ba 59 a9 c3 95 38 86 5e 0e e9 9a 6e 5d 2f 46 48 b3 9a 75 bd f6 5f 6f 41 bf 66 0d 0a 9a cb be de c6 98 b9 a9 25 21 67 e4 ee 43 9c bb 23 ff 79 67 ff 59 32 ea 0e 03 29 1d 6c e4 5a 7a e5 bd 49 3d bb 57 62 db a8 4b d7 59 11 b6 74 6a 71 90 42 ab 36 46 b5 03 c4 75 a8 9d b5 ac af b5 e2 f2 ed 02 f4 8e 60 d9 96 ae db 4d 9e c7 d6 39 c6 2e b6 75 5d b7 f3 c6 4e 31 35 3f 2d 7a 4b 72 8b 44 ba 56 87 06 8b bc 8b 9d 66 b9 78 b2 55 25 f6 48 d0 13 b8 30 ee 8b 3e 03 5d b4 00 ef 16 a3 9e 4e 68 e9 4f 2e 67 d7 8e 28 ba 22 82 9b 6c 0b 48 83 b5 85 87 6d d6 95 06 fb d4 86 3e 75 60 23 ed 30 0b 4b 5b 8b 40 ad 30 e8 21 03 69 ea 21 66 83 6d a8 7d 8e 98 f3 47 df 95 36 66 17 3d cf a9 ad 35 ab 43 84 ed fa 12 34 69 09 d2 e1 36 4f b8 b6 ae 26 Data Ascii: ]4[]CYAY8^n]/FHu_oAf%!gC#ygY2)lZzI=WbKYtjqB6Fu`M9.u]N15?-zKrDVfxU%H0>]NhO.g("lHm>u`#0K[@0!i!fm}G6f=5C4i6O&
2024-10-22 22:13:24 UTC	1369	IN	Data Raw: 0b ed 3a 1b d5 e0 4a 76 09 8e 05 e6 e0 f1 c4 39 b8 84 af e9 78 3e e6 2d 25 91 20 b0 8e e0 eb 44 01 ac 87 5a af 66 f5 c1 ba 5b 52 88 b3 c5 bc fa 96 20 b6 8b 8b d5 ef 6d 24 90 6e c5 03 31 4c 03 d2 7a f6 f5 29 3d f3 7e bf ec fb 7d de 21 1a 5f 02 6a d1 58 5b 2c 8a a9 ed be 96 59 7e 9d 62 a8 81 6d b5 9b 76 cb d0 b0 e9 22 48 fb 61 4b 93 26 79 43 c7 86 3f e6 0b c3 7d d1 5b e0 bd 93 f7 c3 41 04 e8 80 e4 03 bb 30 05 45 0f 55 21 a1 c8 32 9c 0a ef 87 43 c1 59 b8 35 bc 07 fe 6c f5 07 70 21 73 03 54 d3 28 41 32 fd 3f 04 20 ac 41 0c 00 77 71 d1 2d cd 01 2a f3 c0 a6 9a 38 78 33 bb f6 33 87 22 bb 7e 9f 43 87 81 ba 0d 37 ef 7d 19 50 3e 10 57 93 11 1d 1b bc d4 0b a0 ae ce 0a 6e 61 33 dd 91 c5 c3 ba 3b 39 63 bd 5d 5b 38 1c 72 f4 20 13 bc 00 54 ca 90 2a 42 e7 84 27 02 af 1f Data Ascii: :Jv9x>-% DZf[R m$n1Lz)=~}!_jX[,Y~bmv"HaK&yC?}[A0EU!2CY5lp!sT(A2? Awq-8x33"~C7}P>Wna3;9c][8r TB'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49731	104.26.11.58	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:25 UTC	557	OUT	GET /Static/images/Branding/error-page.png HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
2024-10-22 22:13:25 UTC	650	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:25 GMT Content-Type: image/png Content-Length: 45601 Connection: close last-modified: Fri, 21 Oct 2022 11:48:02 GMT etag: "0c543f942e5d81:0" x-powered-by: ASP.NET CF-Cache-Status: HIT Age: 1308 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GaJkR2jpp%2FgyLG3zTiF6p9MD70m7HBaDm3CBcc6vjWXKXGEkZPxIkto2yCDnoMAxt6yTwkg3OHhHzJNVxYXmZIPt6J3Aah0TFal3hUSRr5cvy9AZmD7iveuLaNuTctn49gJ9UA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd5a1fc126bac-DFW
2024-10-22 22:13:25 UTC	719	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 6a 00 00 01 75 08 06 00 00 00 c1 58 a0 ad 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 b1 b3 49 44 41 54 78 da ec bd 07 b0 24 c7 79 26 f8 67 55 7b f3 bc 1b 6f 31 18 03 cc 00 43 78 80 0e 14 29 12 24 41 8a de 88 4e 10 45 86 44 85 24 4a 1b 2b ad bb 50 ec c5 6a 6f 63 b5 b1 ba b8 3b de 9e 56 52 48 5a 43 49 94 28 6a 65 68 45 81 1e 84 07 88 c1 0c 66 30 ee cd 3c 6f da 77 97 cd fb ff 6c f3 da 54 75 57 db d7 dd af 72 50 78 6d aa cb 64 65 7e f9 e5 97 bf 61 9c 73 70 8b 5b dc e2 16 b7 f4 6f 91 dc 2a 70 8b 5b dc e2 96 fe 2e 9e e2 8b b7 3c f3 fb 43 77 73 13 be 68 cd 67 5e c9 03 21 39 00 8c 49 a0 Data Ascii: PNGIHDRjuXgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATx$y&gU{o1Cx)$ANED$J+Pjoc;VRHZCI(jehEf0<owlTuWrPxmde~asp[o*p[.<Cwshg^!9I
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: bb b0 8d ad e4 36 61 43 4b 8a eb 99 c3 f7 69 ac df a5 dc 3a 7e 37 89 d7 77 53 1c e3 10 b6 a1 11 dc ff 62 e2 ba 68 97 0a 3e 6f 6a 3b 87 22 7b f0 ef 92 d8 e7 d6 91 fd d8 f6 d6 20 80 d7 4e d7 b5 8a 75 4e 65 16 f7 2f 7e 4e c5 c0 7f 2f c7 af 61 bb dc 23 ea 83 9e cd 91 91 bd b0 8a ed b0 d4 d7 bc a3 70 31 39 0f 07 23 bb c0 23 cb b0 81 ed 4a 1c 2b 34 25 ee 53 33 35 d1 4e 8e e0 31 e8 b9 d3 33 de c4 76 b7 81 75 75 7c e4 80 78 ce c0 38 28 ba 2a 8e 4f 6d 65 16 fb 10 f5 3b 2a aa a1 61 9f 94 c5 eb 38 fe 06 9f 23 c8 d8 56 64 26 63 dd 98 e2 78 d8 2e 70 1f 49 fc 2d 2a 05 fe c2 3d 0c 62 f9 83 e3 8f d6 02 b5 5b dc d2 a3 c2 68 dc a2 31 b3 b0 f9 05 7e e6 3f f3 14 5e 4b 85 8d 15 de 33 1c 68 c6 10 c4 0f 67 8c dc 21 ec 88 4a 1b 40 ed f5 68 9e 0d ec f8 69 7c 9b c2 4d 2e 9c c7 28 Data Ascii: 6aCKi:~7wSbh>oj;"{ NuNe/~N/a#p19##J+4%S35N13vuu\|x8(Ome;a8#Vd&cx.pI-*=b[h1~?^K3hg!J@hi\|M.(
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: 92 b7 3f bd f1 f2 0c 82 f4 3e dc 67 3c a3 2b c2 8d 5b 80 31 cb bb 69 23 df 26 29 c4 ad c8 5e 03 77 c1 38 46 2a 93 48 74 53 2f 0c 9c e6 38 33 d8 38 fe 85 b8 92 3c 71 25 b5 70 5b 40 f6 7f 74 c4 1b 26 76 7d 0e 9f db df e0 33 7b 2e 0f f5 ee 3a a4 0b d4 6e e9 fb 92 d4 d3 30 e6 8d 8e 84 e4 e0 fd 9b 90 bc ed 62 f2 fa 2e c5 d4 ee ca ea ca dd 71 2d 15 8a 6b 69 01 e0 14 1f 81 80 99 62 39 b8 9d bb 3f 19 77 7e f0 a4 d7 f9 81 93 62 b5 a4 79 96 21 60 1f f6 30 cf 61 d5 d4 28 e6 ca ca a6 92 b8 db 2f fb 9f 0a 48 be cb 21 4f e0 19 7c b6 2f 19 c2 f3 dd 2d 2e 50 bb a5 bf 1e 22 93 7d c8 8c c9 c9 64 0a 59 f1 7d c8 a2 df b9 a9 26 4f 2f 67 d7 83 c4 b0 8b 12 06 05 9c aa 98 71 bb 20 dd f7 a5 f8 84 f2 01 88 b6 2c 6a 28 c8 d5 1a 98 33 f8 5c df 11 f5 86 de 3a 13 98 58 94 33 d2 77 70 Data Ascii: ?>g<+[1i#&)^w8F*HtS/838<q%p[@t&v}3{.:n0b.q-kib9?w~by!`0a(/H!O\|/-.P"}dY}&O/gq ,j(3\:X3wp
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: db 7b 43 33 9f cc 19 da bf c7 af ff 1e f2 da b5 eb 30 e3 02 f5 40 cd 52 c8 bc e9 bd 06 37 ce 5e 4c dc 78 db a6 92 18 cf 1a 8a 98 4e 4a 8c 01 b8 9a 9e 5b 06 b1 61 17 f4 6b 02 6b c3 50 c6 16 32 6b 77 a6 f4 ec ef ec 0e 4c dd 6d 02 ff 5f b8 cb d3 b8 65 c0 5d 6c 74 81 ba cf 4b 18 b7 23 8a a9 7e 78 3e b3 f2 d8 f5 d4 f2 34 35 ea e2 42 a1 5b dc 32 0c cc ba 10 20 8c c2 ab 52 56 f5 c3 49 35 f3 8b fb 23 b3 27 11 9f bf 82 bb 7c 15 b7 79 17 ac 5d a0 ee bb 86 8b 2c 83 58 f4 54 4a cf 3d a8 18 fa 6f 6e 28 c9 7b 36 d4 b8 48 85 e5 2f 38 ac b8 a5 e5 0a de de e2 c2 8d 3d 78 48 32 02 08 02 b6 9e 0e 9d 8b 5d 7e 64 26 30 f1 48 c6 50 bf 10 95 03 ff 17 7e 7d 05 37 37 9f 63 07 a7 e9 6e 69 a3 1c 8a ee 61 8c 49 fb 24 26 fd e7 e7 63 af 7c e1 27 f1 57 ef c9 18 39 f0 4b 3e d7 6c a9 1e Data Ascii: {C30@R7^LxNJ[akkP2kwLm_e]ltK#~x>45B[2 RVI5#'\|y],XTJ=on({6H/8=xH2]~d&0HP~}77cniaI$&c\|'W9K>l
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: b6 9c db f8 a5 94 96 89 50 ee 37 5f de fd 75 38 64 0e 66 fd c6 89 bc d1 14 30 db fd 86 35 7f cd fd 82 d5 bc 99 13 db 80 b9 15 80 37 0d de cc 5e 5a 61 ac 1e 68 17 3e e5 36 92 48 1f 82 36 c5 ca a1 82 60 4d 97 76 87 97 79 ff 0f 89 49 c1 b4 9e fd 9f 93 be 51 17 a8 77 5a a1 11 da e0 c6 ed 37 b3 ab bf 71 25 75 f3 03 49 35 13 a0 36 eb 61 f2 e0 80 b4 1d 30 d8 98 d3 31 d6 22 30 33 87 4c 99 b5 86 b0 6c 70 aa b7 79 30 b7 60 b5 cc e2 73 6e b5 6f 11 e0 79 ad 79 9f 15 70 57 5b 90 f0 32 94 67 cc c6 9d bd 4f 75 6c ea 87 19 3d 07 d7 d3 4b c7 54 53 fb 97 21 4f 40 9f f5 4f 7c 13 2f 78 73 a7 02 f5 50 c7 a3 26 40 66 35 cb 67 cc a7 98 da 1d 37 33 6b 9f 3b 17 bb f2 a1 44 01 a4 a5 61 d5 a3 7b 19 2f d9 8d d1 6c dd c3 1a d5 89 d5 77 52 87 9e 85 34 a8 d5 c6 40 37 75 b8 99 59 39 b5 Data Ascii: P7_u8df057^Zah>6H6`MvyIQwZ7q%uI56a01"03Llpy0`snoyypW[2gOul=KTS!O@O\|/xsP&@f5g73k;Da{/lwR4@7uY9
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: ff 66 21 b3 76 36 6d 64 20 28 fb fa 9b 49 d7 a8 1b cc 5a aa 68 46 e6 a8 91 4d 9a c3 73 ab 9d 9c e9 ce 1d 96 36 fa 11 18 78 27 ee 85 59 d2 0b cb 9f b0 c6 d2 48 43 d9 98 d9 e8 d3 ac f6 f4 dc e6 60 25 95 83 b1 32 99 84 f7 8d 19 1f 2f b0 6a 8e a4 0c fb 7e 44 66 d2 a7 0f 45 76 99 51 4f e8 3f e2 35 2e bb 40 dd 3f 85 42 6e 9d 48 eb b9 7f 75 25 bd 70 67 52 4f 23 48 fb fb 53 93 b6 73 5a 69 14 d9 8e 35 b1 48 d8 ea 02 a1 a3 08 78 1d 02 64 d6 9d fa ec 2a 08 77 cd e1 a6 4a 54 ae 06 6e be d5 26 ea 39 df d8 2e 40 f2 da 67 5b 71 9c ea c0 4f 16 a0 cd ca 81 be 70 24 db c5 46 be 5d 5d 8b 41 c4 13 a4 d8 20 51 bc a8 4f 1d 1f 3d a8 84 e5 d0 bf c7 af d2 30 04 9a f5 a0 03 b5 8c 80 7c 26 67 28 bf fe 62 ec d5 47 14 43 0d 7a fb 75 e1 d0 92 f5 b2 0a f9 b2 21 83 76 62 c1 d1 ec e2 a0 Data Ascii: f!v6md (IZhFMs6x'YHC`%2/j~DfEvQO?5.@?BnHu%pgRO#HSsZi5Hxd*wJTn&9.@g[qOp$F]]A QO=0\|&g(bGCzu!vb
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: 3d 12 cb 0f d8 94 93 91 85 a5 08 af c5 72 27 0c bb f4 b9 85 1c 52 3d b8 54 ba c0 57 c6 b3 e4 bc f7 60 ad 18 0a 9b cf 2c bd 2d 20 f9 97 f7 46 a6 fe 85 c9 79 62 60 80 ba 9f 0c c0 8b d7 22 31 e9 e8 8d cc f2 e7 af a6 16 4e 1b dc 94 fb ce 14 cf 6a 2a c0 a1 b1 19 5b 71 9f 2a a6 d2 52 63 1d 80 ac 1c 6e e9 c1 20 c1 db f8 4d b3 c7 b0 6a b7 4e c1 b6 0f da 2b 39 c4 c4 94 54 f8 0a bb f9 ce 88 37 70 75 d4 1b f9 02 07 33 dd cf cc a2 2f ad 3e 48 37 92 99 ec 59 cd 6d be fb 5c fc ea fb f1 23 7f 5f 98 e1 55 39 ab 6c c5 ec 2d 63 d3 55 f1 7a 99 95 2a d1 40 06 61 36 33 58 ab 63 95 e6 a6 cc f9 b5 57 9c cf 4a 42 61 ad 55 8b 7d 8c ea 1d 0a a0 ad c6 fe 6e f0 ec aa 4c f3 eb 3c 0c 3b a0 ac ba a8 02 c9 66 60 13 14 ac c1 e1 98 8d f9 28 b3 fb ac ec fc db 11 df 9a 88 20 c1 49 42 4b ed Data Ascii: =r'R=TW`,- Fyb`"1Nj[qRcn MjN+9T7pu3/>H7Ym\#_U9l-cUz*@a63XcWJBaU}nL<;f`( IBK
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: 5b ae a4 16 3e 9a d1 95 51 af 24 6f 0f 48 b7 33 c7 90 aa f6 97 ba 7c 3e b7 b8 65 d0 e5 92 e2 5f d6 bf fd 84 50 c8 27 7b 61 4d 89 1f 9b cf 2c 7d 1a df ef 02 72 66 ec 07 58 e2 3d de 0c 6e 1e 47 46 fd bf c5 b4 64 44 e7 fa f6 69 e4 35 d1 ec b6 e4 0e 66 e7 e6 6d e5 c2 2b 35 26 80 d6 71 0d 98 b3 98 0d 76 52 87 53 0f f2 4e 4c bb eb 48 1b 9d 96 4e b6 55 37 e9 f2 b5 74 cd 05 df ca 7d bb 19 29 04 9a 91 42 6a 35 17 d6 8c 55 4f d1 8d dc 6e b6 6a 21 b4 30 a9 77 4d 81 cc 83 d3 7a 06 d6 72 b1 db 13 5a fa 33 6c 9b 63 f7 97 e0 05 67 16 3d d8 b8 f8 8b 7c 7a 14 6f fe 2d 57 92 8b 77 1b dc 90 a4 6d 06 e9 0a d7 70 a8 93 8d a5 41 a3 ac 87 87 95 a0 ef 40 8f b6 90 3a 9c 80 6e 37 01 a0 23 87 eb 17 4f c0 3e ba 87 ae e8 d9 cd 3c 33 1b a0 6c 0c d6 50 c3 1e ea 07 63 02 7b 4b a0 3a 9e Data Ascii: [>Q$oH3\|>e_P'{aM,}rfX=nGFdDi5fm+5&qvRSNLHNU7t})Bj5UOnj!0wMzrZ3lcg=\|zo-WwmpA@:n7#O><3lPc{K:
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: 8f 41 ba 59 a9 c3 95 38 86 5e 0e e9 9a 6e 5d 2f 46 48 b3 9a 75 bd f6 5f 6f 41 bf 66 0d 0a 9a cb be de c6 98 b9 a9 25 21 67 e4 ee 43 9c bb 23 ff 79 67 ff 59 32 ea 0e 03 29 1d 6c e4 5a 7a e5 bd 49 3d bb 57 62 db a8 4b d7 59 11 b6 74 6a 71 90 42 ab 36 46 b5 03 c4 75 a8 9d b5 ac af b5 e2 f2 ed 02 f4 8e 60 d9 96 ae db 4d 9e c7 d6 39 c6 2e b6 75 5d b7 f3 c6 4e 31 35 3f 2d 7a 4b 72 8b 44 ba 56 87 06 8b bc 8b 9d 66 b9 78 b2 55 25 f6 48 d0 13 b8 30 ee 8b 3e 03 5d b4 00 ef 16 a3 9e 4e 68 e9 4f 2e 67 d7 8e 28 ba 22 82 9b 6c 0b 48 83 b5 85 87 6d d6 95 06 fb d4 86 3e 75 60 23 ed 30 0b 4b 5b 8b 40 ad 30 e8 21 03 69 ea 21 66 83 6d a8 7d 8e 98 f3 47 df 95 36 66 17 3d cf a9 ad 35 ab 43 84 ed fa 12 34 69 09 d2 e1 36 4f b8 b6 ae 26 e4 55 65 93 4c f5 6e 87 2e 4a c9 a5 03 e7 Data Ascii: AY8^n]/FHu_oAf%!gC#ygY2)lZzI=WbKYtjqB6Fu`M9.u]N15?-zKrDVfxU%H0>]NhO.g("lHm>u`#0K[@0!i!fm}G6f=5C4i6O&UeLn.J
2024-10-22 22:13:25 UTC	1369	IN	Data Raw: c4 39 b8 84 af e9 78 3e e6 2d 25 91 20 b0 8e e0 eb 44 01 ac 87 5a af 66 f5 c1 ba 5b 52 88 b3 c5 bc fa 96 20 b6 8b 8b d5 ef 6d 24 90 6e c5 03 31 4c 03 d2 7a f6 f5 29 3d f3 7e bf ec fb 7d de 21 1a 5f 02 6a d1 58 5b 2c 8a a9 ed be 96 59 7e 9d 62 a8 81 6d b5 9b 76 cb d0 b0 e9 22 48 fb 61 4b 93 26 79 43 c7 86 3f e6 0b c3 7d d1 5b e0 bd 93 f7 c3 41 04 e8 80 e4 03 bb 30 05 45 0f 55 21 a1 c8 32 9c 0a ef 87 43 c1 59 b8 35 bc 07 fe 6c f5 07 70 21 73 03 54 d3 28 41 32 fd 3f 04 20 ac 41 0c 00 77 71 d1 2d cd 01 2a f3 c0 a6 9a 38 78 33 bb f6 33 87 22 bb 7e 9f 43 87 81 ba 0d 37 ef 7d 19 50 3e 10 57 93 11 1d 1b bc d4 0b a0 ae ce 0a 6e 61 33 dd 91 c5 c3 ba 3b 39 63 bd 5d 5b 38 1c 72 f4 20 13 bc 00 54 ca 90 2a 42 e7 84 27 02 af 1f bd 0d 3e 34 fd 00 ec f5 4f 35 5d 0d 44 24 Data Ascii: 9x>-% DZf[R m$n1Lz)=~}!_jX[,Y~bmv"HaK&yC?}[A0EU!2CY5lp!sT(A2? Awq-8x33"~C7}P>Wna3;9c][8r TB'>4O5]D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49732	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FaOU+KVYCHLglnt&MD=opa4dG2A HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-22 22:13:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 42082115-c5b9-40fd-ae13-c6f3afbe7f91 MS-RequestId: 3fca3278-6e01-4459-9abb-dafec2167ab0 MS-CV: cYkyiNR2Ik+fAXgS.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 22 Oct 2024 22:13:26 GMT Connection: close Content-Length: 24490
2024-10-22 22:13:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-22 22:13:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49738	172.67.69.202	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:27 UTC	1063	OUT	GET /Static/images/Branding/favicon.png HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSigned Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj; ai_user=JBLFi\|2024-10-22T22:13:23.894Z; __utma=56068014.72299502.1729635204.1729635204.1729635204.1; __utmc=56068014; __utmz=56068014.1729635204.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none); __utmt=1; __utmb=56068014.2.9.1729635205528
2024-10-22 22:13:28 UTC	656	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:28 GMT Content-Type: image/png Content-Length: 2295 Connection: close last-modified: Fri, 21 Oct 2022 11:48:02 GMT etag: "0c543f942e5d81:0" x-powered-by: ASP.NET CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FOi9xMoWAB01ixXvS5rGsu%2BI6DZrgYpDyygpT6INzDunmSxkYyakRgPwejjWMzW1DqGRUT7hAjvfA%2BDi9VA5U4ces3v38vcwy%2BFu%2Bwp8jrH12HYiBaS%2F9pE6qYm8G7%2FJ43m3zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd5b04d4be836-DFW
2024-10-22 22:13:28 UTC	713	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 08 89 49 44 41 54 78 da 9c 57 6b 6c 1c 57 15 3e 77 66 76 67 f6 bd f6 da a9 9d d8 4e 9a 47 f3 26 15 6d 09 24 12 01 92 b6 a9 44 0b 54 a2 84 04 9a 06 89 a6 aa a8 84 40 a0 42 fe 10 40 fc 08 ad 90 a8 0a 6d 29 52 23 a0 ad 54 55 91 12 55 fd 11 45 11 a5 85 86 36 44 4a 70 9b a4 b1 83 8d 53 3b 59 3f 76 d7 fb 9a 37 df b9 33 6b 8f 9b 4d 41 cc ea da 33 77 ee 3d 8f ef 7c e7 dc 33 e2 91 0b af 51 eb 12 f8 15 cd 19 12 42 90 ed b9 98 f1 c9 50 e2 e4 f8 2e ee 88 2c d7 2e 54 ec ea e6 ba 6b de d1 70 cc 65 1e 79 1d 02 Data Ascii: PNGIHDR szzgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxWklW>wfvgNG&m$DT@B@m)R#TUUE6DJpS;Y?v73kMA3w=\|3QBP.,.Tkpey
2024-10-22 22:13:28 UTC	1369	IN	Data Raw: 54 20 dd f1 1d 6d b0 34 fc 44 cd 6d aa 75 b7 19 20 70 a5 71 ed 7e 14 a0 2d 2a 56 4a 96 4b 6f 45 38 22 c2 44 24 e4 d8 f7 cd ce 4f d2 2f fb be 44 7d b1 b4 2c 38 d1 8c 6c ed 53 94 08 8f e0 18 67 03 eb 42 9a de cb 28 28 2e 58 32 d1 98 de e3 87 1b 15 2d d8 44 d8 e0 82 49 36 39 e4 89 85 a9 c3 ca 3a 55 83 be bb 78 27 3d d0 bd 95 3e 97 59 45 4d df 9e 33 ce c3 5f 1e 3e f6 c9 bd 60 9a 17 86 85 b3 89 17 15 cd d2 5e e6 82 56 73 1b cb a6 cc f2 76 95 82 3c 67 e5 0e 14 73 f9 5d 12 cf 53 46 d3 69 dc 2e 53 d9 6d 50 52 d1 25 08 1e de 65 95 98 2c af 7c a5 50 ae 0d c4 93 d1 34 30 ef b7 58 1e 16 4b ce 0e 5f 86 cc 91 3a 54 55 21 54 d6 3b cb 76 6d a9 56 b2 ab 5b 2d cf 4e 31 f9 58 39 22 4a 8b f5 2c fd a0 7f 07 ed cc 6f a0 8c 92 a0 51 73 9a 9e 2b be 41 2f 4e fd 9d 18 b1 1f f6 ec Data Ascii: T m4Dmu pq~-*VJKoE8"D$O/D},8lSgB((.X2-DI69:Ux'=>YEM3_>`^Vsv<gs]SFi.SmPR%e,\|P40XK_:TU!T;vmV[-N1X9"J,oQs+A/N
2024-10-22 22:13:28 UTC	213	IN	Data Raw: 26 2c 9c 8e 7e 13 b4 fd 32 e2 c2 01 88 ac 55 99 fe 7d eb 72 cb bf 98 12 89 cb a6 e9 92 0d 41 2e 0b b6 03 48 83 f0 84 21 0a 61 66 a5 fc df c1 1a 13 b9 9e f4 13 c3 eb 33 cb ef 59 91 e9 fb 36 d4 3a 5e 9b f8 69 37 22 2f 3a 64 ea 8c 67 5e d3 95 d8 5b f8 c4 da 85 e6 e1 a1 aa 5d bf 03 c5 58 91 df 87 dc b0 8a 56 e0 83 fa c1 ce a1 86 78 29 35 79 aa 90 c8 1d 2e e8 b9 97 0c 35 5e 71 6f 70 76 fc d7 af 63 ae fb 90 5e ea 36 f2 cf 2c 32 3a 9f b5 3d 7b 63 d9 ae 6e 9f b5 eb eb f1 a9 d5 8d 1e 22 1d e6 7d d5 50 f5 62 4a 35 06 75 35 7e 1c 99 35 98 d2 12 be 1f f6 89 4a 78 54 b7 bb fe 23 c0 00 1d f8 5c fc 08 f1 25 fb 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: &,~2U}rA.H!af3Y6:^i7"/:dg^[]XVx)5y.5^qopvc^6,2:={cn"}PbJ5u5~5JxT#\%IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49741	104.26.11.58	443	6376	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:13:28 UTC	845	OUT	GET /Static/images/Branding/favicon.png HTTP/1.1 Host: www.timesheetz.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj; ai_user=JBLFi\|2024-10-22T22:13:23.894Z; __utma=56068014.72299502.1729635204.1729635204.1729635204.1; __utmc=56068014; __utmz=56068014.1729635204.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none); __utmt=1; __utmb=56068014.2.9.1729635205528; ai_session=/IMBU\|1729635205600.5\|1729635205600.5
2024-10-22 22:13:28 UTC	654	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 22:13:28 GMT Content-Type: image/png Content-Length: 2295 Connection: close last-modified: Fri, 21 Oct 2022 11:48:02 GMT etag: "0c543f942e5d81:0" x-powered-by: ASP.NET CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UN4kXwg4orHIWMPaBPzM55vbXN%2FcQRXdwGnP84%2BDxzz%2BbEz2ZMDOGETVRUNoZCdouuOIbbfDPb4GAt57t1T1w%2FT9Di29VVZKHp02fDGMohOLcPSWWJ2zdCFAfXbJ%2BA9HH5V3Cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6cd5b7cf4a2fdc-DFW
2024-10-22 22:13:28 UTC	715	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 08 89 49 44 41 54 78 da 9c 57 6b 6c 1c 57 15 3e 77 66 76 67 f6 bd f6 da a9 9d d8 4e 9a 47 f3 26 15 6d 09 24 12 01 92 b6 a9 44 0b 54 a2 84 04 9a 06 89 a6 aa a8 84 40 a0 42 fe 10 40 fc 08 ad 90 a8 0a 6d 29 52 23 a0 ad 54 55 91 12 55 fd 11 45 11 a5 85 86 36 44 4a 70 9b a4 b1 83 8d 53 3b 59 3f 76 d7 fb 9a 37 df b9 33 6b 8f 9b 4d 41 cc ea da 33 77 ee 3d 8f ef 7c e7 dc 33 e2 91 0b af 51 eb 12 f8 15 cd 19 12 42 90 ed b9 98 f1 c9 50 e2 e4 f8 2e ee 88 2c d7 2e 54 ec ea e6 ba 6b de d1 70 cc 65 1e 79 1d 02 Data Ascii: PNGIHDR szzgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxWklW>wfvgNG&m$DT@B@m)R#TUUE6DJpS;Y?v73kMA3w=\|3QBP.,.Tkpey
2024-10-22 22:13:28 UTC	1369	IN	Data Raw: dd f1 1d 6d b0 34 fc 44 cd 6d aa 75 b7 19 20 70 a5 71 ed 7e 14 a0 2d 2a 56 4a 96 4b 6f 45 38 22 c2 44 24 e4 d8 f7 cd ce 4f d2 2f fb be 44 7d b1 b4 2c 38 d1 8c 6c ed 53 94 08 8f e0 18 67 03 eb 42 9a de cb 28 28 2e 58 32 d1 98 de e3 87 1b 15 2d d8 44 d8 e0 82 49 36 39 e4 89 85 a9 c3 ca 3a 55 83 be bb 78 27 3d d0 bd 95 3e 97 59 45 4d df 9e 33 ce c3 5f 1e 3e f6 c9 bd 60 9a 17 86 85 b3 89 17 15 cd d2 5e e6 82 56 73 1b cb a6 cc f2 76 95 82 3c 67 e5 0e 14 73 f9 5d 12 cf 53 46 d3 69 dc 2e 53 d9 6d 50 52 d1 25 08 1e de 65 95 98 2c af 7c a5 50 ae 0d c4 93 d1 34 30 ef b7 58 1e 16 4b ce 0e 5f 86 cc 91 3a 54 55 21 54 d6 3b cb 76 6d a9 56 b2 ab 5b 2d cf 4e 31 f9 58 39 22 4a 8b f5 2c fd a0 7f 07 ed cc 6f a0 8c 92 a0 51 73 9a 9e 2b be 41 2f 4e fd 9d 18 b1 1f f6 ec a0 5d Data Ascii: m4Dmu pq~-*VJKoE8"D$O/D},8lSgB((.X2-DI69:Ux'=>YEM3_>`^Vsv<gs]SFi.SmPR%e,\|P40XK_:TU!T;vmV[-N1X9"J,oQs+A/N]
2024-10-22 22:13:28 UTC	211	IN	Data Raw: 9c 8e 7e 13 b4 fd 32 e2 c2 01 88 ac 55 99 fe 7d eb 72 cb bf 98 12 89 cb a6 e9 92 0d 41 2e 0b b6 03 48 83 f0 84 21 0a 61 66 a5 fc df c1 1a 13 b9 9e f4 13 c3 eb 33 cb ef 59 91 e9 fb 36 d4 3a 5e 9b f8 69 37 22 2f 3a 64 ea 8c 67 5e d3 95 d8 5b f8 c4 da 85 e6 e1 a1 aa 5d bf 03 c5 58 91 df 87 dc b0 8a 56 e0 83 fa c1 ce a1 86 78 29 35 79 aa 90 c8 1d 2e e8 b9 97 0c 35 5e 71 6f 70 76 fc d7 af 63 ae fb 90 5e ea 36 f2 cf 2c 32 3a 9f b5 3d 7b 63 d9 ae 6e 9f b5 eb eb f1 a9 d5 8d 1e 22 1d e6 7d d5 50 f5 62 4a 35 06 75 35 7e 1c 99 35 98 d2 12 be 1f f6 89 4a 78 54 b7 bb fe 23 c0 00 1d f8 5c fc 08 f1 25 fb 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: ~2U}rA.H!af3Y6:^i7"/:dg^[]XVx)5y.5^qopvc^6,2:={cn"}PbJ5u5~5JxT#\%IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	53543	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 22:14:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FaOU+KVYCHLglnt&MD=opa4dG2A HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-22 22:14:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e7214f2f-093b-4ee6-828a-e9edc886522c MS-RequestId: f7ca14ec-9a05-469c-8561-a550bca1286b MS-CV: ddDoIjHP5Ui0iz6X.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 22 Oct 2024 22:14:05 GMT Connection: close Content-Length: 30005
2024-10-22 22:14:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-22 22:14:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5264, Parent PID: 3864

General

Target ID:	0
Start time:	18:13:07
Start date:	22/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6376, Parent PID: 5264

General

Target ID:	2
Start time:	18:13:11
Start date:	22/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,3178922573065967647,11451009141796564964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4608, Parent PID: 3864

General

Target ID:	3
Start time:	18:13:14
Start date:	22/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.timesheetz.net/EtzWeb/u/015bcc8ebe"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	TCP traffic: 192.168.2.8:53541 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:60155 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /EtzWeb/u/015bcc8ebe HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /EtzWeb/Error/AlreadyEtzSigned HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /EtzWeb/u/015bcc8ebe HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /EtzWeb/s/35083236/7f68d5aa043c400babd41f62b774fd64 HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /EtzWeb/Error/AlreadyEtzSigned HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /EtzWeb/Css/bootstrap.css HTTP/1.1Host: www.timesheetz.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSignedAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /Static/images/Branding/error-page.png HTTP/1.1Host: www.timesheetz.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSignedAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /Static/images/Branding/error-page.png HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FaOU+KVYCHLglnt&MD=opa4dG2A HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Static/images/Branding/favicon.png HTTP/1.1Host: www.timesheetz.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.timesheetz.net/EtzWeb/Error/AlreadyEtzSignedAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj; ai_user=JBLFi\|2024-10-22T22:13:23.894Z; __utma=56068014.72299502.1729635204.1729635204.1729635204.1; __utmc=56068014; __utmz=56068014.1729635204.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none); __utmt=1; __utmb=56068014.2.9.1729635205528
Source: global traffic	HTTP traffic detected: GET /Static/images/Branding/favicon.png HTTP/1.1Host: www.timesheetz.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ApplicationGatewayAffinityCORS=c7581c187614b8cc3302bd4d87317ffa; ApplicationGatewayAffinity=c7581c187614b8cc3302bd4d87317ffa; ASP.NET_SessionId=kfsipiwxjnnjwuzjxwxrkytj; ai_user=JBLFi\|2024-10-22T22:13:23.894Z; __utma=56068014.72299502.1729635204.1729635204.1729635204.1; __utmc=56068014; __utmz=56068014.1729635204.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none); __utmt=1; __utmb=56068014.2.9.1729635205528; ai_session=/IMBU\|1729635205600.5\|1729635205600.5
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FaOU+KVYCHLglnt&MD=opa4dG2A HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.timesheetz.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: dc.services.visualstudio.com

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.timesheetz.net/EtzWeb/u/015bcc8ebe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
http://www.timesheetz.net/EtzWeb/u/015bcc8ebe