Edit tour

Windows Analysis Report
securedoc_20241104T081116.html

Overview

General Information

Sample name:	securedoc_20241104T081116.html
Analysis ID:	1552224
MD5:	90e93f5ac3097e2e3221afb12c51fde0
SHA1:	52a3c2484663bc9617ac86d0942c48ff22a44515
SHA256:	659442828c15a0141f5c5d16200ad36572c7ea6b9d6275fe6245dc12d103668e
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suspicious Javascript code found in HTML file

Detected hidden input values containing email addresses (often used in phishing pages)

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\securedoc_20241104T081116.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1856,i,12630501653004195865,3579003092620535402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T14:29:03.470280+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.16	49740	TCP
2024-11-08T14:29:41.039647+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.16	49743	TCP

HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688%2Ecorpmailsvcs%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImxmcmFuY29AaGFpZ3JvdXAuY29tIiA8bGZyYW5jb0BoYWlncm91cC5jb20%2B%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27KcAt6m7ewViKVN03X%2BbJAA%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1730729476447%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,16417%5D,%27Body-1730729476447%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,2,%0D%0A%27%27,%0D%0A%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,%0D%0A5,%5B16417,66199%5D,%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B82616,33405%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27DTJqJGnNKxiWH%2B%2B%2FQjzuDWHX1jc%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27VsMhLQ3SnIOj%2Fpx%2BZJ3qeBitZQoXHLamiificjDMUghbKKAIkTDpRGYGKiaH9JDOcnGKsFQJTdMTEV06z7ULIfw1ZTDFy9NtNP7c3Nw8iMDOUAM9c4HP9CeOU0Q5p16lrobXZ43pKCw1qTSYQexaurynIO3jxfcvePYMa5B0KCGCn%2Be%2FaFslddl2Qeur3om9XsJzuQoo5t9YMP9YFeAgWrbjjfGbUDXkd7YYDf1DCuKxCSTo61vnmBjvB8%2F0W38LNHqqCGOorHiZhaYh%2Bhg03NYEk%2FXivNWhNzfK6VHN0n8wbjlkwNkHKKec2x7itDFXv7gV33OAVneRYndOjb6u0F2Jnn%2BT7tXs72u%2F%2FItXHi5CXmTEBxHoulj1KNzgm%2FwBkz9zlrikxEXAWf4ZaT65xXF1s99ZUqO0PQfMAAL%2FDlNZ0%2BvY0qGZ%2B8OuX4WBTphxc2belL4DMNILerAtjtUE%2FvFpA7arFsH0HcCVZ83Fps42UcKw8pxGl8YYVMqoeM0Xdg%2BPojRowpxgeZlk%2FO71jeY1CGJ5c8137yquwyVfhI4H6qRJQIM1OJJf5hIoIoX7yrCb%2BqwVr3bReXEW3DUesfetxeHF5gfBlrPmW4K2pI7rzwiTfc9pKC%2FW0fGMVVaEoOJNVjcHsptmnShfjNHCcIn6MDWFsmALx%2FEhpUKSEhdGkTfUT8KsiktfxnMUKDlJ7KAaxe4phLdlhmLa%2Begk8xPRt3okwf2cfFotr0MoRouW3WRcRplYzCVAaeqIEhj7WSsORhctvH2j%2B8SQ08EWbGHtuuIqsJ5LK8e43JcRLX6Z5JOqF3EhbUgqIqsWNMEf4hsAaaPm8WnLVumOm3jAsId8RewE99TxiZLZ%2BfoOxpgYcig5T1nTfKgMo%2Bi%2FgpBywEWCfPeAK0XYXpSGik2aXyJGMJql3GqCnURc2ReowuD3fhIs%2B8THxsqv4awiGMIc5cigZN8qBjSMyb8WJQsLwNvZHaUmzzSySNsuCktNShHLQRt3Q%2F3dj4c4L9zjb2EKUgh5HzQWF2qMZTjRKtOWGUputU9xfGgEdvTs9AV6uMR64e681qtuUb%2FLMe%2FDsIQ0ilDakUmEO0MNejSEfcPiE84NxqZnXPDSwrR5TeYYpYdWZaSWWWTnf%2BhJLZEVKqW9afv%2BsD3I7UGGwWZPDCFXreIv5ghthZ1xhqeg%2B8osmFEM%2F4zSaD4vHJG9KbqQwY6RCwpOa3oEDuAAuc4cyjqzfSoxT2EL2Pm1sbq1IqXnmaoSK%2BPlb6QL%2FAc8eWJjo7I0WPBfOr%2BWbKDe1ssQzxV3t0aDLguQI5u1SIUqKxJ0RqR9rxKisd5QR%2FS4wotnjBo9J9quBIF9b2AQNBcqV1nuoVId5ZlgHQKExUXKBa5EpZNKtiUeK7kAjzDigsKI3ceOUnc5hBkkaCx%2BebRegeOBEGwdiWKYuz7y15jqQ%2BZaJHZkPW2MTCYmc%2Fl%2B2nRCRxxyrMUdQ66xvR3qtrb94ll

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.16:49740
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.16:49743

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /ajax/libs/select2/4.0.12/css/select2.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /postx.css HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=9AGwpPUMFW/C9ztKe3o+6zfA3LREXWhFDNBhw4ubmbUbwNBIYvAxmGA/Xl/VUwpm/UkZhNtV88h23Vcy0H714Vx+qFwCzVQpLjFLlCvZDtYg29zQdIANeNqGpKaa
Source: global traffic	HTTP traffic detected: GET /websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
Source: global traffic	HTTP traffic detected: GET /CRES_login_bg.jpg HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Regular.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
Source: global traffic	HTTP traffic detected: GET /websafe/images/loginbg.gif HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Light.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-SemiBold.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Bold.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
Source: global traffic	HTTP traffic detected: GET /websafe/images/loginbg.gif HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=48DAF49D4AD0F29937E90157B4B60CD0; AWSALB=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; AWSALBCORS=/i2jlVMUWd8/ZvVwpHuNzYVUm96sRCFdTIZvgr3hYIYU0R3IscGw2NOGZN4RhmcwX1UDjq94GPiU2j2w66+U7755YbOxiqf1Ai9eYX6niqm+PdYt8w5j7QHNJ/ZA
Source: global traffic	HTTP traffic detected: GET /keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; AWSALBCORS=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie
Source: global traffic	HTTP traffic detected: GET /websafe/images/pullFeature/arrowDown.svg HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie
Source: global traffic	HTTP traffic detected: GET /websafe/images/pullFeature/arrowDown.svg HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=48DAF49D4AD0F29937E90157B4B60CD0; AWSALB=GYfP5Gh4N/LpZExrEkT1Iws3HS2mO+R5FaizPj2N/Nydk4NpASNGg5UIcwMCzWiQUKhxIJWpyuryLrYzgT5Ryw23pK0ZD1EuAkD/2kGd5khdg2kFyEqBIt2BaE0E; AWSALBCORS=ff/ih7FVU30M/JR3oSG4GjM5tOwfmg/lf1Rr1anY1UwmPyvwRrcokj0dHULZWqlXX3THOXUkjpY3fUlSX9ofDUVqup7g0XoUOMh5icn3Vl9/qdRnMKheTksNrN+M
Source: global traffic	HTTP traffic detected: GET /CRES_login_bg.jpg HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C4vuXkggBWFuftH&MD=P1xDs3ns HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=1kKxToIYsRZDBy2H3zLT/VHGVb2SRzcdREUBn1BahAMyVPkuYU5i3YKVoWfj19a8cDSOWcjiv1p6tQRZ4SAAiArkGsPaZAk690oaHtTXF3k4zdmqM6Id29hbxdC+
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=Ez/h3FNMbocgxTkuRvFH3IditCvqQ3h6YLp3NtEnJ8YnD3m5vsJBYqahyI3bQRJ6ITpr+Ioeza1dAKE6RI2K+41dOkvZs4GzG2qoT6vZreFfK/AjBuuA5johhCqk
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C4vuXkggBWFuftH&MD=P1xDs3ns HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688%2Ecorpmailsvcs%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImxmcmFuY29AaGFpZ3JvdXAuY29tIiA8bGZyYW5jb0BoYWlncm91cC5jb20%2B%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27KcAt6m7ewViKVN03X%2BbJAA%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1730729476447%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,16417%5D,%27Body-1730729476447%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,2,%0D%0A%27%27,%0D%0A%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,%0D%0A5,%5B16417,66199%5D,%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B82616,33405%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27DTJqJGnNKxiWH%2B%2B%2FQjzuDWHX1jc%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27VsMhLQ3SnIOj%2Fpx%2BZJ3qeBitZQoXHLamiificjDMUghbKKAIkTDpRGYGKiaH9JDOcnGKsFQJTdMTEV06z7ULIfw1ZTDFy9NtNP7c3Nw8iMDOUAM9c4HP9CeOU0Q5p16lrobXZ43pKCw1qTSYQexaurynIO3jxfcvePYMa5B0KCGCn%2Be%2FaFslddl2Qeur3om9XsJzuQoo5t9YMP9YFeAgWrbjjfGbUDXkd7YYDf1DCuKxCSTo61vnmBjvB8%2F0W38LNHqqCGOorHiZhaYh%2Bhg03NYEk%2FXivNWhNzfK6VHN0n8wbjlkwNkHKKec2x7itDFXv7gV33OAVneRYndOjb6u0F2Jnn%2BT7tXs72u%2F%2FItXHi5CXmTEBxHoulj1KNzgm%2FwBkz9zlrikxEXAWf4ZaT65xXF1s99ZUqO0PQfMAAL%2FDlNZ0%2BvY0qGZ%2B8OuX4WBTphxc2belL4DMNILerAtjtUE%2FvFpA7arFsH0HcCVZ83Fps42UcKw8pxGl8YYVMqoeM0Xdg%2BPojRowpxgeZlk%2FO71jeY1CGJ5c8137yquwyVfhI4H6qRJQIM1OJJf5hIoIoX7yrCb%2BqwVr3bReXEW3DUesfetxeHF5gfBlrPmW4K2pI7rzwiTfc9pKC%2FW0fGMVVaEoOJNVjcHsptmnShfjNHCcIn6MDWFsmALx%2FEhpUKSEhdGkTfUT8KsiktfxnMUKDlJ7KAaxe4phLdlhmLa%2Begk8xPRt3okwf2cfFotr0MoRouW3WRcRplYzCVAaeqIEhj7WSsORhctvH2j%2B8SQ08EWbGHtuuIqsJ5LK8e43JcRLX6Z5JOqF3EhbUgqIqsWNMEf4hsAaaPm8WnLVumOm3jAsId8RewE99TxiZLZ%2BfoOxpgYcig5T1nTfKgMo%2Bi%2FgpBywEWCfPeAK0XYXpSGik2aXyJGMJql3GqCnURc2ReowuD3fhIs%2B8THxsqv4awiGMIc5cigZN8qBjSMyb8WJQsLwNvZHaUmzzSySNsuCktNShHLQRt3Q%2F3dj4c4L9zjb2EKUgh5HzQWF2qMZTjRKtOWGUputU9xfGgEdvTs9AV6uMR64e681qtuUb%2FLMe%2FDsIQ0ilDakUmEO0MNejSEfcPiE84NxqZnXPDSwrR5TeYYpYdWZaSWWWTnf%2BhJLZEVKqW9afv%2BsD3I7UGGwWZPDCFXreIv5ghthZ1xhqeg%2B8osmFEM%2F4zSaD4vHJG9KbqQwY6RCwpOa3oEDuAAuc4cyjqzfSoxT2EL2Pm1sbq1IqXnmaoSK%2BPlb6QL%2FAc8eWJjo7I0WPBfOr%2BWbKDe1ssQzxV3t0aDLguQI5u1SIUqKxJ0RqR9rxKisd5QR%2FS4wotnjBo9J9quBIF9b2AQNBcqV1nuoVId5ZlgHQKExUXKBa5EpZNKtiUeK7kAjzDigsKI3ceOUnc5hBkkaCx%2BebRegeOBEGwdiWKYuz7y15jqQ%2BZaJHZkPW2MTCYmc%2Fl%2B2nRCRxxyrMUdQ66xvR3qtrb94ll
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: static.cres-aws.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: res.cisco.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: securedoc_20241104T081116.html	String found in binary or memory: http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUA
Source: chromecache_114.2.dr	String found in binary or memory: http://scripts.sil.org/OFLInterLightWeightSlant
Source: chromecache_131.2.dr	String found in binary or memory: http://scripts.sil.org/OFLInterSemiBoldWeightSlant
Source: chromecache_119.2.dr	String found in binary or memory: http://scripts.sil.org/OFLWeightSlant
Source: chromecache_130.2.dr	String found in binary or memory: http://scripts.sil.org/OFLWeightSlantRegular
Source: securedoc_20241104T081116.html	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
Source: securedoc_20241104T081116.html	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css
Source: securedoc_20241104T081116.html	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js
Source: chromecache_131.2.dr, chromecache_114.2.dr	String found in binary or memory: https://github.com/rsms/inter)Inter
Source: chromecache_130.2.dr	String found in binary or memory: https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter
Source: chromecache_119.2.dr	String found in binary or memory: https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter
Source: chromecache_121.2.dr, chromecache_122.2.dr	String found in binary or memory: https://github.com/select2/select2/blob/master/LICENSE.md
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com/websafe/custom.action?cmd=authFrame
Source: chromecache_116.2.dr, chromecache_128.2.dr	String found in binary or memory: https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=lfranco
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com/websafe/images/loginbg.gif
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com/websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgn
Source: chromecache_116.2.dr	String found in binary or memory: https://res.cisco.com/websafe/register?uuid=28a507f3000001930bf6ac4cac2b64258a374246
Source: chromecache_128.2.dr	String found in binary or memory: https://res.cisco.com/websafe/register?uuid=937f5276000001930bf6b01fac2b64258a374246
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/envelopeopener/decrypt_envelope.jsp
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/keyserver/Logout
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/keyserver/keyserver
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=AddrNotShown
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=PPNotShown
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=RegEnvelope
Source: securedoc_20241104T081116.html	String found in binary or memory: https://res.cisco.com:443/websafe/pswdForgot.action
Source: securedoc_20241104T081116.html	String found in binary or memory: https://static.cres-aws.com/CRES_login_bg.jpg
Source: securedoc_20241104T081116.html	String found in binary or memory: https://static.cres-aws.com/postx.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winHTML@13/39@16/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\securedoc_20241104T081116.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1856,i,12630501653004195865,3579003092620535402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1856,i,12630501653004195865,3579003092620535402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://scripts.sil.org/OFLWeightSlant	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLWeightSlantRegular	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLInterSemiBoldWeightSlant	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/securedoc_20241104T081116.html	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLInterLightWeightSlant	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
res.cisco.com	54.161.165.135	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.250.185.132	true	false	high
d2qj7djftjbj85.cloudfront.net	13.32.121.62	true	false	unknown
static.cres-aws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg	false		high
https://static.cres-aws.com/fonts/Inter/Inter-Light.ttf	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en	false		high
https://res.cisco.com/websafe/images/loginbg.gif	false		high
https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en&try=1	false		high
https://static.cres-aws.com/fonts/Inter/Inter-Regular.ttf	false		high
https://res.cisco.com/websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en	false		high
https://static.cres-aws.com/fonts/Inter/Inter-SemiBold.ttf	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en&try=1	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en	false		high
https://static.cres-aws.com/postx.css	false		high
https://static.cres-aws.com/CRES_login_bg.jpg	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en	false		high
https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js	false		high
file:///C:/Users/user/Desktop/securedoc_20241104T081116.html	true	Avira URL Cloud: safe	unknown
https://res.cisco.com/keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36	false		high
https://static.cres-aws.com/fonts/Inter/Inter-Bold.ttf	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://res.cisco.com/websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgn	securedoc_20241104T081116.html	false		high
https://github.com/select2/select2/blob/master/LICENSE.md	chromecache_121.2.dr, chromecache_122.2.dr	false		high
https://res.cisco.com:443/websafe/help?topic=RegEnvelope	securedoc_20241104T081116.html	false		high
https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter	chromecache_130.2.dr	false		high
https://res.cisco.com/websafe/register?uuid=28a507f3000001930bf6ac4cac2b64258a374246	chromecache_116.2.dr	false		high
https://res.cisco.com/websafe/custom.action?cmd=authFrame	securedoc_20241104T081116.html	false		high
https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter	chromecache_119.2.dr	false		high
http://scripts.sil.org/OFLWeightSlant	chromecache_119.2.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443/websafe/help?topic=PPNotShown	securedoc_20241104T081116.html	false		high
http://scripts.sil.org/OFLWeightSlantRegular	chromecache_130.2.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443/websafe/help?topic=AddrNotShown	securedoc_20241104T081116.html	false		high
https://res.cisco.com:443/envelopeopener/decrypt_envelope.jsp	securedoc_20241104T081116.html	false		high
https://res.cisco.com/websafe/register?uuid=937f5276000001930bf6b01fac2b64258a374246	chromecache_128.2.dr	false		high
https://res.cisco.com:443/websafe/pswdForgot.action	securedoc_20241104T081116.html	false		high
http://scripts.sil.org/OFLInterLightWeightSlant	chromecache_114.2.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443	securedoc_20241104T081116.html	false		high
https://res.cisco.com:443/keyserver/keyserver	securedoc_20241104T081116.html	false		high
https://github.com/rsms/inter)Inter	chromecache_131.2.dr, chromecache_114.2.dr	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUA	securedoc_20241104T081116.html	false		high
http://scripts.sil.org/OFLInterSemiBoldWeightSlant	chromecache_131.2.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443/keyserver/Logout	securedoc_20241104T081116.html	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
13.32.121.62	d2qj7djftjbj85.cloudfront.net	United States	16509	AMAZON-02US	false
13.32.121.35	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.161.165.135	res.cisco.com	United States	14618	AMAZON-AESUS	false
54.234.149.46	unknown	United States	14618	AMAZON-AESUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552224
Start date and time:	2024-11-08 14:28:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	securedoc_20241104T081116.html
Detection:	MAL
Classification:	mal52.phis.winHTML@13/39@16/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.186.174, 66.102.1.84, 142.250.185.234, 34.104.35.123, 142.250.186.170, 199.232.210.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: securedoc_20241104T081116.html

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: ://
URL: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "Register", "text_input_field_labels": [ "ifranco@haigroup.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "Register", "text_input_field_labels": [ "ifranco@haigroup.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html Model: claude-3-haiku-20240307	```json { "brands": [ "Secure Email Encryption Service" ] }
	```json { "brands": [ "Secure Email Encryption Service" ] }
URL: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html Model: claude-3-haiku-20240307	```json { "brands": [ "Secure Email Encryption Service" ] }
	```json { "brands": [ "Secure Email Encryption Service" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.32.121.35	https://gofile.me/7wODs/99hfK37gz	Get hash	malicious	Annabelle	Browse
13.32.121.35	securedoc_20241008T101508.html	Get hash	malicious	Unknown	Browse
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
239.255.255.250	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Otc Workforce Review & Compensation d1tj7WVZ.pdf	Get hash	malicious	Unknown	Browse
	https://appdata.lclouds.pro	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.canva.com/design/DAGV5EObRdI/I7eos98ZtlH9jC4ToJM3Lw/view?utm_content=DAGV5EObRdI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	EFT Remittance_CQDM.html	Get hash	malicious	Mamba2FA	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	https://assets-usa.mkt.dynamics.com/67a616d1-119c-ef11-8a66-00224806e117/digitalassets/standaloneforms/08a80dd6-5e9c-ef11-8a6a-6045bd04c6a1	Get hash	malicious	Unknown	Browse
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse
13.32.121.62	https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D	Get hash	malicious	Unknown	Browse
13.32.121.62	https://www.lusha.com/privacy_topic/control-your-profile/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
res.cisco.com	securedoc_20241028T070148.html	Get hash	malicious	Unknown	Browse	34.235.221.210
	securedoc_20241008T101508.html	Get hash	malicious	Unknown	Browse	50.17.52.147
	https://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	35.168.85.253
	https://fb1f1d-d3.myshopify.com/pages/fb1f1d-d3-scanning#0YnJhbmRpLnRyeW9uQGFjYWRlbWljcGFydG5lcnNoaXBzLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	54.243.162.14
	securedoc_20240805T101719.html	Get hash	malicious	Unknown	Browse	3.210.249.249
	securedoc_20240521T074217.html	Get hash	malicious	Unknown	Browse	54.88.189.149
	securedoc_20240509T112530.html	Get hash	malicious	Unknown	Browse	18.233.198.142
	securedoc_20240328T081124.html	Get hash	malicious	Unknown	Browse	184.94.241.74
	securedoc_20240212T082824.html	Get hash	malicious	Unknown	Browse	184.94.241.74
	securedoc_20240207T142952.html	Get hash	malicious	Unknown	Browse	184.94.241.74
d2qj7djftjbj85.cloudfront.net	securedoc_20241028T070148.html	Get hash	malicious	Unknown	Browse	13.32.121.40
	securedoc_20241008T101508.html	Get hash	malicious	Unknown	Browse	13.32.121.110
	securedoc_20240805T101719.html	Get hash	malicious	Unknown	Browse	18.66.27.82
	securedoc_20240521T074217.html	Get hash	malicious	Unknown	Browse	13.32.121.110
	securedoc_20240509T112530.html	Get hash	malicious	Unknown	Browse	18.160.225.62
	securedoc_20240328T081124.html	Get hash	malicious	Unknown	Browse	108.138.85.20
	securedoc_20240212T082824.html	Get hash	malicious	Unknown	Browse	108.138.85.60
	securedoc_20240207T142952.html	Get hash	malicious	Unknown	Browse	3.163.115.70
	bankozk_securedoc_20231214T140252.html	Get hash	malicious	Unknown	Browse	18.173.166.40
cdnjs.cloudflare.com	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	EFT Remittance_CQDM.html	Get hash	malicious	Mamba2FA	Browse	104.17.25.14
	Digiturk.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Csc-File-260593301.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://cgi-wsc.alfahosting.de/extras/public/photos.cls/selection/addAll?cc=0.653810755815357&accountId=AAHS10INX3Z1&filter=&redirectUrl=https://panimex.cl/158983/secure-redirect#jacquie.treagus+csc.gov.au	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.docusign.net/Signing/EmailStart.aspx?a=bee32ac6-9e7b-46bc-b1a7-7d20209f168e&etti=24&acct=60e19a9b-9a1c-4a80-be2d-f078553cd3fb&er=7cd6fca8-f673-43e6-aa59-6aa11160dad4	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://secured-login.net/XdXJqsPWh0dHaBzOi8vc2vVjdXJluuZC1stb2dpbi5uaZXwQvcGFnZXMvYzM5NTVimMWM0OGEmZW1haWxfdGVtcGxhdGVfaWQ9NzUwNDcyOCZhY3Rpb249cHJldmlldyZ1c2VyX2lkPTk3NjU4ODMx	Get hash	malicious	KnowBe4	Browse	104.17.24.14
	) wavr3e.htm	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.24.14
	Transcript_Sh03 summit bhc.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TtyCIqbov8.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://appdata.lclouds.pro	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	188.114.96.3
	https://www.canva.com/design/DAGV5EObRdI/I7eos98ZtlH9jC4ToJM3Lw/view?utm_content=DAGV5EObRdI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.79.73
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	172.67.74.152
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	172.67.69.226
	EFT Remittance_CQDM.html	Get hash	malicious	Mamba2FA	Browse	104.17.25.14
AMAZON-02US	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	1nzNNooNMS.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	Le55bnMCON.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	z8yxMFhhZI.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.31
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	108.131.187.52
	wrgmhT3TP7.elf	Get hash	malicious	Mirai	Browse	13.236.43.141
	kTbv9ZA2x0.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.31
	IwmwOaVHnd.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.89
	gaYiWz75kv.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	SecuriteInfo.com.Trojan.Linux.GenericKD.28459.8905.27219.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
AMAZON-02US	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	1nzNNooNMS.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	Le55bnMCON.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	z8yxMFhhZI.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.31
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	108.131.187.52
	wrgmhT3TP7.elf	Get hash	malicious	Mirai	Browse	13.236.43.141
	kTbv9ZA2x0.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.31
	IwmwOaVHnd.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.89
	gaYiWz75kv.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.228
	SecuriteInfo.com.Trojan.Linux.GenericKD.28459.8905.27219.elf	Get hash	malicious	Unknown	Browse	34.243.160.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	Otc Workforce Review & Compensation d1tj7WVZ.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	https://appdata.lclouds.pro	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	https://www.canva.com/design/DAGV5EObRdI/I7eos98ZtlH9jC4ToJM3Lw/view?utm_content=DAGV5EObRdI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	EFT Remittance_CQDM.html	Get hash	malicious	Mamba2FA	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	https://assets-usa.mkt.dynamics.com/67a616d1-119c-ef11-8a66-00224806e117/digitalassets/standaloneforms/08a80dd6-5e9c-ef11-8a6a-6045bd04c6a1	Get hash	malicious	Unknown	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	asegurar.vbs	Get hash	malicious	Remcos	Browse	4.175.87.197 52.149.20.212 184.28.90.27
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	4.175.87.197 52.149.20.212 184.28.90.27

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 12:28:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9795672079663844
Encrypted:	false
SSDEEP:	48:8Rd/T3jqHlZidAKZdA1FehwiZUklqehQy+3:8DfYDvy
MD5:	73977CC5B4764AC9998434657D863176
SHA1:	55A504ECCCE234C10D7393138A379ED454240A5E
SHA-256:	B44C5A3F48CA48864B9B09BEA74D8DC38D1434085E128624151CC8761007CF2C
SHA-512:	327D8F2C4EE28CFF787B8323AF0E9600B54BAE5B34256733A48D4747071F02028E5346B85A63D0B70563C1F0AC4E2B9ECCC83FC34B785B74ABDE4B80F34B7897
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......'.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 12:28:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.994525295965365
Encrypted:	false
SSDEEP:	48:8Md/T3jqHlZidAKZdA1seh/iZUkAQkqehfy+2:8EfYN9QWy
MD5:	D119999C1AB84066CFC2A9290D1E0C77
SHA1:	69E4A9A9E465BDE9C6A917F003B41F683C87927D
SHA-256:	E3C4B959547747E514E9CEC0824EAD4929D3164894C50C292CAE24BEB56B9259
SHA-512:	9A8AC05E13E396CAD85DC9471C860C94D9AE16A677F7840DEBC1B0271DD095DF5EDFF0B88BC8CF229960CCB6B4C7E01912930702BD1C1CF6EBA00966C6C4D536
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....$.'.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.001828655058874
Encrypted:	false
SSDEEP:	48:8Md/T3jAHlZidAKZdA14meh7sFiZUkmgqeh7sVy+BX:8EfGRnjy
MD5:	90B1DBFEDE75D01AADEBC920438AD2C4
SHA1:	0B2EF54BFFCAE8F678A6A85D4F1772BBDBE9B223
SHA-256:	21CFC053FAE81FF98BA9130EE4FB1383E78979B93A5BA16E51E534285806E344
SHA-512:	757B52D8BCC4216908606422DDF59142D31E1DE085B4EA69A0C5BAB9815F18D91F09A8E94EF8FD7B1A080CC73232D9DE46BB7CBEEEB6C37B2A45859E4E62E45A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 12:28:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.988630102160623
Encrypted:	false
SSDEEP:	48:8hd/T3jqHlZidAKZdA1TehDiZUkwqehLy+R:8TfY+dy
MD5:	9476AC4209E92698869F93F7E362D1D1
SHA1:	502603297CFE2EF55614490023754C4DADE98B65
SHA-256:	CBBC617B431A7DDE8A432E222D628D61ABF45640CAC391117B9A7EABBF94306D
SHA-512:	7679F20E0C482F21D2DEDD926DB747B90EEE1076597D7010C5D049D27896FEE36ED494602F9E0673E3ED7FF212203AF4713C60BA406A2FDA0553FA06894FFA7E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......'.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 12:28:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9809374165959603
Encrypted:	false
SSDEEP:	48:8od/T3jqHlZidAKZdA1dehBiZUk1W1qehJy+C:8gfYu9py
MD5:	2274139350D0D581658535E3D9006679
SHA1:	37F3B3251D197559455F03AC30869A983955AE4D
SHA-256:	5430F728871B172DAD239FB768C827A0EF0970379323659E9BEE2896901E3FFE
SHA-512:	484CD5F695B6F58E00C515D5F2A516E5069925314948B1BF51008601DC1885E439647FAE980DEECDD1F38CF0BACF6315265ED8B5B5FFD3279967A67CF522FC28
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....:..'.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 12:28:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9883634155325294
Encrypted:	false
SSDEEP:	48:8Fd/T3jqHlZidAKZdA1duTeehOuTbbiZUk5OjqehOuTbjy+yT+:8nfYETfTbxWOvTbjy7T
MD5:	A0AAAF485010A71C7F1EA1DE3953EF85
SHA1:	14C6DCA14D2B4DE3A520D5EC77D713EAD8752847
SHA-256:	AC276000C70BD1C8E2AE557B2F5628BAB769F9E01CE2BFCF2DCC3CAFDDED873E
SHA-512:	4926688CB5F3E70844267E1993CE98512FEF681EDDF1B8CE13D7DD9AA229C92CDF9B03892D10AADC03DC615F9EC8F97B7C315FB4A9A21D16F226942138FAEB4E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....y.'.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IhY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (554)
Category:	downloaded
Size (bytes):	125394
Entropy (8bit):	5.069062799454485
Encrypted:	false
SSDEEP:	1536:ZrCMDD2MR/9fU2j2L292qgJYq1x2KLLn+mbkQ7ThzeSRwJWL0V8bK/FMGFOFlLn5:HDFfU2j2L292qgZxxv+mAQXhzeSRwzQ
MD5:	A0B4FF216E038470B000B63F5AA39816
SHA1:	319D6BB77F2115DA9F977569477AC010F87E6386
SHA-256:	7A61694ACF36F22050B90F751DBAFC330D5025471F83F5C08F663CD2633448F7
SHA-512:	A3B38E3CC9B204D809DBAEEB1417E878EFA9A2D8AAF9E311051FF6FEDD1C1F92F89901274EBD43A163F03D42567D6586063333A3ECDDC128A64773315BB1B094
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://static.cres-aws.com/postx.css
Preview:	/* Inter Font Library */..@font-face {. font-family: "Inter";. font-weight: 100;. src: url("./fonts/Inter/Inter-Thin.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 200;. src: url("./fonts/Inter/Inter-ExtraLight.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 300;. src: url("./fonts/Inter/Inter-Light.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 400;. src: url("./fonts/Inter/Inter-Regular.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 500;. src: url("./fonts/Inter/Inter-Medium.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 600;. src: url("./fonts/Inter/Inter-SemiBold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 700;. src: url("./fonts/Inter/Inter-Bold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 800;. src: url("./fonts/Inter/Inter-ExtraBol

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	387
Entropy (8bit):	5.179130709592589
Encrypted:	false
SSDEEP:	6:TMVBd/NFmc4slJUY7BuwTARZARtAUbWDYHsyXIzqVJEgqIzqVNQs1jvpJrEIdHfi:TMHdVFvnNuuAiOYHzXw5jNdHK
MD5:	1F6AF349658BA40D72AA4C87AECC722A
SHA1:	E3ABD390D66D37C5C245C6AD172E5433584E2B39
SHA-256:	042CD20A95524AAAE53879E8D0210E9D79F0EB9E42E7C6E25EE4A8BDE703FAC0
SHA-512:	4A508F8F4AF98DAEC5218A4B38103898661D1B430783DE4DB314F1EA9D1D891B85987DF734D9697A49A03F23E54B8B137E16B64E519658351EBADD7330E4C79D
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" .viewBox="0 0 16 16">.<defs><style>.b{fill:#ffffff;fill-rule:evenodd;}</style>.</defs>.<path class="b" d="M3.881,6.131c.342-.342,.896-.342,1.237,0l2.881,2.881,2.881-2.881c.342-.342,.896-.342,1.237,0s.342,.896,0,1.237l-3.5,3.5c-.342,.342-.896,.342-1.237,0l-3.5-3.5c-.342-.342-.342-.896,0-1.237Z"/></svg>

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 14 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)Inter LightRegular3.019;
Category:	downloaded
Size (bytes):	304092
Entropy (8bit):	6.319721866705066
Encrypted:	false
SSDEEP:	6144:C3jzGK0leqjmxgOqp888TQIPOer74S1/a9cckpRo/iOmL:C3jzGHAq+8IzrUm7o/OL
MD5:	60C8F64064078554B6469EEDA25944EB
SHA1:	732E278A85762A0EDFB4E077E44E3EB39D8AF92E
SHA-256:	7FB161BBEB1C03F21D9A80601400D803E7EA7DD6FC8EA164F2B2A073E7722953
SHA-512:	57F3E7EC496FCA463848AC63E5BD6EC0967A1CC461D0580868B0625DCA78ECEC14FC13391E4B8F1BA08A598DFAF3DD08D721AD2B5AD31C35B9CC9BFAB3CFA03F
Malicious:	false
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Light.ttf
Preview:	............GDEF1.1...;l....GPOSDT{6..?...!dGSUB..fx..`...B.OS/2"3nb..n....`STAT.M.?.......Dcmap/....n...e.gasp......;d....glyf...........qhead-.aF..Fp...6hhea......nt...$hmtx......F...'.loca.]........'.maxp........... name5.\.......8post..5r......d.preph..................................!...!...!...!...!...........................@.........................O............!#.3.#.#.!.!..........~...................O.............#..!#.3.#.#.!.!."&54632....!"&54632..............~........3MM37II..3MM37II...........M37II73MM37II73M...O...../.&.......l.4.....O.......&.......f.O.....O.......&.......d.......O.....P.&.......j.,.....O.............&..!#.3.#.#.!.!."&546632......'2654&#"..............~.........p.H{JKzHHzK@WW@@WW............pKzHHzKJ{HuY?@XY?@X...O.......&...............O...'...&.......v.......O.......&.......m.m.....O.......&.......n.4.....O...'...&.......v.......O.....a.&.......s.,.....O.......&...............O.......&...............O.......&.......{.L.....O.....g.&...............O

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1280 x 808
Category:	downloaded
Size (bytes):	10598
Entropy (8bit):	7.973575732670468
Encrypted:	false
SSDEEP:	192:0Dszh0YIrh919BR4ljLo1af3wHZY4laNGRO+1BMuq:NNohhn4lpfjkRT1BMp
MD5:	C22D6210FC87C4743002CEA8A581D766
SHA1:	F0050B25B3FCBF863695CFD025E611A98A353CC8
SHA-256:	A0DF8C2C2AAF954F3F45E88A82B2F15AB918BA9DA08EB7BE21569C6143BA5262
SHA-512:	2F22F7109C4F45D8760011CC7FD25A0740FA647D3148ABB3C493F9FF162E799B9FD9CE7294ED9730CAE6E6D825EFB5FA23BF127128B020FDE3C134BCFAD0AC5F
Malicious:	false
URL:	https://res.cisco.com/websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1
Preview:	GIF89a..(................!.......!..ImageMagick.gamma=0.454545.,......(....................H........L..............L.....J.....j..........N....................(8HXhx..........)9IYiy..........:JZjz..........+;K[k{..........,<L\l\|..........-=M]m}...........>N^n~........../?O_o..........0......<.0....:\|.1...+Z..1....;z..2..$K.<.2..,[.\|.3..4k..3..<{...4..D..=.4..L.:}.5..T.Z..5..\.z..6..d.=.6..l.}.7..t...7..\|....8......>.8....;~.9...+[..9...;{..:..]...6=.....R.;.;6l.d.FM;...s.....:.....E.....;..S.....N.z...ok..=..I...V...F.......C...OV...@.......s..GH....."x...1H.w.z.a..7`..\...yp.......x.X..#.h..r........o........m.....Y..j.i[.F..d.K..lO2.elS.Q%lJ^yJ..q)...m..(b.Vf.g..&).6.&.k..g(s.Y'.s.i.\|j...)h.....t"J..^..U8)%.V...Fr.Oh.#.......2.I.."..j......C.j. .........=.,........~..24.l..F[...h.+d....v......-.k.......'.+..k.;...~.."../........j...$...7....G1...Hl...g\.../.....+....\|r...1.....1......L.8..s....0.>......m

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1382
Entropy (8bit):	5.426043599612489
Encrypted:	false
SSDEEP:	24:yVfABdmqLsXc9RZXGEF9wW6Bv5cHKoDvwZd9p6Pborxox8MBSA9hi0D3Qguxey:yVfABpL24mEwW6U6R6cr+mMJ9Dkguxf
MD5:	E08AFD7D867189C82255D832F9B47C36
SHA1:	2C58590545D46EBCA7DA7B59E288E3076D84CCD5
SHA-256:	512B969A87D4547AD142F722F95AAA74C6C40E7C0E38E0B324B881E1548D5B81
SHA-512:	CBF3C0F5F2956CD3A515E770507CF85CB70D042DC6D9707FCC1B41DA2DDCBCF255F6F2A6A77070E1880519DB8876B7F9E9720B1C7080C7307B5CC32D9CA63096
Malicious:	false
URL:	https://res.cisco.com/keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':11..,'message':'Please enroll before opening this Registered Envelope.'..,'state':1..,'reqTime':1731072533805..,'reqNumber':1..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'lfranco@haigroup.com'..,'sessionId':'626DB04AC1BA509E99A0C62243116F48'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=lfranco@haigroup.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1440x960, components 3
Category:	downloaded
Size (bytes):	51646
Entropy (8bit):	7.866024072803453
Encrypted:	false
SSDEEP:	768:bqshsTAgcyy0jzVq/2+wvBjBoPMob7I0i6NIwyAR/4Vw+jgfZZkQt2PhlQZZ:bqshuyuq/274NI0i6NJyAR/V+juZn
MD5:	E38D601F1F6EF6663954EC55183C5FDE
SHA1:	63D466158889D3043056ACDFBF330F16E55DA498
SHA-256:	9B8699D04D29EC9D28E06E4953C40AADE72619EF9813F25632E25DD5FFDBC89C
SHA-512:	18A6DC392E478161B8EED8C45D69E46E6CA12D0FF7D07FF2C310F31CD7818A34646FB4AB4A7E4EE95BED95AC69E685E799DBFCCCD42179B7C2907A0387C72E31
Malicious:	false
URL:	https://res.cisco.com/websafe/images/loginbg.gif
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:36715E7A1D7511EABBCCF15DA342EC86" xmpMM:InstanceID="xmp.iid:36715E791D7511EABBCCF15DA342EC86" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" stRef:documentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1280 x 808
Category:	dropped
Size (bytes):	10598
Entropy (8bit):	7.973575732670468
Encrypted:	false
SSDEEP:	192:0Dszh0YIrh919BR4ljLo1af3wHZY4laNGRO+1BMuq:NNohhn4lpfjkRT1BMp
MD5:	C22D6210FC87C4743002CEA8A581D766
SHA1:	F0050B25B3FCBF863695CFD025E611A98A353CC8
SHA-256:	A0DF8C2C2AAF954F3F45E88A82B2F15AB918BA9DA08EB7BE21569C6143BA5262
SHA-512:	2F22F7109C4F45D8760011CC7FD25A0740FA647D3148ABB3C493F9FF162E799B9FD9CE7294ED9730CAE6E6D825EFB5FA23BF127128B020FDE3C134BCFAD0AC5F
Malicious:	false
Preview:	GIF89a..(................!.......!..ImageMagick.gamma=0.454545.,......(....................H........L..............L.....J.....j..........N....................(8HXhx..........)9IYiy..........:JZjz..........+;K[k{..........,<L\l\|..........-=M]m}...........>N^n~........../?O_o..........0......<.0....:\|.1...+Z..1....;z..2..$K.<.2..,[.\|.3..4k..3..<{...4..D..=.4..L.:}.5..T.Z..5..\.z..6..d.=.6..l.}.7..t...7..\|....8......>.8....;~.9...+[..9...;{..:..]...6=.....R.;.;6l.d.FM;...s.....:.....E.....;..S.....N.z...ok..=..I...V...F.......C...OV...@.......s..GH....."x...1H.w.z.a..7`..\...yp.......x.X..#.h..r........o........m.....Y..j.i[.F..d.K..lO2.elS.Q%lJ^yJ..q)...m..(b.Vf.g..&).6.&.k..g(s.Y'.s.i.\|j...)h.....t"J..^..U8)%.V...Fr.Oh.#.......2.I.."..j......C.j. .........=.,........~..24.l..F[...h.+d....v......-.k.......'.+..k.;...~.."../........j...$...7....G1...Hl...g\.../.....+....\|r...1.....1......L.8..s....0.>......m

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 11 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)InterRegular3.019;RSMS;I
Category:	downloaded
Size (bytes):	303504
Entropy (8bit):	6.240980841374878
Encrypted:	false
SSDEEP:	6144:sgicNAygxZJ64wgVROEODznIw8SV17avLkh6w/yOjKf:sHcNAygxZJ6/gVROEODDI9SmvZw/Gf
MD5:	A4A7379505CD554EA9523594B7C28B2A
SHA1:	C2767D146C3C10FE6C9B8AC0F181EF907C111F19
SHA-256:	EEAB48280AACD4FC83C1C7E735681DF9EDD1B59588DDE23D0339BCF6552FB788
SHA-512:	469B0C4390DAEAC176EB9D5EF5B709E00D6957137A8EB61E1A82F70B8920CED5CCE7AD33FF94410E74F27D36CD33A7D73A97F7EEFF8CAA390195CEEEBFAB60AF
Malicious:	false
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Regular.ttf
Preview:	............GDEF1.1...;.....GPOS...X..?.....GSUB..fx..^...B.OS/2".nb..nL...`STAT.q.E...H...Hcmap/....n...e.gasp......:.....glyf..O4.......&head-.aF..F$...6hhea......n(...$hmtx..L...F\..'.loca.].4...T..'.maxp.......4... name0$Q@...@....post..5r...X..d.preph......8............................!...!...!...!...!...........................@.........................H...(........!!.!.!.#.!.!.L..........................d....H...(.@.......#..!!.!.!.#.!.!."&54632....!"&54632.....L....................?aa?E[[..?aa?E[[.......d...a?E[[E?aa?E[[E?a...H...(.H.&.......l.@.....H...(...&.......f.d.....H...(...&.......d.......H...(.h.&.......j.8.....H...(.........&..!!.!.!.#.!.!."&546632......'2654&#".....L.....................x.N.PP.NN.P>RR>>RR.......d..H.xP.NN.PP.N.U==UU==U...H...(...&...............H...@...&.......v.......H...(...&.......m.@.....H...(...&.......n.@.....H...@...&.......v.......H...(.h.&.......s.8.....H...(...&...............H...(...&...............H...(...&.......{.@.....H...(.t.&.......

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	155249
Entropy (8bit):	7.9359220373800605
Encrypted:	false
SSDEEP:	3072:y2ux/P/4+kIcB3DCN7tiOJ+9uCA2NAdMLJtNK1A50YsGKlk1042opB9iMVD:y2i/34ZIcB25tt+VA+LC40YsVlkkeMMt
MD5:	C3598F2D3BF6694DF3378AAFC792BFEE
SHA1:	BBCA95477B9B15A41E4EDC59784D76F621A27263
SHA-256:	A7842139A79734699FB6BD749733DA53E30B3634FB8C2695B57FD1A017DD1FE2
SHA-512:	5623BDBCD1FC446518E1DCE0817813E55938136D09375F35CFF3F828085C5B9A383DB43904565B7B5399B12919C72D56E0D4E00CB5582FE158E793CF41795425
Malicious:	false
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3" xmpMM:InstanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E712D444FE6211E994A3CEA94946B049" stRef:documentID="xmp.did:E712D445FE6211E994A3CEA94946B049"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64131)
Category:	downloaded
Size (bytes):	70357
Entropy (8bit):	5.316512415217151
Encrypted:	false
SSDEEP:	768:8otqucnre3DeGGG8MinEAsBj0hGE5jGookOlxN07TWlOw7uZRgydnRR66cGK/Jw:X8hCBjAGvkOvxbyJvoGD
MD5:	7C909F6DD07BED69C9CDABC9DEE2C131
SHA1:	7EF0ABFDB5935CDC2D50953FC0CEE43ABB501C28
SHA-256:	C1F5534ED276A1EAA57B106C7DADCC994A01EFBC033513EA4F5435580D8C327E
SHA-512:	E7E16B1264A28E3C5102B25678B7022048284180205348126BD32034C37EB55492F8C3D9B0493D6BB3A43D9AFB0338CD2678352A5FAD5CE415B4972C53E031D3
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js
Preview:	/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /.!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="undefined"!=typeof window?require("jquery"):require("jquery")(e)),n(t),t}:n(jQuery)}(function(u){var e=function(){if(u&&u.fn&&u.fn.select2&&u.fn.select2.amd)var e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].replace(w,"")),"."===e[0].charAt(0)&&h&&(e=h.slice(0,h.length-1).concat(e)),u=0;u<e.length;u++)if("."===(p=e[u]))e.splice(u,1),u-=1;else if(".."===p){if(0===u\|\|1===u&&".."===e[2]\|\|".."===e[u-1])continue;0<u&&(e.splice(u-1,2),u-=2)}e=e.join("/")}if((h\|\|g)&&f){for(u=(n=e.split("/")).length;0<u;u-=1){if(r=n.slice(0,u).join("/"),h)for(d=h.lengt

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64131)
Category:	dropped
Size (bytes):	70357
Entropy (8bit):	5.316512415217151
Encrypted:	false
SSDEEP:	768:8otqucnre3DeGGG8MinEAsBj0hGE5jGookOlxN07TWlOw7uZRgydnRR66cGK/Jw:X8hCBjAGvkOvxbyJvoGD
MD5:	7C909F6DD07BED69C9CDABC9DEE2C131
SHA1:	7EF0ABFDB5935CDC2D50953FC0CEE43ABB501C28
SHA-256:	C1F5534ED276A1EAA57B106C7DADCC994A01EFBC033513EA4F5435580D8C327E
SHA-512:	E7E16B1264A28E3C5102B25678B7022048284180205348126BD32034C37EB55492F8C3D9B0493D6BB3A43D9AFB0338CD2678352A5FAD5CE415B4972C53E031D3
Malicious:	false
Preview:	/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /.!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="undefined"!=typeof window?require("jquery"):require("jquery")(e)),n(t),t}:n(jQuery)}(function(u){var e=function(){if(u&&u.fn&&u.fn.select2&&u.fn.select2.amd)var e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].replace(w,"")),"."===e[0].charAt(0)&&h&&(e=h.slice(0,h.length-1).concat(e)),u=0;u<e.length;u++)if("."===(p=e[u]))e.splice(u,1),u-=1;else if(".."===p){if(0===u\|\|1===u&&".."===e[2]\|\|".."===e[u-1])continue;0<u&&(e.splice(u-1,2),u-=2)}e=e.join("/")}if((h\|\|g)&&f){for(u=(n=e.split("/")).length;0<u;u-=1){if(r=n.slice(0,u).join("/"),h)for(d=h.lengt

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1920x1280, components 3
Category:	downloaded
Size (bytes):	155249
Entropy (8bit):	7.9359220373800605
Encrypted:	false
SSDEEP:	3072:y2ux/P/4+kIcB3DCN7tiOJ+9uCA2NAdMLJtNK1A50YsGKlk1042opB9iMVD:y2i/34ZIcB25tt+VA+LC40YsVlkkeMMt
MD5:	C3598F2D3BF6694DF3378AAFC792BFEE
SHA1:	BBCA95477B9B15A41E4EDC59784D76F621A27263
SHA-256:	A7842139A79734699FB6BD749733DA53E30B3634FB8C2695B57FD1A017DD1FE2
SHA-512:	5623BDBCD1FC446518E1DCE0817813E55938136D09375F35CFF3F828085C5B9A383DB43904565B7B5399B12919C72D56E0D4E00CB5582FE158E793CF41795425
Malicious:	false
URL:	https://static.cres-aws.com/CRES_login_bg.jpg
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3" xmpMM:InstanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E712D444FE6211E994A3CEA94946B049" stRef:documentID="xmp.did:E712D445FE6211E994A3CEA94946B049"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	387
Entropy (8bit):	5.179130709592589
Encrypted:	false
SSDEEP:	6:TMVBd/NFmc4slJUY7BuwTARZARtAUbWDYHsyXIzqVJEgqIzqVNQs1jvpJrEIdHfi:TMHdVFvnNuuAiOYHzXw5jNdHK
MD5:	1F6AF349658BA40D72AA4C87AECC722A
SHA1:	E3ABD390D66D37C5C245C6AD172E5433584E2B39
SHA-256:	042CD20A95524AAAE53879E8D0210E9D79F0EB9E42E7C6E25EE4A8BDE703FAC0
SHA-512:	4A508F8F4AF98DAEC5218A4B38103898661D1B430783DE4DB314F1EA9D1D891B85987DF734D9697A49A03F23E54B8B137E16B64E519658351EBADD7330E4C79D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" .viewBox="0 0 16 16">.<defs><style>.b{fill:#ffffff;fill-rule:evenodd;}</style>.</defs>.<path class="b" d="M3.881,6.131c.342-.342,.896-.342,1.237,0l2.881,2.881,2.881-2.881c.342-.342,.896-.342,1.237,0s.342,.896,0,1.237l-3.5,3.5c-.342,.342-.896,.342-1.237,0l-3.5-3.5c-.342-.342-.342-.896,0-1.237Z"/></svg>

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1440x960, components 3
Category:	dropped
Size (bytes):	51646
Entropy (8bit):	7.866024072803453
Encrypted:	false
SSDEEP:	768:bqshsTAgcyy0jzVq/2+wvBjBoPMob7I0i6NIwyAR/4Vw+jgfZZkQt2PhlQZZ:bqshuyuq/274NI0i6NJyAR/V+juZn
MD5:	E38D601F1F6EF6663954EC55183C5FDE
SHA1:	63D466158889D3043056ACDFBF330F16E55DA498
SHA-256:	9B8699D04D29EC9D28E06E4953C40AADE72619EF9813F25632E25DD5FFDBC89C
SHA-512:	18A6DC392E478161B8EED8C45D69E46E6CA12D0FF7D07FF2C310F31CD7818A34646FB4AB4A7E4EE95BED95AC69E685E799DBFCCCD42179B7C2907A0387C72E31
Malicious:	false
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:36715E7A1D7511EABBCCF15DA342EC86" xmpMM:InstanceID="xmp.iid:36715E791D7511EABBCCF15DA342EC86" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" stRef:documentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	5.451209206052216
Encrypted:	false
SSDEEP:	24:yVfABdmqLsXc9RZXGEF9J48W6Bv5cHKoDvwZd9p6PborxoxLzdlhkiD3QglXRXxf:yVfABpL24mEJ48W6U6R6cr+RxlhkglBl
MD5:	43E2BC2EEEF2B5F601EA79FC40E9FC08
SHA1:	9760BBEE7FD79DD7AEB94259BB92DAFCF902C00C
SHA-256:	B7F07F6DCBB227737D98164C59ABFE9568425818EE7F29C7C5E67977B318CB9A
SHA-512:	84836E71244CA17C7113B129F0FCD8F74E02EAFCB1A48EE51B1EF5B6F520DF4148AF5E001AF80463350823F0A3551232F9F476FC831D31108DDF1DF69E20B40D
Malicious:	false
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':11..,'message':'Please enroll before opening this Registered Envelope.'..,'state':1..,'reqTime':1731072533805..,'reqNumber':1..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'lfranco@haigroup.com'..,'sessionId':'B40B0CDBD89B66AE5193A2D79F434E57'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=lfranco@haigroup.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14965)
Category:	downloaded
Size (bytes):	14966
Entropy (8bit):	4.771466859662571
Encrypted:	false
SSDEEP:	192:pL5u/nTfc3aqPJRQ9CPjOtWlUJKLPcH9tPOF:3u/TfXARQ9htWGSPcdwF
MD5:	9F54E6414F87E0D14B9E966F19A174F9
SHA1:	AE5735562FAABD1A2D9803BBD7BF4C502B5E4F51
SHA-256:	15D6AD4DFDB43D0AFFAD683E70029F97A8F8FC8637A28845009EE0542DCCDF81
SHA-512:	9CC365A6E6833EBAA5125B37217FD0E7A1F7EAABC1012C1BDE2A6EA373317966EC401D7CF35A31D1C46FED43D380196B8AAA329EDDF92A313080651E51720F9F
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css
Preview:	.select2-container{box-sizing:border-box;display:inline-block;margin:0;position:relative;vertical-align:middle}.select2-container .select2-selection--single{box-sizing:border-box;cursor:pointer;display:block;height:28px;user-select:none;-webkit-user-select:none}.select2-container .select2-selection--single .select2-selection__rendered{display:block;padding-left:8px;padding-right:20px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.select2-container .select2-selection--single .select2-selection__clear{position:relative}.select2-container[dir="rtl"] .select2-selection--single .select2-selection__rendered{padding-right:8px;padding-left:20px}.select2-container .select2-selection--multiple{box-sizing:border-box;cursor:pointer;display:block;min-height:32px;user-select:none;-webkit-user-select:none}.select2-container .select2-selection--multiple .select2-selection__rendered{display:inline-block;overflow:hidden;padding-left:8px;text-overflow:ellipsis;white-space:nowrap}.select2-cont

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 12 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)InterBold3.019;RSMS;Inte
Category:	downloaded
Size (bytes):	309772
Entropy (8bit):	6.315392152109917
Encrypted:	false
SSDEEP:	3072:voVlAvwEZEbPzW/Pl4Jl0Wkaco0KiY2T32Rrq41tIW+XMaf/F7oPHUGHYI9L31zP:gVl/PzJek8/P2RW1qa1WRRnQzS6m
MD5:	D17C0274915408CEE0308D5476DF9F45
SHA1:	444CDCA680F8CE64C16FE5A606DCFBE4B33E7925
SHA-256:	F9342F2D916AA89C924BC2ADCC1D3BFBB6EB54675E48953BACC49024FC768F76
SHA-512:	2C38DE878D1F6D254090555B9FDF517CCCC641457020A577DADB73056F04E25488328C27129E146C10456EAA97AE5E9077DFE5B88C1A1DF5015FD1DA5A289CEC
Malicious:	false
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Bold.ttf
Preview:	............GDEF1.1...F.....GPOS..2/..J...,.GSUB..fx..w...B.OS/2#.nB..yP...`STAT...G.......Dcmap/....y...e.gasp......E.....glyf..5.......(+head-.aF..Q(...6hhea......y,...$hmtx7."...Q`..'.loca......)X..'.maxp......)8... name00T....D....post..5r...\..d.preph......<.......#...i................!...!...!...!...!..#.F...F...F...F...F.......@.........................C............!!.!.!.#.!.!...0.......0......H.......,.......C.....i.......#..!!.!.!.#.!.!."&54632....!"&54632.......0.......0......H...V\|\|VWyy..V\|\|VWyy.....,......ySUvvUSyySUvvUSy...C.....^.&.......l.v.....C.......&.......f.......C.......&.......d.n.....C.....~.&.......j.......C.............&..!!.!.!.#.!.!."&546632......'2654&#........0.......0......H...'..S.UU.SS.U8NN88ON.....,.......\|S.QQ.SS.Q.L76L.L66M...C.....?.&.........V.p...C.......&.......v.^.....C.......&.......m.......C.......&.......n.v.....C.......&.......v.^.....C.....~.&.......s.......C.......&...............C.......&...............C.......&.......{.......C.......&..

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 14 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)Inter SemiBoldRegular3.0
Category:	downloaded
Size (bytes):	309432
Entropy (8bit):	6.313238065412327
Encrypted:	false
SSDEEP:	3072:q2x3CNOVe9tnoIXXsm5IQcuM9xaR4ThDnIQvXPLUkOIvdmULUX/aZMOrwTrVxfN7:sTIQMc4ThYyba/PR41Pa/jtdc0
MD5:	1753A05196ABEEF95C32F10246BD6473
SHA1:	ACDA92ADC6CF8C67C89395C65F371A4D2B05A783
SHA-256:	F5595839DEBDB0D028116ED8A7579F31D1C2F712677A2E794459A5DCE6ECA929
SHA-512:	68AA83B7521EFDD53D810E5BC8A6AC0F211CBB989CBA9C317D5AD196FFA08D439CC096C823305D5316D5B0D17FB9D6ED6E39CD0A28E0B2478A2DCCE01D78B760
Malicious:	false
URL:	https://static.cres-aws.com/fonts/Inter/Inter-SemiBold.ttf
Preview:	............GDEF1.1...D.....GPOS...t..H...-.GSUB..fx..u...B.OS/2#_nb..w....`STAT.y.E...t...Dcmap/....x...e.gasp......D.....glyfj.........&.head-.aF..O....6hhea......w....$hmtx$5.9..O...'.loca..)...'...'.maxp......'.... name7\`.......Ppost..5r......d.preph.................C................!...!...!...!...!............................@.........................E............!!.!.!.#.!.!...t.......t......8.......\.......E.....[.......#..!!.!.!.#.!.!."&54632....!"&54632.......t.......t......8...OssOQoo..OssOQoo.....\......pLPmmPLppLPmmPLp...E.....V.&.......l.d.....E.......&.......f.......E.......&.......d.R.....E.....v.&.......j.......E.............&..!!.!.!.#.!.!."&546632......'6654&.".......t.......t......8....}.Q.ST.QQ.T:PO;:OO.....\.......{R.PP.RR.P..O88P.O88P...E.....).&.........B.....E.......&.......v.......E.......&.......m.......E.......&.......n.d.....E.......&.......v.......E.....v.&.......s.......E.......&.........N.....E.......&.........b.....E.......&.......{.......E.......&.

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (491), with CRLF, LF line terminators
Entropy (8bit):	6.196405041102118
TrID:	Scalable Vector Graphics (18501/1) 24.18% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (11501/1) 15.03% HyperText Markup Language (11501/1) 15.03%
File name:	securedoc_20241104T081116.html
File size:	242'967 bytes
MD5:	90e93f5ac3097e2e3221afb12c51fde0
SHA1:	52a3c2484663bc9617ac86d0942c48ff22a44515
SHA256:	659442828c15a0141f5c5d16200ad36572c7ea6b9d6275fe6245dc12d103668e
SHA512:	8c8bdc431af62a8ed97c4e01d8192dec376edbf46f3ad8093a091f385dbefdd5f886d03e9b1d0c364fb7786a69af9ba32099b2ccb408942665f7f51d27aa2a7d
SSDEEP:	6144:j/LQIGqc+IHYONivQ2BYJrUO7V+dWIyu/iR:j/LQIGqrBYZUuVKTyu/iR
TLSH:	CF34CF892621643202E608F3B07B56493935981705086CB1FBACD6ACBFF9DA6417FFDD
File Content Preview:	saved from url=(0025)https://res.cisco.com:443 -->..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN". "http://www.w3.org/TR/html4/loose.dtd"><html.lang="en"><head><base href="http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNT

File Icon


Icon Hash:	173149cccc490307

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-08T14:29:03.470280+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.16	49740	TCP
2024-11-08T14:29:41.039647+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.16	49743	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 14:28:51.142565012 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:28:51.457238913 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:28:52.046880960 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.046890020 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.046935081 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.047046900 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.047095060 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.047168970 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.047281027 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.047291040 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.047399044 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.047413111 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.052017927 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.052158117 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.057085037 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.057118893 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.057224989 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.057245016 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.057425976 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.057866096 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.062685966 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.062777996 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.062807083 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.062850952 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.062860966 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.062865973 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.062890053 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.062916040 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.062931061 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.062980890 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063010931 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063035011 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.063039064 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063059092 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.063069105 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063102007 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063111067 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.063132048 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.063148975 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.063219070 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.064225912 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:28:52.065931082 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.065946102 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.066028118 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.066931963 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.066946030 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.067791939 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.067857981 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.068038940 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.068048954 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.068080902 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.068090916 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.068103075 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.068110943 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.068140030 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.068152905 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.084964037 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.085148096 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.138324022 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.138484955 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.186371088 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.580492973 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.659893036 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.659914017 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.660267115 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.660301924 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.660456896 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.660474062 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.662081003 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.662115097 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.662143946 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.662199974 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.664293051 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.664458036 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.664513111 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.664609909 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.664611101 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.664619923 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.664896011 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.664907932 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.716195107 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.728204012 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.728894949 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.747565031 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.747631073 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.747701883 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.747894049 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.747912884 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.775461912 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.780222893 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.783118010 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.785444021 CET	80	49703	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.785547018 CET	49703	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.786355972 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.786393881 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.786587954 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.786689043 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:52.786704063 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:52.801199913 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.801542997 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.801579952 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.801610947 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.801911116 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.801929951 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.802923918 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.802970886 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.802995920 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.803036928 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.803065062 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.803107023 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.803693056 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.804593086 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.804639101 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.804702044 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.804708958 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.804728985 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.804738045 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.805521965 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.806185961 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.806191921 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.806274891 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.806303024 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.806349039 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.806355000 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.806395054 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.807646036 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.848234892 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.848243952 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.858268976 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.890225887 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.920160055 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.920290947 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.920367002 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.920414925 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.920983076 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.921021938 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.921067953 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.921077967 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.921132088 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.921530962 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.921937943 CET	49700	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.921957016 CET	443	49700	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.922162056 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.922202110 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.922251940 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.922260046 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.922301054 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.922879934 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.926615000 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.927349091 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.927359104 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.928435087 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.928498983 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.929406881 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.929491043 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:52.929555893 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.971132994 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:52.971132994 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:52.971163988 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:52.971178055 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.017210960 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.019115925 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.037580967 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.037925005 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038021088 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.038042068 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038291931 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038817883 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038853884 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038863897 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.038876057 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.038887978 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.039642096 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.039675951 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.039691925 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.039699078 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.039736032 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.077384949 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.126332998 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.126349926 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.154493093 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.154717922 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.154812098 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.154824018 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.154875994 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.155029058 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.155544043 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.155798912 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.155832052 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.155864954 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.155874014 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.155900002 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.178025961 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.194017887 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.194097042 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.194107056 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.220206976 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.236278057 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.268218040 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:28:53.279931068 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.279947042 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280004025 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.280510902 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280517101 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280567884 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.280601978 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280637980 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280741930 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.280754089 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.280837059 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.281418085 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.281469107 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.281477928 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.281524897 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.281569004 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.281744003 CET	49701	443	192.168.2.16	104.17.24.14
Nov 8, 2024 14:28:53.281755924 CET	443	49701	104.17.24.14	192.168.2.16
Nov 8, 2024 14:28:53.297688961 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.297714949 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.297795057 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297805071 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.297811985 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297830105 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297840118 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297863007 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.297867060 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297887087 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.297913074 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.297913074 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.297961950 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.298010111 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.298022985 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.416867971 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.416883945 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.416980982 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.417006969 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.417021990 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.417041063 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.417079926 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.417110920 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.420578957 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.420860052 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.420907021 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.421962976 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.422064066 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.423039913 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.423111916 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.423382044 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.423398018 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.457664967 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.457906008 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.457928896 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.459028959 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.459099054 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.459386110 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.459454060 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.459516048 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.473778009 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.507340908 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.508199930 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.508219957 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.535583973 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.535629988 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.535675049 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.535687923 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.535726070 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.535751104 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.556201935 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.590317965 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.590393066 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.591164112 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.591305017 CET	49705	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.591339111 CET	443	49705	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.592662096 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.597650051 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.604465961 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.604501009 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:53.604571104 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.604832888 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.604846954 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:53.622374058 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622396946 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622405052 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622456074 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622473001 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.622488976 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622519970 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.622582912 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622628927 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.622638941 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622661114 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.622711897 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.623297930 CET	49706	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.623321056 CET	443	49706	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.625462055 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.625772953 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.625827074 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:53.625894070 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.626143932 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:53.626163960 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:53.630511999 CET	80	49711	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.630587101 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.630722046 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.635885954 CET	80	49711	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.656044960 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.656100035 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.656156063 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.656177998 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.656219959 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.700464010 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.751853943 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.753978968 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.754036903 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.754245996 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.754458904 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.754477978 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:53.777252913 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.777266979 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.777307034 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.777364969 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.777381897 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.777406931 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.777467012 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.794231892 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:53.896291018 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.896320105 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.896401882 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.896420002 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:53.896467924 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:53.923402071 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.923674107 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.923697948 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.924767017 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.924849987 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.925144911 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.925213099 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:53.925343037 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.967243910 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:53.967264891 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.010693073 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.010725975 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.010876894 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.010907888 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.011095047 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.014225006 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.063234091 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.063292027 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.063325882 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.063374996 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.063424110 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.063640118 CET	49704	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.063657045 CET	443	49704	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.071806908 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.072107077 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.072144985 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.072205067 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.072222948 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.072278976 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.072418928 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.072463989 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.073064089 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.073126078 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.073139906 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.073254108 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.073373079 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.078891993 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.079174042 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.079185009 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.083111048 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.083184958 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.083344936 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.083380938 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.083408117 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.083453894 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.083661079 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.083690882 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.083861113 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.083877087 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.126328945 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.133198977 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.133266926 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.133363962 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.133496046 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.133546114 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.134004116 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.134020090 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.134037971 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.134567022 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.134582996 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.134633064 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.134778023 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.134797096 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.135391951 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.135401964 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.139230013 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.139245987 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.139327049 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.139481068 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.139494896 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.190871954 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.190948963 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191015959 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.191021919 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191040039 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191157103 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.191210032 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191669941 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191701889 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191746950 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.191762924 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.191819906 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.191837072 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.192322016 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.192384958 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.192394018 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.213712931 CET	49689	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:28:54.234210014 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.265721083 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.273947001 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.273963928 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.275096893 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.275175095 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.275863886 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.275935888 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.276880026 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.276890039 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.294011116 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.294060946 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.294365883 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.294588089 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.294604063 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.295306921 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.295504093 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.295532942 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.296612978 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.296700001 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.296983957 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.297045946 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.297126055 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.300478935 CET	80	49711	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.303642035 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.303673983 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.303734064 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.303944111 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.303956032 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.308394909 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.308619976 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.308646917 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.308674097 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.308695078 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.308779001 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.308835983 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.309022903 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.309098005 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.309106112 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.330228090 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.343339920 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.345207930 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.345225096 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.345252037 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.349380016 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.349446058 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.349464893 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.349667072 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.349900961 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.349906921 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.393208981 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.393271923 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.426842928 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.427187920 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.427220106 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.427263975 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.427284002 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.427333117 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.427499056 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.427974939 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.428031921 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.428040981 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.437741041 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.437813044 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.437871933 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.438636065 CET	49710	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.438654900 CET	443	49710	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460630894 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460654974 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460661888 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460692883 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460726976 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.460751057 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460764885 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.460822105 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460865974 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.460871935 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460891008 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.460932970 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.463913918 CET	49712	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:54.463958979 CET	443	49712	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:54.468274117 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.468344927 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.468363047 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.521236897 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.546363115 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.546379089 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.546442986 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.546519995 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.546530008 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.546565056 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.547607899 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.547616005 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.547699928 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.587265968 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.587279081 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.587347031 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.587361097 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.587400913 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.587455034 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.587651968 CET	49707	443	192.168.2.16	104.17.25.14
Nov 8, 2024 14:28:54.587668896 CET	443	49707	104.17.25.14	192.168.2.16
Nov 8, 2024 14:28:54.755706072 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.756037951 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.756063938 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.756418943 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.756726980 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.756793022 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.756912947 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.803334951 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.934402943 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.934663057 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.934684992 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.935028076 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.935378075 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.935456991 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.935539007 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.972239971 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.972515106 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.972541094 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.974078894 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.974148989 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.974580050 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.974689007 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.974720001 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.974734068 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.974843979 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.974927902 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.974953890 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.975035906 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.975048065 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.976152897 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.976207018 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.976226091 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.976283073 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.976506948 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.976604939 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.976840973 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.976910114 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.976963997 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.976969957 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.977015972 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:54.977022886 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:54.977375984 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.977551937 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.977560043 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.978590012 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.978652954 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.978905916 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.978962898 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.978997946 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.979325056 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.984123945 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.984332085 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.984359980 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.985351086 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.985423088 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.985709906 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.985770941 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.985804081 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.999510050 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:54.999733925 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:54.999743938 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.000761986 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.000823975 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.001090050 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.001154900 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.001230955 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.001238108 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.015328884 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.019332886 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.027339935 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.029207945 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.029211998 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.029217958 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.029226065 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.029230118 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.029238939 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.029244900 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.029256105 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.046500921 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.077225924 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.077234030 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.077239037 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.139842987 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.139873981 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.139882088 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.139910936 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.139991045 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.140017033 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.188232899 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.256064892 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.256079912 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.256120920 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.256138086 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.256150961 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.256166935 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.300245047 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.372061968 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.372083902 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.372119904 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.372143984 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.372149944 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.372210979 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.373264074 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.373270988 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.373327017 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.373347044 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.373400927 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.462899923 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.467720985 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.467737913 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.468116999 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.468513012 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.468580008 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.468667030 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.489301920 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.489314079 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.489402056 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.489437103 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.490072966 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.490156889 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.490154982 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.490202904 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.490474939 CET	49729	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.490500927 CET	443	49729	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.500119925 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.500169039 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:55.500230074 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.500438929 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.500453949 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:55.515331984 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.655793905 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.655822992 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.655901909 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.655930042 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.655977011 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.680224895 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:28:55.690018892 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.726063967 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.727909088 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.727984905 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.728050947 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.731421947 CET	49713	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.731440067 CET	443	49713	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.744235039 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.744677067 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.744718075 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.744801044 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.745259047 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:55.745271921 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:55.745959997 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.746004105 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:55.746071100 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.746246099 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:55.746258020 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:55.775171995 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.775187016 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.775229931 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.775279999 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.775300026 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.775345087 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.775676012 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.807342052 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807358980 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807393074 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807435036 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.807486057 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.807580948 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807589054 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807605028 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.807631969 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.807663918 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.807676077 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818654060 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818682909 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818691015 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818722010 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818737030 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818747997 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818754911 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.818768978 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.818778038 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.818814039 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.818818092 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840822935 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840852022 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840862036 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840890884 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840909958 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840919018 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840939999 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.840976000 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.840995073 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.841028929 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.845551968 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845567942 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845602989 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845618010 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845632076 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.845637083 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845652103 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.845659018 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.845679998 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.845700979 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.855237007 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.871212959 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.894818068 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.894869089 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.894927979 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.894948959 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.894985914 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.895004988 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.924755096 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924770117 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924818993 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924843073 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924864054 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924873114 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.924949884 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.924951077 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.924951077 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.932849884 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.932858944 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.932938099 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.932970047 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936672926 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936686993 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936718941 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936733007 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936743021 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.936755896 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.936778069 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.936799049 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.959474087 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.959537983 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.959593058 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.959629059 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.959759951 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.959759951 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.960227013 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.960290909 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.966662884 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.966697931 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.966768980 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.966778994 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:55.966821909 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:55.980247974 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.014141083 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.014172077 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.014255047 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.014257908 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.014276981 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.014305115 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.016077042 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.016155958 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.016166925 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.043524981 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.043533087 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.043626070 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.043656111 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058760881 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058775902 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058815956 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058834076 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.058850050 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058862925 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.058876038 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.058907986 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.059232950 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.059598923 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.059652090 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.079036951 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.079077005 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.079171896 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.079171896 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.079205036 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.079253912 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.085748911 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.085777044 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.085834026 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.085844994 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.085871935 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.085890055 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.085931063 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.085977077 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.091234922 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.138072014 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.138098955 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.138181925 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.138206959 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.138283968 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.167288065 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.167296886 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.167344093 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.167357922 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.167469978 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.167469978 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.167500973 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.167553902 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.171295881 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.171556950 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.171585083 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.171982050 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.172311068 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.172379971 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.172441006 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.177006006 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.177036047 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.177100897 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.177125931 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.177174091 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.197756052 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.197798014 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.197851896 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.197866917 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.197912931 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.208228111 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.208252907 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.208339930 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.208350897 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.208403111 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.215328932 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.250237942 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.253554106 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.253587008 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.253658056 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.253679037 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.253690004 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.253730059 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.284568071 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.284578085 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.284617901 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.284657001 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.284679890 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.284712076 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.284842968 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.284842968 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.294652939 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.294678926 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.294717073 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.294725895 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.294750929 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.294776917 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.316428900 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.316447020 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.316483974 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.316628933 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.316628933 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.316659927 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.316803932 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.324269056 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.324336052 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.328743935 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.328766108 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.328820944 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.328845024 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.328891039 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.335674047 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.335700989 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.335735083 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.335762024 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.335787058 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.335808039 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.371613026 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.371639013 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.371723890 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.371743917 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.371787071 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.391239882 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.402096033 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.402121067 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.402226925 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.402257919 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.402301073 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.407718897 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.407963991 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.407980919 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.408360958 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.409060001 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.409132004 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.409194946 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.411916018 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.411942959 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.412031889 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.412056923 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.412103891 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.416714907 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.420103073 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:56.420113087 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.420687914 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.421199083 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:56.421298981 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.421369076 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:56.445446014 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.445476055 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.445584059 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.445616961 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.445667028 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.446216106 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.446295023 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.447544098 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.447570086 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.447639942 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.447648048 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.447702885 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.452195883 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.452210903 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.452302933 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.452326059 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.454248905 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.454257965 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.467331886 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.488847017 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.488909006 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.488945961 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.488967896 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.488981962 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.494961977 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.494983912 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.495059967 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.495070934 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.501281023 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.509320974 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.509371996 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.509433985 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.509474039 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.509488106 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.519013882 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.519109964 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.519128084 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.527951956 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.527976036 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.528038025 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.528047085 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.528083086 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.548259020 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.558454037 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.558479071 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.558577061 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.558607101 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.558665037 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.559968948 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.560038090 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.560756922 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.560823917 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.563736916 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.563769102 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.563838959 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.563857079 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.563899994 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.564240932 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.568470001 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.568485022 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.568526030 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.568552017 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.568555117 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.568624020 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.569546938 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.569555998 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.569610119 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.569622040 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.569664955 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.597784042 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.597878933 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.597944975 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:56.598754883 CET	49733	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:28:56.598772049 CET	443	49733	54.161.165.135	192.168.2.16
Nov 8, 2024 14:28:56.601495981 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.601522923 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.601592064 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.601824999 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.601836920 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.607420921 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.608262062 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.608366966 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.608392000 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.635766029 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.635782003 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.635821104 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.635865927 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.635883093 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.635912895 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.635927916 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.636715889 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.636785030 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.636794090 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.644315958 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.644341946 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.644428015 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.644445896 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.644494057 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.646306038 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.646378994 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.657267094 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.676629066 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.676789999 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.676892042 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.678385973 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.678468943 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.678476095 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.678519964 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.682023048 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.682049036 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.682111025 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.682137012 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.682163954 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.682189941 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.685014009 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.685072899 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.685930967 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.685947895 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.685998917 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.686009884 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.686013937 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.686916113 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.686975956 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.686983109 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.686997890 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.687026978 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.687103987 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.687181950 CET	49732	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.687196970 CET	443	49732	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.689239025 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.705132008 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.705229998 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.705292940 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.706079960 CET	49734	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:56.706096888 CET	443	49734	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:56.726358891 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.726375103 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.726413012 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.726450920 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.726473093 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.726504087 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.726687908 CET	49716	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.726706982 CET	443	49716	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753215075 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753232002 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753278017 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753308058 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753349066 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.753398895 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.753418922 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.753439903 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.765511036 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:56.765566111 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:56.765630007 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:56.775657892 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:56.775675058 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:56.776601076 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.776632071 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.776709080 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.776743889 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.776762962 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.776791096 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.785211086 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:56.785254955 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:56.785335064 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:56.785495043 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:56.785511017 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:56.795480967 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.795515060 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.795583963 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.795612097 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.795628071 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.795659065 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.798213959 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.798264980 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.798288107 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.798295975 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.798338890 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.801007032 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.801033020 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.801084042 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.801091909 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.801121950 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.801142931 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.806951046 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.806971073 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.807063103 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.807081938 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.807137012 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.863228083 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.863270044 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.863325119 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.863358021 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.863424063 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.871484995 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.871505022 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.871555090 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.871562004 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.871593952 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.871608019 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.876842022 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.876868010 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.876929998 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.876938105 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.876996040 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.881778955 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.881808996 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.881877899 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.881882906 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.881927013 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.913674116 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.913752079 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.916390896 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.916419029 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.916469097 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.916496992 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.916508913 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.916541100 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.923021078 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.923048973 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.923110008 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.923130035 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.923157930 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.923193932 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.925291061 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.925359011 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.987515926 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.987543106 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.987571955 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.987615108 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.987642050 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.987664938 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.996665001 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.996714115 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.996771097 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.996782064 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.996831894 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.999407053 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.999425888 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:56.999511957 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:56.999519110 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.032972097 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.033013105 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.033102036 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.033133030 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.033240080 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.035851002 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.035898924 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.035933971 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.035944939 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.035975933 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.038232088 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.041196108 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.041228056 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.041306019 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.041316986 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.041380882 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.053368092 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.085326910 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.103671074 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.103688955 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.103732109 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.103790045 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.103836060 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.103857994 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.103874922 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.111360073 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.115940094 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.115958929 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.116034031 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.116069078 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.116367102 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.116406918 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.116413116 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.153820038 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.153848886 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.153927088 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.153949976 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.153999090 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.159302950 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.159337044 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.159410000 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.159420967 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.159468889 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.164304972 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.188608885 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.188636065 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.188728094 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.188760996 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.188808918 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.207895994 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.207922935 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.208026886 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.208056927 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.208120108 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.213519096 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.213618994 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.221587896 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.221616030 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.221659899 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.221673965 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.221700907 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.228512049 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.228595018 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.229696035 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.229746103 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.233714104 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.233740091 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.233787060 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.233807087 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.233825922 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.233860016 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.267182112 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.267205954 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.267265081 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.267281055 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.267327070 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.269217968 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.269634008 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:57.269661903 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.270001888 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.270783901 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:57.270857096 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.271100998 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:57.272955894 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.272981882 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.273035049 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.273041964 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.273082018 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.275232077 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.278796911 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.278817892 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.278893948 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.278901100 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.279124022 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.281259060 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.281332016 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.311335087 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.337352991 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.337368965 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.337404966 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.337430000 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.337455034 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.337483883 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.337507010 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.338984013 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.339018106 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.339076996 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.339098930 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.339153051 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.349982023 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350004911 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350078106 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.350102901 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350137949 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.350230932 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350919962 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350950956 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.350966930 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.350975037 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.351003885 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.384324074 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.384421110 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.391701937 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.391725063 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.391776085 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.391798019 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.391815901 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.397177935 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.397202015 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.397250891 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.397274971 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.397291899 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.397319078 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.422095060 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.422178984 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.422197104 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.436722994 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.436791897 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.436872005 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:57.437768936 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.441224098 CET	49735	443	192.168.2.16	54.234.149.46
Nov 8, 2024 14:28:57.441241026 CET	443	49735	54.234.149.46	192.168.2.16
Nov 8, 2024 14:28:57.445506096 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.445525885 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.445570946 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.445590019 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.445633888 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.445647001 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.454231024 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.454294920 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.454305887 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.454317093 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.454370022 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.454776049 CET	49726	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.454782009 CET	443	49726	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467799902 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467828989 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467866898 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467880964 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.467891932 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467926025 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.467937946 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.467982054 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.468260050 CET	49724	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.468266010 CET	443	49724	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.507762909 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.507778883 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.507824898 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.507837057 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.507867098 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.507899046 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.507910013 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.509001970 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.509073973 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.509077072 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.509126902 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.509341955 CET	49725	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.509356022 CET	443	49725	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516020060 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516043901 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516091108 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516128063 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.516139030 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516176939 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.516180992 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.516216993 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.519206047 CET	49727	443	192.168.2.16	13.32.121.62
Nov 8, 2024 14:28:57.519236088 CET	443	49727	13.32.121.62	192.168.2.16
Nov 8, 2024 14:28:57.604096889 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:57.604146957 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:57.604250908 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:57.605787039 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:57.605811119 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:57.616889954 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.617332935 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.617351055 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.618432999 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.618505001 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.618874073 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.618937969 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.619033098 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.619040966 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.670192957 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:57.670490026 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:57.670507908 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:57.671617031 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:57.671684980 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:57.672231913 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.673099995 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:57.673187017 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:57.720247030 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:57.720261097 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:28:57.767226934 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:28:57.984379053 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984407902 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984415054 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984467030 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984483957 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984497070 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984555960 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.984586954 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:57.984627962 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:57.984661102 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.103257895 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.103291988 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.103404045 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.103435040 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.103473902 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.220515013 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.220551014 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.220690012 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.220731974 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.220777988 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.337846041 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.337874889 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.337953091 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.337969065 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.338030100 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.450045109 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.450150967 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.454276085 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.454345942 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.454369068 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.454387903 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.454407930 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.502255917 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.512619019 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.512645960 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.513005018 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.566395998 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.571196079 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.571227074 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.571295023 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.571327925 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.571348906 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.572838068 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.641510963 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.687325001 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.687959909 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.687988043 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.688060045 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.688088894 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.688107014 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.688129902 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.777362108 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.777396917 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.777445078 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.777462959 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.777482986 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.777501106 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.850560904 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.850589991 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.850672960 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.850697041 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.850733042 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.886853933 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.887120008 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.887120008 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.887140989 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.887291908 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.887334108 CET	443	49738	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.887373924 CET	49738	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.920010090 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.920090914 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.920099974 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.920164108 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.920346975 CET	49736	443	192.168.2.16	13.32.121.35
Nov 8, 2024 14:28:58.920362949 CET	443	49736	13.32.121.35	192.168.2.16
Nov 8, 2024 14:28:58.922172070 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.922228098 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:58.922291994 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.922610998 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:58.922622919 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:59.314832926 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:28:59.616254091 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:28:59.783986092 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:59.784084082 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:59.785213947 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:59.785228014 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:59.785475016 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:28:59.786557913 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:28:59.831337929 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:29:00.036631107 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:29:00.061055899 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:29:00.062443018 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:29:00.062536001 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:29:00.062557936 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:29:00.062568903 CET	49739	443	192.168.2.16	184.28.90.27
Nov 8, 2024 14:29:00.062575102 CET	443	49739	184.28.90.27	192.168.2.16
Nov 8, 2024 14:29:00.221285105 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:29:00.493278027 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:29:01.435254097 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:29:01.820643902 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:01.820694923 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:01.820785999 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:01.821983099 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:01.821994066 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:02.947184086 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:02.947323084 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:02.950023890 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:02.950036049 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:02.950354099 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:02.991266012 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.035191059 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.075341940 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411676884 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411706924 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411715984 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411727905 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411755085 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411799908 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.411829948 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.411847115 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.411878109 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.468435049 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.468586922 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.468621969 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.469922066 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.469935894 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.469945908 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.470091105 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.470129967 CET	443	49740	4.175.87.197	192.168.2.16
Nov 8, 2024 14:29:03.470546961 CET	49740	443	192.168.2.16	4.175.87.197
Nov 8, 2024 14:29:03.786505938 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:03.849312067 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:29:04.089724064 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:04.696295977 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:05.910273075 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:07.663515091 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:29:07.663588047 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:29:07.663642883 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:29:08.191263914 CET	49737	443	192.168.2.16	142.250.185.132
Nov 8, 2024 14:29:08.191298962 CET	443	49737	142.250.185.132	192.168.2.16
Nov 8, 2024 14:29:08.314284086 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:08.649310112 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:29:09.937654018 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:09.937747002 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:09.937829971 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:09.939613104 CET	49717	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:09.939634085 CET	443	49717	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:09.941306114 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:09.941363096 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:09.941445112 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:09.941704035 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:09.941715956 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.095319033 CET	49673	443	192.168.2.16	204.79.197.203
Nov 8, 2024 14:29:10.142674923 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.142761946 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.142822027 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.143556118 CET	49728	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.143577099 CET	443	49728	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.145108938 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.145144939 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.145200968 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.146045923 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.146055937 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.611387968 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.611710072 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.611737967 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.612098932 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.612478971 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.612541914 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.612670898 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.659337997 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.815278053 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.815577984 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.815593004 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.815948963 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.816251040 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.816315889 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:10.816380978 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:10.859335899 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:13.129311085 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:18.264302015 CET	49678	443	192.168.2.16	20.189.173.10
Nov 8, 2024 14:29:22.743331909 CET	49680	80	192.168.2.16	192.229.211.108
Nov 8, 2024 14:29:33.843902111 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.844063997 CET	443	49741	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:33.844126940 CET	49741	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.844391108 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.844510078 CET	443	49742	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:33.844568014 CET	49742	443	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.895900011 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.895946026 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.901989937 CET	80	49702	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:33.902036905 CET	80	49711	54.161.165.135	192.168.2.16
Nov 8, 2024 14:29:33.902048111 CET	49702	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:33.902101040 CET	49711	80	192.168.2.16	54.161.165.135
Nov 8, 2024 14:29:39.733819008 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:39.733865976 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:39.733948946 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:39.734288931 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:39.734298944 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.621289015 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.621445894 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:40.622953892 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:40.622981071 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.623225927 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.624456882 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:40.667354107 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.918834925 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.918868065 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.918909073 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.918956995 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:40.918989897 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:40.919004917 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:40.919044018 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:41.039458036 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:41.039530039 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:41.039549112 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:41.039700031 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:41.039700031 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:41.039819002 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:41.039844036 CET	443	49743	52.149.20.212	192.168.2.16
Nov 8, 2024 14:29:41.039859056 CET	49743	443	192.168.2.16	52.149.20.212
Nov 8, 2024 14:29:41.039866924 CET	443	49743	52.149.20.212	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 14:28:51.938452959 CET	53	55233	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.038531065 CET	49601	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.038667917 CET	54576	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.038923025 CET	55285	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.039083004 CET	49912	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.039557934 CET	56115	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.039721012 CET	50745	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.044456959 CET	53	50390	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.044891119 CET	53	51732	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.045700073 CET	53	55285	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.046459913 CET	53	49912	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.050316095 CET	53	50745	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.051609993 CET	53	56115	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.059113026 CET	53	49601	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.074091911 CET	53	54576	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.732100964 CET	56560	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.732367992 CET	50621	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:52.746857882 CET	53	56560	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:52.747015953 CET	53	50621	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.257653952 CET	53	58548	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.289735079 CET	63386	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:53.289871931 CET	61052	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:53.296963930 CET	53	61052	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.297039032 CET	53	63386	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.594041109 CET	62053	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:53.594208956 CET	49940	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:53.603813887 CET	53	62053	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.603827953 CET	53	49940	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:53.753639936 CET	53	57627	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:56.729110956 CET	56004	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:56.729299068 CET	52254	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:56.759195089 CET	53	52254	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:56.764955044 CET	53	56004	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:56.776212931 CET	53410	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:56.776357889 CET	53473	53	192.168.2.16	1.1.1.1
Nov 8, 2024 14:28:56.783444881 CET	53	53410	1.1.1.1	192.168.2.16
Nov 8, 2024 14:28:56.783575058 CET	53	53473	1.1.1.1	192.168.2.16
Nov 8, 2024 14:29:10.306485891 CET	53	49493	1.1.1.1	192.168.2.16
Nov 8, 2024 14:29:29.025259972 CET	53	61406	1.1.1.1	192.168.2.16
Nov 8, 2024 14:29:55.484172106 CET	138	138	192.168.2.16	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 8, 2024 14:28:52.074187994 CET	192.168.2.16	1.1.1.1	c272	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 8, 2024 14:28:52.038531065 CET	192.168.2.16	1.1.1.1	0x9ea9	Standard query (0)	static.cres-aws.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.038667917 CET	192.168.2.16	1.1.1.1	0xa43e	Standard query (0)	static.cres-aws.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:52.038923025 CET	192.168.2.16	1.1.1.1	0xbdcb	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.039083004 CET	192.168.2.16	1.1.1.1	0xbd80	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:52.039557934 CET	192.168.2.16	1.1.1.1	0x9563	Standard query (0)	res.cisco.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.039721012 CET	192.168.2.16	1.1.1.1	0xd321	Standard query (0)	res.cisco.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:52.732100964 CET	192.168.2.16	1.1.1.1	0xa72a	Standard query (0)	res.cisco.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.732367992 CET	192.168.2.16	1.1.1.1	0xc5c6	Standard query (0)	res.cisco.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:53.289735079 CET	192.168.2.16	1.1.1.1	0xd01b	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.289871931 CET	192.168.2.16	1.1.1.1	0x6d86	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:53.594041109 CET	192.168.2.16	1.1.1.1	0x67e3	Standard query (0)	res.cisco.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.594208956 CET	192.168.2.16	1.1.1.1	0x7e3e	Standard query (0)	res.cisco.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:56.729110956 CET	192.168.2.16	1.1.1.1	0x86d4	Standard query (0)	static.cres-aws.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.729299068 CET	192.168.2.16	1.1.1.1	0xc07f	Standard query (0)	static.cres-aws.com	65	IN (0x0001)	false
Nov 8, 2024 14:28:56.776212931 CET	192.168.2.16	1.1.1.1	0x1a49	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.776357889 CET	192.168.2.16	1.1.1.1	0x3b1b	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 8, 2024 14:28:52.045700073 CET	1.1.1.1	192.168.2.16	0xbdcb	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.045700073 CET	1.1.1.1	192.168.2.16	0xbdcb	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.046459913 CET	1.1.1.1	192.168.2.16	0xbd80	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 8, 2024 14:28:52.051609993 CET	1.1.1.1	192.168.2.16	0x9563	No error (0)	res.cisco.com		54.161.165.135	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.051609993 CET	1.1.1.1	192.168.2.16	0x9563	No error (0)	res.cisco.com		54.234.149.46	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.051609993 CET	1.1.1.1	192.168.2.16	0x9563	No error (0)	res.cisco.com		34.204.64.207	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.059113026 CET	1.1.1.1	192.168.2.16	0x9ea9	No error (0)	static.cres-aws.com	d2qj7djftjbj85.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 14:28:52.059113026 CET	1.1.1.1	192.168.2.16	0x9ea9	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.62	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.059113026 CET	1.1.1.1	192.168.2.16	0x9ea9	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.40	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.059113026 CET	1.1.1.1	192.168.2.16	0x9ea9	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.110	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.059113026 CET	1.1.1.1	192.168.2.16	0x9ea9	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.35	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.074091911 CET	1.1.1.1	192.168.2.16	0xa43e	No error (0)	static.cres-aws.com	d2qj7djftjbj85.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 14:28:52.746857882 CET	1.1.1.1	192.168.2.16	0xa72a	No error (0)	res.cisco.com		54.161.165.135	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.746857882 CET	1.1.1.1	192.168.2.16	0xa72a	No error (0)	res.cisco.com		34.204.64.207	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:52.746857882 CET	1.1.1.1	192.168.2.16	0xa72a	No error (0)	res.cisco.com		54.234.149.46	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.296963930 CET	1.1.1.1	192.168.2.16	0x6d86	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 8, 2024 14:28:53.297039032 CET	1.1.1.1	192.168.2.16	0xd01b	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.297039032 CET	1.1.1.1	192.168.2.16	0xd01b	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.603813887 CET	1.1.1.1	192.168.2.16	0x67e3	No error (0)	res.cisco.com		54.234.149.46	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.603813887 CET	1.1.1.1	192.168.2.16	0x67e3	No error (0)	res.cisco.com		54.161.165.135	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:53.603813887 CET	1.1.1.1	192.168.2.16	0x67e3	No error (0)	res.cisco.com		34.204.64.207	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.759195089 CET	1.1.1.1	192.168.2.16	0xc07f	No error (0)	static.cres-aws.com	d2qj7djftjbj85.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 14:28:56.764955044 CET	1.1.1.1	192.168.2.16	0x86d4	No error (0)	static.cres-aws.com	d2qj7djftjbj85.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 14:28:56.764955044 CET	1.1.1.1	192.168.2.16	0x86d4	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.35	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.764955044 CET	1.1.1.1	192.168.2.16	0x86d4	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.110	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.764955044 CET	1.1.1.1	192.168.2.16	0x86d4	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.62	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.764955044 CET	1.1.1.1	192.168.2.16	0x86d4	No error (0)	d2qj7djftjbj85.cloudfront.net		13.32.121.40	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.783444881 CET	1.1.1.1	192.168.2.16	0x1a49	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 8, 2024 14:28:56.783575058 CET	1.1.1.1	192.168.2.16	0x3b1b	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

cdnjs.cloudflare.com

static.cres-aws.com

res.cisco.com

https:

fs.microsoft.com

slscr.update.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49702	54.161.165.135	80	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 14:28:52.057425976 CET	477	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 8, 2024 14:28:52.728894949 CET	483	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Fri, 08 Nov 2024 13:28:52 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Nov 8, 2024 14:28:53.592662096 CET	491	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 8, 2024 14:28:53.751853943 CET	497	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Fri, 08 Nov 2024 13:28:53 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49703	54.161.165.135	80	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 14:28:52.057866096 CET	12360	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688%2Ecorpmailsvcs%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImxmcmFuY29AaGFpZ3JvdXAuY29tIiA8bGZyYW5jb0BoYWlncm91cC5jb20%2B%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27KcAt6m7ewViKVN03X%2BbJAA%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1730729476447%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,16417%5D,%27Body-1730729476447%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27attachment2024-11-04-09%2E11%2E10%2Epdf%27,2,%0D%0A [TRUNCATED] Data Raw: Data Ascii:
Nov 8, 2024 14:28:52.062850952 CET	2472	OUT	Data Raw: 67 4f 61 6d 36 38 44 77 6d 74 6c 6f 36 47 66 44 47 55 44 69 74 25 32 42 52 32 71 68 35 39 4f 6b 4c 36 39 78 33 50 55 39 64 76 66 53 42 50 41 57 36 32 6a 37 74 59 66 6c 75 4d 42 4b 56 4f 6e 70 30 46 67 53 6e 6f 5a 49 77 70 44 72 73 58 54 57 45 4a Data Ascii: gOam68Dwmtlo6GfDGUDit%2BR2qh59OkL69x3PU9dvfSBPAW62j7tYfluMBKVOnp0FgSnoZIwpDrsXTWEJNw4spcOJgDGVYmLLogXH7VgB5wsOhhelDYk9%2BWN0bE4KkrvconVCsXdqEmxYFZkQ3Nt6%2F35JNvLM1I%2BqmCGINF6xDif3Mn%2Fojk%2BqtU2rV2oywhMjoM6U4OyByar%2FU0zfv1QD8zzOjfnPCfvfu6M7A
Nov 8, 2024 14:28:52.062865973 CET	2472	OUT	Data Raw: 46 65 37 78 53 56 59 62 32 76 62 67 7a 33 31 43 33 4e 68 42 43 55 73 75 32 6b 4a 71 61 37 64 33 5a 30 52 50 70 6e 68 48 63 44 59 25 32 46 62 77 66 49 42 78 43 35 68 4e 4f 52 72 48 56 47 52 36 59 4c 47 6b 42 74 38 6c 50 6a 61 30 33 64 53 78 65 69 Data Ascii: Fe7xSVYb2vbgz31C3NhBCUsu2kJqa7d3Z0RPpnhHcDY%2FbwfIBxC5hNORrHVGR6YLGkBt8lPja03dSxeirGLCATxoSvvMuvVfpoess3mSXGoGASngY4Iw7PzHmZCd1Yqj5kMyxgVcYolPt4o%2BKgwbJ7IcPbCaIkkKEjE1SIUaCG7D3lTTS3oZ3G7ZgNLjUEscYlCTWK5jOs2OM4B%2B7MWGG63UVvxu8jWd%2Fc6IFPaYwC%
Nov 8, 2024 14:28:52.062916040 CET	2472	OUT	Data Raw: 35 6d 4d 49 57 31 4d 61 64 6e 31 41 49 6f 59 44 6d 35 6b 25 32 46 31 62 78 51 33 77 73 34 67 6e 76 4e 50 41 78 6a 43 64 55 50 46 69 5a 52 72 5a 68 7a 32 32 78 46 4e 4a 73 62 65 78 58 4e 49 71 71 55 6d 49 4a 25 32 46 37 7a 39 64 47 30 6d 42 75 30 Data Ascii: 5mMIW1Madn1AIoYDm5k%2F1bxQ3ws4gnvNPAxjCdUPFiZRrZhz22xFNJsbexXNIqqUmIJ%2F7z9dG0mBu0LMaoe8QDsXPPUmwoY80V3lAOcqUPWmPLwZHehVRilGefvUIMbGkwWxXM92SWz9Hu5IZznjb7bwtc9h1NsYnX1SFbfDnTrl7cCDF1ivcbzKB2L7a3efO3jNrYJzMSDG2LgY6qi18x%2FKYstMj1Ig7jsZikSZFYY3b
Nov 8, 2024 14:28:52.062931061 CET	2472	OUT	Data Raw: 79 4e 4e 44 7a 62 53 46 66 6b 78 4a 63 34 36 75 39 75 4f 47 43 48 72 5a 25 32 42 49 66 32 6b 71 55 78 49 34 6a 4e 6d 35 6c 62 56 30 61 6e 4c 47 32 44 74 42 53 4b 4f 56 77 53 6e 4c 64 76 45 38 43 77 57 4a 48 6e 6e 4c 4a 7a 76 25 32 46 6b 58 49 43 Data Ascii: yNNDzbSFfkxJc46u9uOGCHrZ%2BIf2kqUxI4jNm5lbV0anLG2DtBSKOVwSnLdvE8CwWJHnnLJzv%2FkXICN247sU%2Bjo9SXYiOrc2rvP4f1w%2BCdzkyOVMD5LWXum9sV3WJM%2BE%2BrqfKTu1FD8iG7N%2Bwt3AxkFJ7jHl3KUrr6koB5S5wMYLW9T5Nc8z7dMZRCNTz7q7kZ3YreKzJiNM%2Fu7brfrElDNlzHkHkOOb%2F
Nov 8, 2024 14:28:52.063035011 CET	2472	OUT	Data Raw: 31 6f 72 72 71 43 4e 51 64 25 32 42 32 41 4c 73 75 33 79 36 59 47 56 79 38 54 69 63 44 5a 77 50 37 54 56 63 31 6f 78 65 4c 47 6a 6d 55 32 48 63 64 61 4e 77 39 58 6c 58 41 46 68 53 64 35 31 42 32 77 53 4d 59 6a 37 62 57 79 72 79 42 31 52 4e 6a 45 Data Ascii: 1orrqCNQd%2B2ALsu3y6YGVy8TicDZwP7TVc1oxeLGjmU2HcdaNw9XlXAFhSd51B2wSMYj7bWyryB1RNjEJ9dceGGgeHQXMXXzGyk2aNsYDBi4X%2FK%2BiLEMCyfr2Jar%2FNU4dIw4g9YUjEOlzaxlUu1ojzQyvcNK6EEAwkfEC3muuSrxRUPk09fO%2FveUtyrMLp4nM%2BzgG%2BPFLMvcZ94AsNoebJ3FEUCCEVzhniwI3
Nov 8, 2024 14:28:52.063059092 CET	2472	OUT	Data Raw: 6e 52 72 4e 42 25 32 42 55 64 63 77 46 77 42 54 72 39 6e 49 4b 45 4e 57 30 5a 50 55 48 69 38 6a 64 47 41 53 35 6a 74 57 63 38 64 6b 75 31 50 71 69 70 37 45 4f 61 6d 76 6d 75 77 64 72 32 6e 30 33 6b 48 48 30 32 72 77 56 25 32 46 4c 75 31 6e 54 47 Data Ascii: nRrNB%2BUdcwFwBTr9nIKENW0ZPUHi8jdGAS5jtWc8dku1Pqip7EOamvmuwdr2n03kHH02rwV%2FLu1nTGA3jpwRL5vchMu5cl7aqOGo6IOYHA%2FXqxnU9l9vjyguIWFKDR4CODx3E3GJmgDqDQsn82AvOyzOA1NN14SmtuC0KnGkr53ZgkBSyKuqbZZG45pdaTF%2BceRckXpFCn%2F%2FT8eBfxZhIGF9GlCDbyzu8FSkDwi
Nov 8, 2024 14:28:52.063111067 CET	4944	OUT	Data Raw: 70 4f 76 39 69 45 38 30 65 25 32 46 6e 55 78 43 59 25 32 46 4c 4e 56 35 56 54 36 5a 36 73 59 33 35 31 48 54 65 7a 30 47 79 4c 76 42 6f 78 77 4e 36 6b 32 77 5a 77 77 71 25 32 42 63 54 79 76 70 5a 61 51 67 4d 73 4c 30 68 6d 77 6c 32 6b 4d 32 6e 61 Data Ascii: pOv9iE80e%2FnUxCY%2FLNV5VT6Z6sY351HTez0GyLvBoxwN6k2wZwwq%2BcTyvpZaQgMsL0hmwl2kM2naBrfgsvIh8upXDTsnFiWTQvfBYesKOw3UJ8w0fn9wWDMtDPyg5sCtn5XLlZZ%2BDMfLmALDHkqFiDEtXVkiSZO2olOLWhHIv2Ry5rMTtVelPm0%2F6WL1nNoDe8SRbxvITXPlf4wOWjraT3Q5ZAGOIIHYvsmgQZ%2F
Nov 8, 2024 14:28:52.063148975 CET	2472	OUT	Data Raw: 48 78 64 69 52 59 66 51 4c 37 6a 4d 77 46 48 37 39 52 79 42 44 39 72 36 6b 49 42 25 32 46 41 51 31 45 62 67 52 6a 7a 6d 58 41 46 6d 51 71 65 62 45 33 64 71 6f 52 55 39 41 38 4d 75 62 68 36 42 79 61 41 4f 76 42 57 25 32 42 4f 4c 4e 68 25 32 46 4d Data Ascii: HxdiRYfQL7jMwFH79RyBD9r6kIB%2FAQ1EbgRjzmXAFmQqebE3dqoRU9A8Mubh6ByaAOvBW%2BOLNh%2FMpt6SrGFoXFH34Z7AtsH%2F15COP3TFFhGiAnGfVdBwjW1OFIvFSPzK1Kz%2FAJhBWCvJiaJoaBxKz9LrVr5YZdfdMJrKo2rwO7m49FIPn1IBZiiRMrSTnNPPXMgNQJHZgjasp9vfaVtkHFNprXtfmkd60fQgeBLxk
Nov 8, 2024 14:28:52.063219070 CET	2472	OUT	Data Raw: 39 4f 55 37 35 38 36 62 52 4f 77 4d 25 32 42 34 75 45 58 72 63 61 34 4c 66 53 32 45 68 54 79 41 69 52 50 6a 66 6a 30 30 32 66 33 55 41 41 58 6c 46 36 4d 74 41 69 41 74 44 73 4c 6b 5a 56 36 35 53 6e 38 5a 39 53 6e 33 43 6b 56 4b 25 32 42 31 49 66 Data Ascii: 9OU7586bROwM%2B4uEXrca4LfS2EhTyAiRPjfj002f3UAAXlF6MtAiAtDsLkZV65Sn8Z9Sn3CkVK%2B1IfyvRzEfHm25oWFpSe86USNwuwrR95MGNb7d32Ad6iQRLCd4l8iONNM1beRhGBvc9rULURwU5k%2BYIS8usg%2BUGLH15w3LJwliJskeDo3N%2FJi%2B4WXPKmVFEOfSXhY2EppEbErJnct8ZZ5bnND%2FVk0xKt14v
Nov 8, 2024 14:28:52.067857981 CET	2472	OUT	Data Raw: 37 6d 6b 65 50 52 47 71 5a 61 68 66 78 67 6a 5a 75 30 39 56 74 76 45 4b 25 32 42 7a 6b 72 61 76 25 32 46 61 5a 6e 67 43 75 54 34 41 74 25 32 46 4b 75 53 6a 56 37 55 38 5a 4d 61 6b 76 4c 77 73 65 67 6d 4b 70 58 4c 25 32 42 54 47 59 6b 64 69 50 67 Data Ascii: 7mkePRGqZahfxgjZu09VtvEK%2Bzkrav%2FaZngCuT4At%2FKuSjV7U8ZMakvLwsegmKpXL%2BTGYkdiPgdOVavRAzO1DNenuv8OgdoU2jxrhD5QA9bsZRJVPHrHK8TN2NYI33UjXt4%2FKbsO8EbndZRigo%2BxCogH%2BeW2jEsPierVCsroLSEYqbZh%2BclDcP8EOVRRaykanZmb0yf1ieGBUZmwT9iAE4xC7pzR4o%2Fxn
Nov 8, 2024 14:28:52.775461912 CET	302	IN	HTTP/1.1 414 Request-URI Too Large Server: awselb/2.0 Date: Fri, 08 Nov 2024 13:28:52 GMT Content-Type: text/html Content-Length: 142 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 34 20 52 65 71 75 65 73 74 2d 55 52 49 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 34 20 52 65 71 75 65 73 74 2d 55 52 49 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>414 Request-URI Too Large</title></head><body><center><h1>414 Request-URI Too Large</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	54.161.165.135	80	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 14:28:53.630722046 CET	487	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 8, 2024 14:28:54.300478935 CET	493	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Fri, 08 Nov 2024 13:28:54 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49700	104.17.24.14	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:52 UTC	542	OUT	GET /ajax/libs/select2/4.0.12/css/select2.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:52 UTC	947	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:52 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fcb-3a76" Last-Modified: Mon, 04 May 2020 16:16:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 55012 Expires: Wed, 29 Oct 2025 13:28:52 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ghoNwYTQEU1BQgCpo5uxAIaOPwcyFc%2BlldRfS3hoKrp5hjFs3lYwK6VmqZUPnNEXwo3vk6VazzuTRyLEYNtvBA2vJAGFH0%2B6Z%2BDrbWq4P6DsJXP%2FPcoIRMZN%2FnpumzBiG8RlQYnP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8df5e8a17dd3e9b5-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 13:28:52 UTC	422	IN	Data Raw: 33 61 37 36 0d 0a 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 Data Ascii: 3a76.select2-container{box-sizing:border-box;display:inline-block;margin:0;position:relative;vertical-align:middle}.select2-container .select2-selection--single{box-sizing:border-box;cursor:pointer;display:block;height:28px;user-select:none;-webkit-user
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 3a 65 6c 6c 69 70 73 69 73 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 63 6c 65 61 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 30 70 78 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 Data Ascii: :ellipsis;white-space:nowrap}.select2-container .select2-selection--single .select2-selection__clear{position:relative}.select2-container[dir="rtl"] .select2-selection--single .select2-selection__rendered{padding-right:8px;padding-left:20px}.select2-conta
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 64 72 6f 70 64 6f 77 6e 2d 2d 61 62 6f 76 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6f 70 65 6e 20 2e 73 65 6c 65 63 74 32 2d 64 72 6f 70 64 6f 77 6e 2d 2d 62 65 6c 6f 77 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 73 65 61 72 63 68 2d 2d 64 72 6f 70 64 6f 77 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e Data Ascii: dropdown--above{border-bottom:none;border-bottom-left-radius:0;border-bottom-right-radius:0}.select2-container--open .select2-dropdown--below{border-top:none;border-top-left-radius:0;border-top-right-radius:0}.select2-search--dropdown{display:block;paddin
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 61 72 72 6f 77 7b 68 65 69 67 68 74 3a 32 36 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 31 70 78 3b 72 69 67 68 74 3a 31 70 78 3b 77 69 64 74 68 3a 32 30 70 78 7d 2e 73 65 6c Data Ascii: -weight:bold}.select2-container--default .select2-selection--single .select2-selection__placeholder{color:#999}.select2-container--default .select2-selection--single .select2-selection__arrow{height:26px;position:absolute;top:1px;right:1px;width:20px}.sel
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 20 6c 69 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 20 2e 73 65 6c 65 63 74 32 Data Ascii: on__rendered{box-sizing:border-box;list-style:none;margin:0;padding:0 5px;width:100%}.select2-container--default .select2-selection--multiple .select2-selection__rendered li{list-style:none}.select2-container--default .select2-selection--multiple .select2
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 74 61 69 6e 65 72 2d 2d 66 6f 63 75 73 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 62 6c 61 63 6b 20 31 70 78 3b 6f 75 74 6c 69 6e 65 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 69 73 61 62 6c 65 64 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 69 73 61 62 6c 65 64 20 2e Data Ascii: tainer--focus .select2-selection--multiple{border:solid black 1px;outline:0}.select2-container--default.select2-container--disabled .select2-selection--multiple{background-color:#eee;cursor:default}.select2-container--default.select2-container--disabled .
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 5b 61 72 69 61 2d 73 65 6c 65 63 74 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 64 64 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 65 6d 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e Data Ascii: tainer--default .select2-results__option[aria-selected=true]{background-color:#ddd}.select2-container--default .select2-results__option .select2-results__option{padding-left:1em}.select2-container--default .select2-results__option .select2-results__option
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 67 72 6f 75 70 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 36 70 78 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 63 6c 61 73 73 69 63 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 37 66 37 66 37 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 6f 75 74 6c 69 6e 65 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 35 30 Data Ascii: efault .select2-results__group{cursor:default;display:block;padding:6px}.select2-container--classic .select2-selection--single{background-color:#f7f7f7;border:1px solid #aaa;border-radius:4px;outline:0;background-image:-webkit-linear-gradient(top, #fff 50
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 23 65 65 65 20 35 30 25 2c 20 23 63 63 63 20 31 30 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 3b 66 69 6c 74 65 72 3a 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 67 72 61 64 69 65 6e 74 28 73 74 61 72 74 43 6f 6c 6f 72 73 74 72 3d 27 23 46 46 45 45 45 45 45 45 27 2c 20 65 6e 64 43 6f 6c 6f 72 73 74 72 3d 27 23 46 46 43 43 43 43 43 43 27 2c 20 47 72 61 64 69 65 6e 74 54 79 70 65 3d 30 29 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 63 6c 61 73 73 69 63 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f Data Ascii: background-image:linear-gradient(to bottom, #eee 50%, #ccc 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFEEEEEE', endColorstr='#FFCCCCCC', GradientType=0)}.select2-container--classic .select2-selectio
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 6f 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 3b Data Ascii: left-radius:0;border-top-right-radius:0;background-image:-webkit-linear-gradient(top, #fff 0%, #eee 50%);background-image:-o-linear-gradient(top, #fff 0%, #eee 50%);background-image:linear-gradient(to bottom, #fff 0%, #eee 50%);background-repeat:repeat-x;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49701	104.17.24.14	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:52 UTC	526	OUT	GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:52 UTC	959	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:52 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fcb-112d5" Last-Modified: Mon, 04 May 2020 16:16:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 236757 Expires: Wed, 29 Oct 2025 13:28:52 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kxl2gmpUR8G5HiNoyaRAPVJHoWnya0QzSToYeGndfqQ5m%2F5TgzdY5ue%2FT3ASgvuoWK6D8h9IrZEUynmCyK%2BoPCxnzgFVV6bLk05aqXEeGsJYSr9Yqc3UC4ReHIWWjFpys8bRsUGK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8df5e8a17adb6bf2-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 13:28:52 UTC	410	IN	Data Raw: 37 62 66 31 0d 0a 2f 2a 21 20 53 65 6c 65 63 74 32 20 34 2e 30 2e 31 32 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 65 6c 65 63 74 32 2f 73 65 6c 65 63 74 32 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 2e 6d 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 6e 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 22 75 6e 64 Data Ascii: 7bf1/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="und
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 61 72 20 65 3d 75 2e 66 6e 2e 73 65 6c 65 63 74 32 2e 61 6d 64 3b 76 61 72 20 74 2c 6e 2c 72 2c 68 2c 6f 2c 73 2c 66 2c 67 2c 6d 2c 76 2c 79 2c 5f 2c 69 2c 61 2c 77 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 69 2e 63 61 6c 6c 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 2c 73 2c 61 2c 6c 2c 63 2c 75 2c 64 2c 70 2c 68 3d 74 26 26 74 2e 73 70 6c 69 74 28 22 2f 22 29 2c 66 3d 79 2e 6d 61 70 2c 67 3d 66 26 26 66 5b 22 2a 22 5d 7c 7c 7b 7d 3b 69 66 28 65 29 7b 66 6f 72 28 73 3d 28 65 3d 65 2e 73 70 6c 69 74 28 22 2f 22 29 29 2e 6c 65 6e 67 74 68 2d 31 2c 79 2e 6e 6f 64 65 49 64 43 6f 6d 70 61 74 26 26 77 2e 74 65 73 74 28 65 5b 73 5d 29 26 26 28 65 5b 73 5d 3d 65 5b 73 5d 2e 72 Data Ascii: ar e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].r
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 72 6e 20 65 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 3d 6c 28 69 2c 6f 29 29 29 2c 69 3f 65 3d 6e 26 26 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 3f 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6c 28 65 2c 74 29 7d 7d 28 6f 29 29 3a 6c 28 65 2c 6f 29 3a 28 69 3d 28 72 3d 63 28 65 3d 6c 28 65 2c 6f 29 29 29 5b 30 5d 2c 65 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 29 29 29 2c 7b 66 3a 69 3f 69 2b 22 21 22 2b 65 3a 65 2c 6e 3a 65 2c 70 72 3a 69 2c 70 3a 6e 7d 7d 2c 67 3d 7b 72 65 71 75 69 72 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 28 65 29 7d 2c 65 78 70 6f 72 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6d Data Ascii: rn e=r[1],i&&(n=D(i=l(i,o))),i?e=n&&n.normalize?n.normalize(e,function(t){return function(e){return l(e,t)}}(o)):l(e,o):(i=(r=c(e=l(e,o)))[0],e=r[1],i&&(n=D(i))),{f:i?i+"!"+e:e,n:e,pr:i,p:n}},g={require:function(e){return A(e)},exports:function(e){var t=m
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 28 22 53 65 65 20 61 6c 6d 6f 6e 64 20 52 45 41 44 4d 45 3a 20 69 6e 63 6f 72 72 65 63 74 20 6d 6f 64 75 6c 65 20 62 75 69 6c 64 2c 20 6e 6f 20 6d 6f 64 75 6c 65 20 6e 61 6d 65 22 29 3b 74 2e 73 70 6c 69 63 65 7c 7c 28 6e 3d 74 2c 74 3d 5b 5d 29 2c 62 28 6d 2c 65 29 7c 7c 62 28 76 2c 65 29 7c 7c 28 76 5b 65 5d 3d 5b 65 2c 74 2c 6e 5d 29 7d 29 2e 61 6d 64 3d 7b 6a 51 75 65 72 79 3a 21 30 7d 2c 65 2e 72 65 71 75 69 72 65 6a 73 3d 74 2c 65 2e 72 65 71 75 69 72 65 3d 6e 2c 65 2e 64 65 66 69 6e 65 3d 72 29 2c 65 2e 64 65 66 69 6e 65 28 22 61 6c 6d 6f 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 65 2e 64 65 66 69 6e 65 28 22 6a 71 75 65 72 79 22 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 7c 7c 24 3b 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: ("See almond README: incorrect module build, no module name");t.splice\|\|(n=t,t=[]),b(m,e)\|\|b(v,e)\|\|(v[e]=[e,t,n])}).amd={jQuery:!0},e.requirejs=t,e.require=n,e.define=r),e.define("almond",function(){}),e.define("jquery",[],function(){var e=u\|\|$;return nul
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 2c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 63 3d 65 5b 6c 5d 3b 6f 2e 70 72 6f 74 6f 74 79 70 65 5b 63 5d 3d 61 28 63 29 7d 72 65 74 75 72 6e 20 6f 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 7b 7d 7d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 7c 7c 7b 7d 2c 65 20 69 6e 20 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3f 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 2e 70 75 73 68 28 74 29 3a 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 3d 5b 74 Data Ascii: ,n.apply(this,arguments)}}for(var l=0;l<e.length;l++){var c=e[l];o.prototype[c]=a(c)}return o};function e(){this.listeners={}}e.prototype.on=function(e,t){this.listeners=this.listeners\|\|{},e in this.listeners?this.listeners[e].push(t):this.listeners[e]=[t
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 26 67 74 3b 22 2c 27 22 27 3a 22 26 71 75 6f 74 3b 22 2c 22 27 22 3a 22 26 23 33 39 3b 22 2c 22 2f 22 3a 22 26 23 34 37 3b 22 7d 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 3f 65 3a 53 74 72 69 6e 67 28 65 29 2e 72 65 70 6c 61 63 65 28 2f 5b 26 3c 3e 22 27 5c 2f 5c 5c 5d 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 7d 2c 69 2e 61 70 70 65 6e 64 4d 61 6e 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 31 2e 37 22 3d 3d 3d 6f 2e 66 6e 2e 6a 71 75 65 72 79 2e 73 75 62 73 74 72 28 30 2c 33 29 29 7b 76 61 72 20 6e 3d 6f 28 29 3b 6f 2e 6d 61 70 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 6e 2e 61 64 64 28 65 29 7d 29 2c 74 3d 6e 7d 65 2e 61 70 70 65 6e 64 28 74 29 7d 2c 69 Data Ascii: >",'"':""","'":"'","/":"/"};return"string"!=typeof e?e:String(e).replace(/[&<>"'\/\\]/g,function(e){return t[e]})},i.appendMany=function(e,t){if("1.7"===o.fn.jquery.substr(0,3)){var n=o();o.map(t,function(e){n=n.add(e)}),t=n}e.append(t)},i
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 70 65 4d 61 72 6b 75 70 22 29 3b 74 68 69 73 2e 63 6c 65 61 72 28 29 2c 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 6e 3d 68 28 27 3c 6c 69 20 72 6f 6c 65 3d 22 61 6c 65 72 74 22 20 61 72 69 61 2d 6c 69 76 65 3d 22 61 73 73 65 72 74 69 76 65 22 20 63 6c 61 73 73 3d 22 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 22 3e 3c 2f 6c 69 3e 27 29 2c 72 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 65 2e 6d 65 73 73 61 67 65 29 3b 6e 2e 61 70 70 65 6e 64 28 74 28 72 28 65 2e 61 72 67 73 29 29 29 2c 6e 5b 30 5d 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6d 65 73 73 61 67 65 22 2c 74 68 69 73 2e 24 72 Data Ascii: peMarkup");this.clear(),this.hideLoading();var n=h('<li role="alert" aria-live="assertive" class="select2-results__option"></li>'),r=this.options.get("translations").get(e.message);n.append(t(r(e.args))),n[0].className+=" select2-results__message",this.$r
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 2e 73 65 6c 65 63 74 65 64 7c 7c 6e 75 6c 6c 3d 3d 74 2e 65 6c 65 6d 65 6e 74 26 26 2d 31 3c 68 2e 69 6e 41 72 72 61 79 28 6e 2c 72 29 3f 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 74 72 75 65 22 29 3a 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 66 61 6c 73 65 22 29 7d 29 7d 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 68 6f 77 4c 6f 61 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 74 3d 7b 64 69 73 61 62 6c 65 64 3a 21 30 2c 6c 6f 61 64 69 6e 67 3a 21 30 2c 74 65 78 74 3a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 22 73 65 61 72 63 68 69 6e 67 22 29 28 65 Data Ascii: .selected\|\|null==t.element&&-1<h.inArray(n,r)?e.attr("aria-selected","true"):e.attr("aria-selected","false")})})},r.prototype.showLoading=function(e){this.hideLoading();var t={disabled:!0,loading:!0,text:this.options.get("translations").get("searching")(e
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 70 70 65 6e 64 28 61 29 2c 73 2e 61 70 70 65 6e 64 28 70 29 7d 65 6c 73 65 20 74 68 69 73 2e 74 65 6d 70 6c 61 74 65 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 66 2e 53 74 6f 72 65 44 61 74 61 28 74 2c 22 64 61 74 61 22 2c 65 29 2c 74 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6c 3d 74 68 69 73 2c 6e 3d 74 2e 69 64 2b 22 2d 72 65 73 75 6c 74 73 22 3b 74 68 69 73 2e 24 72 65 73 75 6c 74 73 2e 61 74 74 72 28 22 69 64 22 2c 6e 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 61 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 2e 63 6c 65 61 72 28 29 2c 6c 2e 61 70 70 65 6e 64 28 65 2e 64 61 74 61 29 2c 74 2e 69 73 4f 70 65 6e 28 29 26 26 28 6c 2e 73 65 74 43 6c 61 73 73 65 73 28 29 2c 6c 2e 68 Data Ascii: ppend(a),s.append(p)}else this.template(e,t);return f.StoreData(t,"data",e),t},r.prototype.bind=function(t,e){var l=this,n=t.id+"-results";this.$results.attr("id",n),t.on("results:all",function(e){l.clear(),l.append(e.data),t.isOpen()&&(l.setClasses(),l.h
2024-11-08 13:28:52 UTC	1369	IN	Data Raw: 28 6e 3c 3d 30 29 29 7b 76 61 72 20 72 3d 6e 2d 31 3b 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 72 3d 30 29 3b 76 61 72 20 69 3d 74 2e 65 71 28 72 29 3b 69 2e 74 72 69 67 67 65 72 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 29 3b 76 61 72 20 6f 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 73 3d 69 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 61 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 2b 28 73 2d 6f 29 3b 30 3d 3d 3d 72 3f 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 30 29 3a 73 2d 6f 3c 30 26 26 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 61 29 7d 7d 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 6e 65 78 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d Data Ascii: (n<=0)){var r=n-1;0===e.length&&(r=0);var i=t.eq(r);i.trigger("mouseenter");var o=l.$results.offset().top,s=i.offset().top,a=l.$results.scrollTop()+(s-o);0===r?l.$results.scrollTop(0):s-o<0&&l.$results.scrollTop(a)}}),t.on("results:next",function(){var e=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49704	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:52 UTC	506	OUT	GET /postx.css HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:53 UTC	725	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 125394 Connection: close Last-Modified: Sat, 08 Jun 2024 05:00:10 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 08 Nov 2024 13:28:53 GMT ETag: "a0b4ff216e038470b000b63f5aa39816" X-Cache: Hit from cloudfront Via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: r_TzfkcHlLvzpz8CbwUESFizoQdS4GgKwIAD9Isg4xVZmBoNrUyLRg== Age: 20333 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Vary: Origin
2024-11-08 13:28:53 UTC	16384	IN	Data Raw: 2f 2a 20 49 6e 74 65 72 20 46 6f 6e 74 20 4c 69 62 72 61 72 79 20 2a 2f 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 74 65 72 22 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 31 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2f 66 6f 6e 74 73 2f 49 6e 74 65 72 2f 49 6e 74 65 72 2d 54 68 69 6e 2e 74 74 66 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 3b 0a 7d 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 74 65 72 22 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 32 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2f 66 6f 6e 74 73 2f 49 6e 74 65 72 2f 49 6e 74 65 72 2d 45 78 74 72 61 4c 69 67 68 74 2e 74 74 66 22 29 20 Data Ascii: /* Inter Font Library */@font-face { font-family: "Inter"; font-weight: 100; src: url("./fonts/Inter/Inter-Thin.ttf") format("truetype");}@font-face { font-family: "Inter"; font-weight: 200; src: url("./fonts/Inter/Inter-ExtraLight.ttf")
2024-11-08 13:28:53 UTC	16384	IN	Data Raw: 35 35 35 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 7d 0a 0a 2e 6c 69 73 74 43 65 6c 6c 4c 69 6e 6b 54 65 78 74 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 33 33 36 36 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 7d 0a 0a 2e 6c 69 73 74 43 65 6c 6c 45 72 72 6f 72 54 65 78 74 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 63 63 30 30 30 30 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 7d 0a 0a 2f 2a 20 4f 74 68 65 72 20 73 74 79 6c 65 73 20 28 6f 66 74 65 6e 20 70 61 67 65 20 73 70 65 63 69 66 69 63 29 20 2a 2f 0a 0a 2e 66 6f 72 6d 49 6e 70 75 74 43 65 6c 6c 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 20 31 30 70 78 20 30 70 Data Ascii: 555; font-size: 8pt;}.listCellLinkText { color: #003366; font-size: 8pt; text-decoration: underline;}.listCellErrorText { color: #cc0000; font-size: 8pt;}/* Other styles (often page specific) */.formInputCell { margin: 0px 10px 0p
2024-11-08 13:28:53 UTC	16384	IN	Data Raw: 68 61 6c 6c 65 6e 67 65 51 75 65 73 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 35 35 35 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 20 30 70 78 20 31 30 70 78 20 35 70 78 3b 0a 7d 0a 0a 23 73 75 70 70 6f 72 74 43 6f 6e 74 61 63 74 54 61 62 6c 65 20 7b 7d 0a 0a 2e 73 75 70 70 6f 72 74 54 61 62 6c 65 48 65 61 64 69 6e 67 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 35 35 35 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 31 35 70 78 20 31 30 70 78 20 35 70 78 3b 0a 7d Data Ascii: hallengeQuestionContainer { color: #555555; font-size: 8pt; font-weight: normal; margin: 0px 0px 10px 5px;}#supportContactTable {}.supportTableHeading { color: #555555; font-size: 8pt; font-weight: bold; padding: 20px 15px 10px 5px;}
2024-11-08 13:28:53 UTC	14808	IN	Data Raw: 6c 6f 72 3a 20 23 66 66 64 39 64 63 3b 0a 7d 0a 0a 23 74 69 63 6b 2d 6d 61 72 6b 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 36 63 63 30 34 61 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 76 77 3b 0a 7d 0a 0a 23 63 6c 6f 73 65 2d 6d 61 72 6b 20 7b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6c 69 67 68 74 65 72 3b 0a 7d 0a 0a 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 29 20 7b 0a 20 20 2e 65 78 70 69 72 79 4c 6f 63 6b 50 61 67 65 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 39 33 39 33 62 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 2e 35 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 39 38 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 Data Ascii: lor: #ffd9dc;}#tick-mark { color: #6cc04a; padding-right: 1vw;}#close-mark { font-weight: lighter;}@media screen and (max-width: 600px) { .expiryLockPage { color: #39393b; font-size: 16.5px; font-weight: 398; line-height:
2024-11-08 13:28:53 UTC	16384	IN	Data Raw: 31 38 33 2c 20 34 38 2c 20 30 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 2d 66 2d 32 3a 20 72 67 62 61 28 32 31 39 2c 20 31 35 31 2c 20 31 32 38 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 2d 66 2d 31 3a 20 72 67 62 61 28 32 34 31 2c 20 32 31 34 2c 20 32 30 34 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 2d 65 2d 33 3a 20 72 67 62 61 28 32 34 34 2c 20 31 30 30 2c 20 31 32 32 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 2d 65 2d 32 3a 20 72 67 62 61 28 32 34 39 2c 20 31 37 37 2c 20 31 38 38 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 2d 65 2d 31 3a 20 72 67 62 61 28 32 35 33 2c 20 32 32 34 2c 20 32 32 38 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 Data Ascii: 183, 48, 0, 1); --color-accent-f-2: rgba(219, 151, 128, 1); --color-accent-f-1: rgba(241, 214, 204, 1); --color-accent-e-3: rgba(244, 100, 122, 1); --color-accent-e-2: rgba(249, 177, 188, 1); --color-accent-e-1: rgba(253, 224, 228, 1); --color
2024-11-08 13:28:53 UTC	16384	IN	Data Raw: 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 0a 2e 6d 64 73 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2c 0a 2e 6d 64 73 2d 62 75 74 74 6f 6e 2e 6d 64 73 2d 62 75 74 74 6f 6e 2d 6c 6f 61 64 69 6e 67 5b 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 5c 22 74 72 75 65 5c 22 5d 2c 0a 2e 6d 64 73 2d 62 75 74 74 6f 6e 5b 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 5c 22 74 72 75 65 5c 22 5d 3a 64 69 73 61 62 6c 65 64 2c 0a 2e 6d 64 73 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 5b 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 5c 22 74 72 75 65 5c 22 5d 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 6d 64 73 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 2d 74 65 78 74 2d 64 69 73 Data Ascii: ton:disabled:focus-visible,.mds-button[disabled]:focus-visible,.mds-button.mds-button-loading[aria-expanded=\"true\"],.mds-button[aria-expanded=\"true\"]:disabled,.mds-button[disabled][aria-expanded=\"true\"] { color: var(--mds-button-color-text-dis
2024-11-08 13:28:54 UTC	16384	IN	Data Raw: 0a 20 20 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 20 5c 22 74 6e 75 6d 5c 22 3b 0a 20 20 66 6f 6e 74 2d 76 61 72 69 61 6e 74 2d 6e 75 6d 65 72 69 63 3a 20 74 61 62 75 6c 61 72 2d 6e 75 6d 73 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 2d 32 29 3b 0a 7d 0a 0a 2e 6d 64 73 2d 74 65 78 74 2d 6d 6f 6e 6f 73 70 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 5c 22 52 6f 62 6f 74 6f 20 4d 6f 6e 6f 5c 22 2c 20 53 46 4d 6f 6e 6f 2d 52 65 67 75 6c 61 72 2c 20 43 6f 6e 73 6f 6c 61 73 2c 20 5c 22 4c 69 62 65 72 61 74 69 6f 6e 20 4d 6f 6e 6f 5c 22 2c 20 4d 65 6e 6c 6f 2c 20 43 6f 75 72 69 65 72 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 7d 0a 0a 2e 6d 64 Data Ascii: font-feature-settings: \"tnum\"; font-variant-numeric: tabular-nums; background-color: var(--color-neutral-2);}.mds-text-monospace { font-family: \"Roboto Mono\", SFMono-Regular, Consolas, \"Liberation Mono\", Menlo, Courier, monospace;}.md
2024-11-08 13:28:54 UTC	12282	IN	Data Raw: 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 61 72 69 61 2d 69 6e 76 61 6c 69 64 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 73 74 72 69 6e 67 22 20 76 61 6c 75 65 3d 22 22 20 63 6c 61 73 73 3d 22 6d 64 73 2d 72 65 62 75 69 6c 64 2d 69 6e 70 75 74 20 6d 64 73 2d 72 65 62 75 69 6c 64 2d 69 6e 70 75 74 2d 73 69 7a 65 2d 6d 64 20 66 69 65 6c 64 4c 65 6e 39 30 22 3e 0a 20 20 20 20 20 20 3c 2f 6c 61 62 65 6c 3e 20 0a 20 20 20 20 20 20 2a 2f 0a 2e 6d 64 73 2d 72 65 62 75 69 6c 64 2d 69 6e 70 75 74 2d 66 72 61 6d 65 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 67 61 70 3a 20 76 61 72 28 2d 2d 73 69 Data Ascii: n> </div> <input aria-invalid="false" type="string" value="" class="mds-rebuild-input mds-rebuild-input-size-md fieldLen90"> </label> */.mds-rebuild-input-frame { display: flex; flex-direction: column; gap: var(--si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49705	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:53 UTC	557	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:53 UTC	742	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:53 GMT Content-Type: image/gif Content-Length: 49 Connection: close Set-Cookie: AWSALB=9AGwpPUMFW/C9ztKe3o+6zfA3LREXWhFDNBhw4ubmbUbwNBIYvAxmGA/Xl/VUwpm/UkZhNtV88h23Vcy0H714Vx+qFwCzVQpLjFLlCvZDtYg29zQdIANeNqGpKaa; Expires=Fri, 15 Nov 2024 13:28:53 GMT; Path=/ Set-Cookie: AWSALBCORS=9AGwpPUMFW/C9ztKe3o+6zfA3LREXWhFDNBhw4ubmbUbwNBIYvAxmGA/Xl/VUwpm/UkZhNtV88h23Vcy0H714Vx+qFwCzVQpLjFLlCvZDtYg29zQdIANeNqGpKaa; Expires=Fri, 15 Nov 2024 13:28:53 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private Server: unknown
2024-11-08 13:28:53 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49706	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:53 UTC	653	OUT	GET /websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:53 UTC	971	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:53 GMT Content-Type: image/gif Content-Length: 10598 Connection: close Set-Cookie: AWSALB=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/; Expires=Fri, 15 Nov 2024 13:28:53 GMT; Path=/ Set-Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/; Expires=Fri, 15 Nov 2024 13:28:53 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=1FFEE4AF18B1F84D3E2269BDC9A4223F; Path=/websafe; Secure; HttpOnly Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-2966" Server: unknown
2024-11-08 13:28:53 UTC	8459	IN	Data Raw: 47 49 46 38 39 61 00 05 28 03 f1 00 00 00 00 00 f6 f6 f6 f7 f7 f7 f8 f8 f8 21 f9 04 01 00 00 00 00 21 ff 0b 49 6d 61 67 65 4d 61 67 69 63 6b 0e 67 61 6d 6d 61 3d 30 2e 34 35 34 35 34 35 00 2c 00 00 00 00 00 05 28 03 00 02 ff 84 8f a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 0b c7 f2 4c d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 c4 a2 f1 88 4c 2a 97 cc a6 f3 09 8d 4a a7 d4 aa f5 8a cd 6a b7 dc ae f7 0b 0e 8b c7 e4 b2 f9 8c 4e ab d7 ec b6 fb 0d 8f cb e7 f4 ba fd 8e cf eb f7 fc be ff 0f 18 28 38 48 58 68 78 88 98 a8 b8 c8 d8 e8 f8 08 19 29 39 49 59 69 79 89 99 a9 b9 c9 d9 e9 f9 09 1a 2a 3a 4a 5a 6a 7a 8a 9a aa ba ca da ea fa 0a 1b 2b 3b 4b 5b 6b 7b 8b 9b ab bb cb db eb fb 0b 1c 2c 3c 4c 5c 6c 7c 8c 9c ac bc cc dc ec fc 0c 1d 2d 3d 4d Data Ascii: GIF89a(!!ImageMagickgamma=0.454545,(HLLJjN(8HXhx)9IYiy:JZjz+;K[k{,<L\l\|-=M
2024-11-08 13:28:53 UTC	2139	IN	Data Raw: 90 f8 ba f0 1c c6 f0 00 db 90 ee f8 25 02 39 e0 0d 1f 21 0a 9f 2e 0d e5 0f 0f 67 90 09 e5 a0 03 97 ed 0a 2b a1 04 ff 90 0f dd d0 10 c9 b0 a1 c8 06 73 86 c0 09 c5 07 14 1c 11 6f 1a 4f 10 49 ff 10 11 c3 cf 0f 17 91 d9 1a d1 0e 99 6c 0d 01 ce 08 bb 21 dc 9e 0f 13 af a6 66 14 cc 12 5f 0b 15 3f 31 0c c5 50 15 79 0f 08 4b d1 5d 4e 91 12 bd d0 13 f5 4e 0f f7 90 16 13 b1 9e ea a5 5b 66 51 17 17 0f 18 13 d0 15 c5 41 14 d9 0e 16 2f cd 59 7e d1 16 dd 4f 07 a5 4d 18 63 90 13 e5 0e 19 93 2f 58 02 11 1a 3b 91 19 ed 0f 14 bd c1 d3 7e 90 14 b1 0c f4 7e 20 12 b3 a6 e9 70 71 15 59 b1 15 a5 b1 bb a8 b1 cf 2c 0d 0d cf 71 4f d6 71 1b d3 51 1d b1 11 04 15 f1 0e 11 cd ac e6 11 11 fa b1 f2 b4 31 1c bc d1 f6 4e 70 10 b0 ca 07 06 b2 08 03 d2 a7 48 84 0e a9 21 21 01 b0 1d b3 b1 b8 Data Ascii: %9!.g+soOIl!f_?1PyK]NN[fQA/Y~OMc/X;~~ pqY,qOqQ1NpH!!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49707	104.17.25.14	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:53 UTC	386	OUT	GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:54 UTC	955	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:53 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fcb-112d5" Last-Modified: Mon, 04 May 2020 16:16:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 236758 Expires: Wed, 29 Oct 2025 13:28:53 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IFhmIUh09cDvJfjjtKofmaEFDogFvvgfNlOAwqxxkcReQLT4i7Pzd6scjbx6%2FdErSKyJ0N5wQH7q3eBn7yKRdLxAMai8MjyU3otI13W4Jo1xFVfNxCNzMvnbSNbZ0YrjXgn6GH5k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8df5e8a96bf42caa-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 13:28:54 UTC	414	IN	Data Raw: 33 39 37 39 0d 0a 2f 2a 21 20 53 65 6c 65 63 74 32 20 34 2e 30 2e 31 32 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 65 6c 65 63 74 32 2f 73 65 6c 65 63 74 32 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 2e 6d 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 6e 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 22 75 6e 64 Data Ascii: 3979/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="und
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 3d 75 2e 66 6e 2e 73 65 6c 65 63 74 32 2e 61 6d 64 3b 76 61 72 20 74 2c 6e 2c 72 2c 68 2c 6f 2c 73 2c 66 2c 67 2c 6d 2c 76 2c 79 2c 5f 2c 69 2c 61 2c 77 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 69 2e 63 61 6c 6c 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 2c 73 2c 61 2c 6c 2c 63 2c 75 2c 64 2c 70 2c 68 3d 74 26 26 74 2e 73 70 6c 69 74 28 22 2f 22 29 2c 66 3d 79 2e 6d 61 70 2c 67 3d 66 26 26 66 5b 22 2a 22 5d 7c 7c 7b 7d 3b 69 66 28 65 29 7b 66 6f 72 28 73 3d 28 65 3d 65 2e 73 70 6c 69 74 28 22 2f 22 29 29 2e 6c 65 6e 67 74 68 2d 31 2c 79 2e 6e 6f 64 65 49 64 43 6f 6d 70 61 74 26 26 77 2e 74 65 73 74 28 65 5b 73 5d 29 26 26 28 65 5b 73 5d 3d 65 5b 73 5d 2e 72 65 70 6c 61 Data Ascii: =u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].repla
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 3d 6c 28 69 2c 6f 29 29 29 2c 69 3f 65 3d 6e 26 26 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 3f 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6c 28 65 2c 74 29 7d 7d 28 6f 29 29 3a 6c 28 65 2c 6f 29 3a 28 69 3d 28 72 3d 63 28 65 3d 6c 28 65 2c 6f 29 29 29 5b 30 5d 2c 65 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 29 29 29 2c 7b 66 3a 69 3f 69 2b 22 21 22 2b 65 3a 65 2c 6e 3a 65 2c 70 72 3a 69 2c 70 3a 6e 7d 7d 2c 67 3d 7b 72 65 71 75 69 72 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 28 65 29 7d 2c 65 78 70 6f 72 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6d 5b 65 5d 3b Data Ascii: =r[1],i&&(n=D(i=l(i,o))),i?e=n&&n.normalize?n.normalize(e,function(t){return function(e){return l(e,t)}}(o)):l(e,o):(i=(r=c(e=l(e,o)))[0],e=r[1],i&&(n=D(i))),{f:i?i+"!"+e:e,n:e,pr:i,p:n}},g={require:function(e){return A(e)},exports:function(e){var t=m[e];
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 65 20 61 6c 6d 6f 6e 64 20 52 45 41 44 4d 45 3a 20 69 6e 63 6f 72 72 65 63 74 20 6d 6f 64 75 6c 65 20 62 75 69 6c 64 2c 20 6e 6f 20 6d 6f 64 75 6c 65 20 6e 61 6d 65 22 29 3b 74 2e 73 70 6c 69 63 65 7c 7c 28 6e 3d 74 2c 74 3d 5b 5d 29 2c 62 28 6d 2c 65 29 7c 7c 62 28 76 2c 65 29 7c 7c 28 76 5b 65 5d 3d 5b 65 2c 74 2c 6e 5d 29 7d 29 2e 61 6d 64 3d 7b 6a 51 75 65 72 79 3a 21 30 7d 2c 65 2e 72 65 71 75 69 72 65 6a 73 3d 74 2c 65 2e 72 65 71 75 69 72 65 3d 6e 2c 65 2e 64 65 66 69 6e 65 3d 72 29 2c 65 2e 64 65 66 69 6e 65 28 22 61 6c 6d 6f 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 65 2e 64 65 66 69 6e 65 28 22 6a 71 75 65 72 79 22 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 7c 7c 24 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 Data Ascii: e almond README: incorrect module build, no module name");t.splice\|\|(n=t,t=[]),b(m,e)\|\|b(v,e)\|\|(v[e]=[e,t,n])}).amd={jQuery:!0},e.requirejs=t,e.require=n,e.define=r),e.define("almond",function(){}),e.define("jquery",[],function(){var e=u\|\|$;return null==e
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 63 3d 65 5b 6c 5d 3b 6f 2e 70 72 6f 74 6f 74 79 70 65 5b 63 5d 3d 61 28 63 29 7d 72 65 74 75 72 6e 20 6f 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 7b 7d 7d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 7c 7c 7b 7d 2c 65 20 69 6e 20 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3f 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 2e 70 75 73 68 28 74 29 3a 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 3d 5b 74 5d 7d 2c 65 Data Ascii: pply(this,arguments)}}for(var l=0;l<e.length;l++){var c=e[l];o.prototype[c]=a(c)}return o};function e(){this.listeners={}}e.prototype.on=function(e,t){this.listeners=this.listeners\|\|{},e in this.listeners?this.listeners[e].push(t):this.listeners[e]=[t]},e
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 22 2c 27 22 27 3a 22 26 71 75 6f 74 3b 22 2c 22 27 22 3a 22 26 23 33 39 3b 22 2c 22 2f 22 3a 22 26 23 34 37 3b 22 7d 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 3f 65 3a 53 74 72 69 6e 67 28 65 29 2e 72 65 70 6c 61 63 65 28 2f 5b 26 3c 3e 22 27 5c 2f 5c 5c 5d 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 7d 2c 69 2e 61 70 70 65 6e 64 4d 61 6e 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 31 2e 37 22 3d 3d 3d 6f 2e 66 6e 2e 6a 71 75 65 72 79 2e 73 75 62 73 74 72 28 30 2c 33 29 29 7b 76 61 72 20 6e 3d 6f 28 29 3b 6f 2e 6d 61 70 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 6e 2e 61 64 64 28 65 29 7d 29 2c 74 3d 6e 7d 65 2e 61 70 70 65 6e 64 28 74 29 7d 2c 69 2e 5f 5f 63 Data Ascii: ",'"':""","'":"'","/":"/"};return"string"!=typeof e?e:String(e).replace(/[&<>"'\/\\]/g,function(e){return t[e]})},i.appendMany=function(e,t){if("1.7"===o.fn.jquery.substr(0,3)){var n=o();o.map(t,function(e){n=n.add(e)}),t=n}e.append(t)},i.__c
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 72 6b 75 70 22 29 3b 74 68 69 73 2e 63 6c 65 61 72 28 29 2c 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 6e 3d 68 28 27 3c 6c 69 20 72 6f 6c 65 3d 22 61 6c 65 72 74 22 20 61 72 69 61 2d 6c 69 76 65 3d 22 61 73 73 65 72 74 69 76 65 22 20 63 6c 61 73 73 3d 22 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 22 3e 3c 2f 6c 69 3e 27 29 2c 72 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 65 2e 6d 65 73 73 61 67 65 29 3b 6e 2e 61 70 70 65 6e 64 28 74 28 72 28 65 2e 61 72 67 73 29 29 29 2c 6e 5b 30 5d 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6d 65 73 73 61 67 65 22 2c 74 68 69 73 2e 24 72 65 73 75 6c Data Ascii: rkup");this.clear(),this.hideLoading();var n=h('<li role="alert" aria-live="assertive" class="select2-results__option"></li>'),r=this.options.get("translations").get(e.message);n.append(t(r(e.args))),n[0].className+=" select2-results__message",this.$resul
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 65 63 74 65 64 7c 7c 6e 75 6c 6c 3d 3d 74 2e 65 6c 65 6d 65 6e 74 26 26 2d 31 3c 68 2e 69 6e 41 72 72 61 79 28 6e 2c 72 29 3f 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 74 72 75 65 22 29 3a 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 66 61 6c 73 65 22 29 7d 29 7d 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 68 6f 77 4c 6f 61 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 74 3d 7b 64 69 73 61 62 6c 65 64 3a 21 30 2c 6c 6f 61 64 69 6e 67 3a 21 30 2c 74 65 78 74 3a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 22 73 65 61 72 63 68 69 6e 67 22 29 28 65 29 7d 2c 6e Data Ascii: ected\|\|null==t.element&&-1<h.inArray(n,r)?e.attr("aria-selected","true"):e.attr("aria-selected","false")})})},r.prototype.showLoading=function(e){this.hideLoading();var t={disabled:!0,loading:!0,text:this.options.get("translations").get("searching")(e)},n
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 64 28 61 29 2c 73 2e 61 70 70 65 6e 64 28 70 29 7d 65 6c 73 65 20 74 68 69 73 2e 74 65 6d 70 6c 61 74 65 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 66 2e 53 74 6f 72 65 44 61 74 61 28 74 2c 22 64 61 74 61 22 2c 65 29 2c 74 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6c 3d 74 68 69 73 2c 6e 3d 74 2e 69 64 2b 22 2d 72 65 73 75 6c 74 73 22 3b 74 68 69 73 2e 24 72 65 73 75 6c 74 73 2e 61 74 74 72 28 22 69 64 22 2c 6e 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 61 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 2e 63 6c 65 61 72 28 29 2c 6c 2e 61 70 70 65 6e 64 28 65 2e 64 61 74 61 29 2c 74 2e 69 73 4f 70 65 6e 28 29 26 26 28 6c 2e 73 65 74 43 6c 61 73 73 65 73 28 29 2c 6c 2e 68 69 67 68 6c Data Ascii: d(a),s.append(p)}else this.template(e,t);return f.StoreData(t,"data",e),t},r.prototype.bind=function(t,e){var l=this,n=t.id+"-results";this.$results.attr("id",n),t.on("results:all",function(e){l.clear(),l.append(e.data),t.isOpen()&&(l.setClasses(),l.highl
2024-11-08 13:28:54 UTC	1369	IN	Data Raw: 30 29 29 7b 76 61 72 20 72 3d 6e 2d 31 3b 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 72 3d 30 29 3b 76 61 72 20 69 3d 74 2e 65 71 28 72 29 3b 69 2e 74 72 69 67 67 65 72 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 29 3b 76 61 72 20 6f 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 73 3d 69 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 61 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 2b 28 73 2d 6f 29 3b 30 3d 3d 3d 72 3f 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 30 29 3a 73 2d 6f 3c 30 26 26 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 61 29 7d 7d 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 6e 65 78 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6c 2e 67 65 Data Ascii: 0)){var r=n-1;0===e.length&&(r=0);var i=t.eq(r);i.trigger("mouseenter");var o=l.$results.offset().top,s=i.offset().top,a=l.$results.scrollTop()+(s-o);0===r?l.$results.scrollTop(0):s-o<0&&l.$results.scrollTop(a)}}),t.on("results:next",function(){var e=l.ge

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49710	54.234.149.46	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	632	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=9AGwpPUMFW/C9ztKe3o+6zfA3LREXWhFDNBhw4ubmbUbwNBIYvAxmGA/Xl/VUwpm/UkZhNtV88h23Vcy0H714Vx+qFwCzVQpLjFLlCvZDtYg29zQdIANeNqGpKaa
2024-11-08 13:28:54 UTC	742	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:54 GMT Content-Type: image/gif Content-Length: 49 Connection: close Set-Cookie: AWSALB=UsLHfk8+pNhpGOu6kOQksWGQviLyXuELN/6tE6j1dg7SFUh7Y3eDWmvY9+4uTzcacqz8SCHnKQR5OlptrwsBN+UnBSzz7AjQ/HV4qaDWoCRahoBP0EG3LpFRjXDY; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/ Set-Cookie: AWSALBCORS=UsLHfk8+pNhpGOu6kOQksWGQviLyXuELN/6tE6j1dg7SFUh7Y3eDWmvY9+4uTzcacqz8SCHnKQR5OlptrwsBN+UnBSzz7AjQ/HV4qaDWoCRahoBP0EG3LpFRjXDY; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private Server: unknown
2024-11-08 13:28:54 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49712	54.234.149.46	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	598	OUT	GET /websafe/logo/qWuRZDIlFFn0Z.ejbun830-rfiY7KGOHGT2q9s4Y9v3gB5g005b.rfoQ7ujVDdQgnEtQdA!!/branding/customer-logo.gif?f=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
2024-11-08 13:28:54 UTC	971	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:54 GMT Content-Type: image/gif Content-Length: 10598 Connection: close Set-Cookie: AWSALB=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/ Set-Cookie: AWSALBCORS=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=48DAF49D4AD0F29937E90157B4B60CD0; Path=/websafe; Secure; HttpOnly Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-2966" Server: unknown
2024-11-08 13:28:54 UTC	8459	IN	Data Raw: 47 49 46 38 39 61 00 05 28 03 f1 00 00 00 00 00 f6 f6 f6 f7 f7 f7 f8 f8 f8 21 f9 04 01 00 00 00 00 21 ff 0b 49 6d 61 67 65 4d 61 67 69 63 6b 0e 67 61 6d 6d 61 3d 30 2e 34 35 34 35 34 35 00 2c 00 00 00 00 00 05 28 03 00 02 ff 84 8f a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 0b c7 f2 4c d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 c4 a2 f1 88 4c 2a 97 cc a6 f3 09 8d 4a a7 d4 aa f5 8a cd 6a b7 dc ae f7 0b 0e 8b c7 e4 b2 f9 8c 4e ab d7 ec b6 fb 0d 8f cb e7 f4 ba fd 8e cf eb f7 fc be ff 0f 18 28 38 48 58 68 78 88 98 a8 b8 c8 d8 e8 f8 08 19 29 39 49 59 69 79 89 99 a9 b9 c9 d9 e9 f9 09 1a 2a 3a 4a 5a 6a 7a 8a 9a aa ba ca da ea fa 0a 1b 2b 3b 4b 5b 6b 7b 8b 9b ab bb cb db eb fb 0b 1c 2c 3c 4c 5c 6c 7c 8c 9c ac bc cc dc ec fc 0c 1d 2d 3d 4d Data Ascii: GIF89a(!!ImageMagickgamma=0.454545,(HLLJjN(8HXhx)9IYiy:JZjz+;K[k{,<L\l\|-=M
2024-11-08 13:28:54 UTC	2139	IN	Data Raw: 90 f8 ba f0 1c c6 f0 00 db 90 ee f8 25 02 39 e0 0d 1f 21 0a 9f 2e 0d e5 0f 0f 67 90 09 e5 a0 03 97 ed 0a 2b a1 04 ff 90 0f dd d0 10 c9 b0 a1 c8 06 73 86 c0 09 c5 07 14 1c 11 6f 1a 4f 10 49 ff 10 11 c3 cf 0f 17 91 d9 1a d1 0e 99 6c 0d 01 ce 08 bb 21 dc 9e 0f 13 af a6 66 14 cc 12 5f 0b 15 3f 31 0c c5 50 15 79 0f 08 4b d1 5d 4e 91 12 bd d0 13 f5 4e 0f f7 90 16 13 b1 9e ea a5 5b 66 51 17 17 0f 18 13 d0 15 c5 41 14 d9 0e 16 2f cd 59 7e d1 16 dd 4f 07 a5 4d 18 63 90 13 e5 0e 19 93 2f 58 02 11 1a 3b 91 19 ed 0f 14 bd c1 d3 7e 90 14 b1 0c f4 7e 20 12 b3 a6 e9 70 71 15 59 b1 15 a5 b1 bb a8 b1 cf 2c 0d 0d cf 71 4f d6 71 1b d3 51 1d b1 11 04 15 f1 0e 11 cd ac e6 11 11 fa b1 f2 b4 31 1c bc d1 f6 4e 70 10 b0 ca 07 06 b2 08 03 d2 a7 48 84 0e a9 21 21 01 b0 1d b3 b1 b8 Data Ascii: %9!.g+soOIl!f_?1PyK]NN[fQA/Y~OMc/X;~~ pqY,qOqQ1NpH!!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49717	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	716	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
2024-11-08 13:29:09 UTC	805	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 08 Nov 2024 13:29:09 GMT Content-Length: 0 Connection: close Set-Cookie: AWSALB=1kKxToIYsRZDBy2H3zLT/VHGVb2SRzcdREUBn1BahAMyVPkuYU5i3YKVoWfj19a8cDSOWcjiv1p6tQRZ4SAAiArkGsPaZAk690oaHtTXF3k4zdmqM6Id29hbxdC+; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/ Set-Cookie: AWSALBCORS=1kKxToIYsRZDBy2H3zLT/VHGVb2SRzcdREUBn1BahAMyVPkuYU5i3YKVoWfj19a8cDSOWcjiv1p6tQRZ4SAAiArkGsPaZAk690oaHtTXF3k4zdmqM6Id29hbxdC+; Expires=Fri, 15 Nov 2024 13:28:54 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Location: https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en&try=1 Server: unknown

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49716	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	560	OUT	GET /CRES_login_bg.jpg HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:55 UTC	716	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 155249 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Wed, 20 Sep 2023 11:59:56 GMT ETag: "c3598f2d3bf6694df3378aafc792bfee" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 ec1ac21acdbd36c971eca9d6b61d0744.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: Y-puF8Q7Oyn7BmGRqQsVtI9TsrCbksG9pcgGCtNfipLky-5rrgGEDQ== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Vary: Origin
2024-11-08 13:28:55 UTC	6396	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2024-11-08 13:28:55 UTC	10590	IN	Data Raw: 00 30 e4 bc e1 68 5b 6e ce 16 9d c7 6a a5 58 00 a2 84 8b 23 8f e5 45 80 00 a4 25 00 c0 9d c2 dc 02 e4 d0 c2 8e 0d 6c db 31 ad 2c f2 82 37 77 80 de cc 9d 2d 60 fa 36 ee 06 bb d8 b7 99 fd 1b 77 1f d0 7d c0 6e f0 62 dc b2 ed ed df 72 36 ce 08 36 a5 d9 7f 51 99 2e 06 ba 8f e8 be e5 1a ef 0d e6 5f 4a c2 d9 70 ad d5 a5 c1 52 65 c4 9a 96 c7 3a 81 75 28 cb 8e d8 34 90 18 00 00 00 00 01 86 fc 3e e6 cf 08 ca f5 d1 2d 40 d5 0c 8a db a3 d4 b0 00 00 00 00 00 01 40 c0 09 80 c8 c0 05 b8 72 86 28 40 30 27 68 9c a0 0b 3e 85 a5 06 2a de af 23 5d c8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4e d4 50 01 0e b1 a1 33 0b 26 8d 91 55 bb 2f e0 04 d1 c6 5e ac ae 4b 42 85 ab 2a cd 25 2c 85 49 cb d4 0b aa 85 08 a2 36 b5 a0 6e 68 0b 26 d5 90 de 86 9a 60 73 da 8e a2 56 3a 5e 4e Data Ascii: 0h[njX#E%l1,7w-`6w}nbr66Q._JpRe:u(4>-@@r(@0'h>#]NP3&U/^KB%,I6nh&`sV:^N
2024-11-08 13:28:55 UTC	15990	IN	Data Raw: 2a b4 cb 22 b5 43 da 05 01 3b 41 28 02 89 a8 65 13 54 d2 03 41 42 14 b0 dc 03 da 82 05 b8 72 06 32 d9 a4 f7 21 26 de 0b dd 1a 80 42 63 86 09 a6 38 ec 02 96 0a c8 32 13 dc 0a 26 d5 91 42 e8 38 7d 00 95 66 b1 6f bc d0 87 2f 0c cd 37 4f 20 37 26 dd 81 59 3c 82 02 8c ef 49 ca d4 d0 00 ca b9 52 8a 96 4a f4 da 3a 33 50 27 70 d3 90 81 3a a0 28 08 da c2 5a 02 c0 9d c3 90 13 aa 67 3f 25 36 e5 1d 46 7c 8a 51 06 5c 6f 39 36 6d 3c 1c aa 53 86 75 52 1a 08 36 c6 81 94 54 0b 25 52 dd dc a4 d3 14 f7 14 20 2c 08 db d8 25 a0 2c 09 56 43 99 01 80 00 00 86 20 14 48 6c 4b 42 80 09 c8 6e 8d 4a 00 30 b3 cc a3 4a df 71 50 99 0f 8d 6a b0 06 80 65 b9 ac 32 f7 01 40 29 43 03 2e 55 84 5a ac 13 cb f2 9a 20 14 30 43 00 25 d9 11 2a 4b 6d 23 3a d3 3b ac 41 6e b2 4b 6e d8 ae 9d c4 ff 00 Data Ascii: "C;A(eTABr2!&Bc82&B8}fo/7O 7&Y<IRJ:3P'p:(Zg?%6F\|Q\o96m<SuR6T%R ,%,VC HlKBnJ0JqPje2@)C.UZ 0C%Km#:;AnKn
2024-11-08 13:28:55 UTC	394	IN	Data Raw: 0e 43 79 2d e2 4c f7 76 08 d5 d9 90 df 72 72 c7 b4 07 5c bc 03 99 2e b7 49 60 89 c8 57 47 1a 8a 9a 19 f1 fc a6 85 00 00 00 10 cb 25 81 9b 34 ae 86 6c d2 ba 01 42 18 80 60 21 80 8c ec 68 67 60 33 10 c4 44 51 cf 75 93 a0 ca f5 cc 81 3c 6b 27 59 cf 48 9c 1b 94 03 23 72 16 f9 d1 01 a0 a4 88 b3 f0 1f d3 ee 00 f9 12 39 f9 2c ec f0 8e 98 aa 25 dd 2d 14 91 5c ab 86 f6 d7 43 a2 be dd 2d 41 f2 b6 4b 76 7d 40 d5 2a a0 7c a9 68 73 b4 fb 92 aa 96 ae 49 a3 67 ca de 84 4b 7a 93 b9 0b 78 14 06 6e e4 bb 81 a8 18 6f 17 d4 03 79 14 98 7d 52 7e a8 1d 12 29 39 9f 29 3f 50 0e ad c2 dc 72 7d 41 6f 03 a9 d8 9d c7 2f d4 21 f2 30 3b 37 8b 71 c7 f5 05 bc 0e af 79 6d 95 ab 69 59 2e 8f 46 66 b8 eb cf c4 fe 82 75 72 fd 0f ff 00 b4 3f ec 6d e9 47 24 ed e0 4d 61 cb fc ca 8d b9 6a d5 f8 Data Ascii: Cy-Lvrr\.I`WG%4lB`!hg`3DQu<k'YH#r9,%-\C-AKv}@*\|hsIgKzxnoy}R~)9)?Pr}Ao/!0;7qymiY.Ffur?mG$Maj
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: c7 67 57 9a 46 6a 06 6b 35 5e 66 cb 97 6b b2 b6 6b d8 56 e1 57 aa b7 0c da b3 95 d5 64 c1 b7 ea 0a e8 fa 6b 16 a6 6b f8 99 a8 85 1d c5 5b da b6 51 d8 da bc 75 e5 53 4f 4b 99 80 35 e0 ad ab 6d d1 87 f7 1d f5 b2 b6 3a 9c bc 7c ed 55 f1 bd 50 aa da 7e 20 77 4b ae ba 1c 1e eb d9 a7 eb e3 cf 7a ff 00 0f e0 75 d3 99 3c 5b 05 a6 d0 1f 3d 08 36 a3 d7 f7 3e d2 bc de ba 62 ff 00 9f 99 e3 d9 5a 8f 6b 50 d7 70 2b 6a 08 46 73 66 3a d2 dd c2 36 5c 70 a4 a5 6c 60 c2 ea c2 a7 0c f5 20 e8 4e 74 1d 56 e7 0b 52 38 b8 ab 39 93 a7 fb 6e 27 a5 80 5f 4d ac c0 2a f8 17 cb ed ef 45 35 bb 68 e4 ff 00 71 7e e0 3a 60 67 2c f2 77 91 2d f2 15 da a0 a4 73 27 68 25 72 59 30 3b 30 61 69 d0 3e a5 8b ad 9d 80 55 b3 2e b6 87 a0 ac dd 75 40 b9 10 17 28 d2 97 4b a9 92 69 e5 0f 05 1d 4b 91 14 Data Ascii: gWFjk5^fkkVWdkk[QuSOK5m:\|UP~ wKzu<[=6>bZkPp+jFsf:6\pl` NtVR89n'_M*E5hq~:`g,w-s'h%rY0;0ai>U.u@(KiK
2024-11-08 13:28:56 UTC	1514	IN	Data Raw: 9c bf f3 53 cd 9d a7 17 27 fc d4 f8 9d a5 80 00 19 40 00 00 03 42 29 01 16 12 1d b5 12 03 0f 73 cb f4 d2 6d 4c 97 31 54 67 ee b4 45 bf 94 88 48 aa ea 42 2e ba 81 63 08 02 87 d0 c6 72 6f d0 c7 a8 29 a7 0c 1b 44 db 52 42 3a 16 80 03 0d 04 73 d9 a9 3a 11 ca 94 5c 09 b7 3d 28 e2 c5 70 5f 8e d7 f4 6a 2e 78 dd 95 21 c0 d2 be 14 11 1d ac 82 d9 05 52 00 00 00 00 00 00 00 03 2f 71 ff 00 1d bc 8d 4c 7d c7 fc 76 f2 01 70 fc a8 ab e9 9d 09 e1 f9 50 f9 63 6b 92 0e 24 b8 6d ab ac 17 c7 c5 c3 5b 2d ad 37 d3 27 2f 1d 38 16 6c eb 8d 0e 8e 3a 70 26 b6 ed 99 47 16 de b8 ac 31 5b 43 bb 08 67 97 c7 c1 c7 be 77 2c 1e 9b 3c ce 5a 71 43 75 db bb 26 3d 77 1a 8f 4b eb 53 fa 90 7d 5a 77 5f 79 e0 7b 5a d5 b8 b4 44 1d 76 e0 e1 7d 6a 3e c6 3d 4f ab 4e e8 d8 f1 6d f4 eb 58 51 86 7b 28 Data Ascii: S'@B)smL1TgEHB.cro)DRB:s:\=(p_j.x!R/qL}vpPck$m[-7'/8l:p&G1[Cgw,<ZqCu&=wKS}Zw_y{ZDv}j>=ONmXQ{(
2024-11-08 13:28:56 UTC	2264	IN	Data Raw: 9f 90 2b 26 dc ad 00 9e 3b a6 b0 92 36 dc 8c f7 52 cb 05 2d b6 50 14 f7 24 e4 a9 44 3d a9 60 72 88 13 49 e2 0c 92 ad 74 45 4c 64 cf 3a 95 1a 73 d6 b7 6b 77 62 38 aa 93 aa 5d d1 7c cf d4 bc 8c 97 cd 5f f5 20 3d 7e 4d 0c 51 bd f4 31 46 91 45 12 52 0a 18 20 60 80 e3 f7 75 dc d6 60 cf 8e bb 6d 2c db dc 24 ec 62 9e 4c aa 6f 5b bb 38 78 ec 63 6e 2b ce 1a 3a 5c cb 22 5c 84 73 2e 0b d5 43 86 74 72 4a e3 aa ae 5a 1c 85 9c 24 30 72 ba dd d5 a7 53 d7 f6 9f f1 af 89 c3 38 3b bd a3 ff 00 6f 3d d8 9d aa fa 94 49 46 d0 ce 1f 76 fd 4b 13 83 b9 9e 7f bb 76 57 5b 54 e0 94 72 ca ab 6f 6b 1f d4 95 1b 1c 12 ef 67 33 5c 85 7d c5 ff 00 a0 ca bd 3f 67 ff 00 1e 91 96 69 52 3d a5 9d f8 db 6a 1c b3 4a 9b 88 b3 cf f7 5b 1d a2 d3 f0 47 a0 79 3e f3 99 d6 ee b1 38 25 1b 7b 5f a7 f5 1a Data Ascii: +&;6R-P$D=`rItELd:skwb8]\|_ =~MQ1FER `u`m,$bLo[8xcn+:\"\s.CtrJZ$0rS8;o=IFvKvW[Trokg3\}?giR=jJ[Gy>8%{_
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 6f 44 2f ad 99 82 ff 00 b5 b5 92 72 8a 7e da cf aa 02 1f 33 4a 49 b7 3b 59 ec 6a fd ab 6b 50 bf b5 76 51 28 83 1a f3 ee 46 bc 36 6d a9 15 7d 9b af 53 6a 70 3a c6 74 03 9a 61 bf 31 37 93 a5 7b 78 72 d9 4f 82 5c 8c 1c 8d 4b 39 f6 cb 83 d1 fe df 3a 91 fd 9a 99 90 38 f6 6d cb 7d 48 ab 87 93 d1 fe de b5 59 67 9a aa a7 c4 0e a4 f2 55 96 a6 75 ae 51 b3 88 72 51 ca e8 03 76 51 04 e0 83 6e 15 0c e8 e7 f9 91 9d 15 54 35 a9 a7 3f cc 80 e4 ba 6e cf 27 3f 22 6d c1 d5 75 ea 67 35 e9 ea d4 0d 78 ea d2 c9 d7 5b 56 bd 0c 5a db 55 92 6e 9d 92 80 3b 37 ae c1 bb c0 e7 aa 70 54 33 1a d6 46 92 9d 91 dc 79 8d 35 6a b7 dc f4 cd c6 4c 04 33 41 32 4a 13 01 09 6a 02 5a 90 68 31 01 43 10 0c 08 68 83 53 36 88 25 88 00 09 23 95 4a c9 a1 3c 96 55 52 f4 03 ce 76 8d 19 a7 15 a5 9a a5 c5 Data Ascii: oD/r~3JI;YjkPvQ(F6m}Sjp:ta17{xrO\K9:8m}HYgUuQrQvQnT5?n'?"mug5x[VZUn;7pT3Fy5jL3A2JjZh1ChS6%#J<URv
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 88 b2 80 00 00 4c c8 d5 99 00 8c be ae b8 d0 d5 98 a5 ba 7a 10 4f d4 dc a6 0c b9 29 4b 29 75 35 4e ad 3c a0 85 6a bc 90 3f 6d 0a 89 3c 23 ce f7 14 ae f7 b7 3d cb e5 ff 00 8e be 67 3c 81 9e c3 a3 d9 d6 39 11 9e e3 7f 6a e7 91 01 d9 ef 2b ba b0 79 57 e0 b3 d3 a1 ea fb df 91 9e 52 bb ab c3 25 ed a8 8a 2b d5 c3 6e 08 e5 6f 73 49 ca 3a 5f 2d a3 35 27 8f 89 5a b2 41 cd c7 2a c8 ee a5 a3 9e 3a 19 d7 db e5 34 cd 68 bf df 97 d8 9b ca fc 3d 83 3b e5 31 da 5a 84 70 72 7b 6e 64 b1 79 3a 30 c1 51 5e d0 d1 6f da a5 9a b3 86 9f 56 b6 ce 87 47 1d ad b5 e4 e7 5a 6f c7 5b 56 ea 74 93 d8 bf ca cf 0f 87 99 bb 24 cf 72 ff 00 2b 2f 92 bc 7e 48 dc c5 b5 33 6b f1 d6 cf 3a 90 f8 3b 33 0d 33 74 7d 09 ad 5a c3 34 fa 77 4e 0f 46 9e de a9 67 53 53 59 b8 f3 39 5e df 94 c7 8e d6 6c f7 Data Ascii: LzO)K)u5N<j?m<#=g<9j+yWR%+nosI:_-5'ZA*:4h=;1Zpr{ndy:0Q^oVGZo[Vt$r+/~H3k:;33t}Z4wNFgSSY9^l
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 91 f1 c6 ad 23 4e 3e 29 cc 59 fd d5 5f 89 8f d4 7d 3d 3e 40 93 7a 9a 39 af 77 d9 53 6d 6e a1 2f fc a7 a1 57 aa 8a fa 66 2b d1 9c be c3 15 e4 f2 fe 25 73 38 aa 5d a8 81 27 fb 38 f6 51 e1 3d 8f b5 f0 53 f6 f7 7a 45 bc 89 a7 2d 92 87 95 e3 91 ef a4 cb af fe 97 01 79 4f d1 bd 7a 35 f7 89 3b 57 ad 97 c5 9b 57 96 ab 47 c9 5f 2b 4f e6 5a e5 5f fe d2 df 1a a6 54 e7 f0 c7 eb f2 7f 53 1f f7 1c bf d5 f8 1d 1b e7 f7 d3 e3 41 6e f1 e2 fb 99 0f f0 df d9 f2 de d4 6e ce 73 d8 ea e6 e5 b5 78 d3 5a c9 97 b5 5e 8f d9 af 43 7e 65 e8 58 ab f8 98 9f b5 67 8e 38 72 f1 73 3b 5d 27 5a eb a8 5f e9 ed ac d3 fa b4 f0 65 71 57 d4 9e de bd 2c 1c 94 4e b5 95 65 f3 74 f1 36 b7 3e c5 45 c7 f4 b1 5b 42 bf e3 23 f7 0e 8b 8e de 99 c7 70 a5 6a b8 ac bd 50 af 3f 2f 8a 2f 9a 89 d2 ca 1b c3 f0 Data Ascii: #N>)Y_}=>@z9wSmn/Wf+%s8]'8Q=SzE-yOz5;WWG_+OZ_TSAnnsxZ^C~eXg8rs;]'Z_eqW,Net6>E[B#pjP?//

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49726	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	569	OUT	GET /fonts/Inter/Inter-Regular.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:55 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 303504 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "a4a7379505cd554ea9523594b7c28b2a" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: sMrB0reWWPGZJWNSd0a-I0XmUYZHIhw7pUOo4yTDIsdXGwLTVwr-GQ== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-11-08 13:28:55 UTC	16384	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 3b 00 00 00 04 12 47 50 4f 53 bc af 92 58 00 03 3f 14 00 01 1f 80 47 53 55 42 be 7f 66 78 00 04 5e 94 00 00 42 b4 4f 53 2f 32 22 97 6e 62 00 02 6e 4c 00 00 00 60 53 54 41 54 f1 71 d9 45 00 04 a1 48 00 00 00 48 63 6d 61 70 2f 2e e9 9d 00 02 6e ac 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 3a f8 00 00 00 08 67 6c 79 66 8b bf 4f 34 00 00 01 0c 00 02 1d 26 68 65 61 64 2d c3 61 46 00 02 46 24 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 6e 28 00 00 00 24 68 6d 74 78 fd c3 4c d4 00 02 46 5c 00 00 27 ca 6c 6f 63 61 09 5d 06 34 00 02 1e 54 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 1e 34 00 00 00 20 6e 61 6d 65 30 24 51 40 00 02 d4 40 00 00 02 16 70 6f 73 74 a7 a8 35 72 00 02 d6 58 00 00 64 9e 70 72 65 Data Ascii: GDEF11;GPOSX?GSUBfx^BOS/2"nbnL`STATqEHHcmap/.negasp:glyfO4&head-aFF$6hhean($hmtxLF\'loca]4T'maxp4 name0$Q@@post5rXdpre
2024-11-08 13:28:55 UTC	604	IN	Data Raw: 07 30 0a f8 02 26 01 a5 00 00 00 07 08 0c 07 3c 02 38 ff ff 00 f8 ff dc 07 30 0a a0 02 26 01 a5 00 00 00 07 06 7b 06 9c 02 00 ff ff 00 f8 ff dc 07 30 0a 74 02 26 01 a5 00 00 00 07 06 7f 07 66 02 a0 ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 8d 07 c0 ff e4 ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 90 07 74 ff e4 ff ff 00 f8 fd b4 07 30 08 00 02 26 01 a5 00 00 00 07 06 89 07 34 ff e4 ff ff 00 f8 ff dc 07 30 0b a0 02 26 01 a5 00 00 00 07 08 bd 06 00 00 00 ff ff 00 f8 ff dc 07 30 0b 80 02 26 01 a5 00 00 00 07 08 5d 07 3c 02 8c ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 8b 07 54 ff e4 ff ff 00 f8 ff dc 07 30 0b 0c 02 26 01 a5 00 00 00 07 06 80 07 44 02 24 ff ff 00 f8 ff dc 08 fc 0a a0 02 26 01 a6 00 00 00 07 06 64 01 Data Ascii: 0&<80&{0t&f0&0&t0&40&0&]<0&T0&D$&d
2024-11-08 13:28:55 UTC	16384	IN	Data Raw: 06 84 f8 00 06 60 f9 a0 ff ff 00 3c 00 00 0a 34 0a 68 02 26 01 c8 00 00 00 07 06 6a 02 b8 02 00 ff ff 00 3c 00 00 0a 34 0a a0 02 26 01 c8 00 00 00 07 06 66 01 e4 02 00 ff ff 00 3c 00 00 0a 34 0a a0 02 26 01 c8 00 00 00 07 06 64 02 9c 02 00 ff ff 00 3c 00 00 0a 34 0a 40 02 26 01 c8 00 00 00 07 06 69 01 f8 00 18 ff ff 00 3c 00 00 0a 34 0a 40 02 26 01 c8 00 00 00 07 06 70 03 e8 02 00 ff ff 00 3c fe 14 0a 34 08 00 02 26 01 c8 00 00 00 07 06 8b 08 78 00 10 00 01 00 4c 00 00 06 c4 08 00 00 0d 00 00 01 01 33 01 21 01 01 21 01 23 01 21 01 01 01 70 02 10 10 02 10 01 24 fd 7c 02 84 fe dc fd f0 10 fd f0 fe dc 02 94 fd 6c 08 00 fc ac 03 54 fc 00 fc 00 03 44 fc bc 04 00 04 00 ff ff 00 4c 00 00 06 c4 0a 40 02 26 01 cf 00 00 00 07 06 70 02 38 02 00 ff ff 00 4c 00 00 06 Data Ascii: `<4h&j<4&f<4&d<4@&i<4@&p<4&xL3!!#!p$\|lTDL@&p8L
2024-11-08 13:28:55 UTC	9200	IN	Data Raw: 26 03 07 00 00 00 07 09 96 00 fc 00 b0 ff ff 00 90 ff e0 06 00 08 94 02 26 03 07 00 00 00 07 09 9d 01 5c 00 94 00 03 00 90 ff e0 06 00 06 14 00 03 00 13 00 23 00 00 01 15 21 35 01 22 24 02 35 34 12 24 33 32 04 12 15 14 02 04 27 32 36 12 35 34 02 26 23 22 06 02 15 14 12 16 05 62 fb cc 02 1a d0 fe c7 af af 01 39 d0 d0 01 39 af af fe c7 d0 9e cc 62 62 cc 9e 9e cc 62 62 cc 03 66 cc cc fc 7a c6 01 64 ee f0 01 66 c6 c6 fe 9a f0 ee fe 9c c6 d4 a2 01 08 9a 9a 01 0a a4 a4 fe f6 9a 9a fe f8 a2 ff ff 00 90 ff e0 06 00 06 14 02 06 03 35 00 00 ff ff 00 90 ff e0 06 00 06 14 02 06 03 07 00 00 ff ff 00 90 ff e0 06 00 08 40 02 06 03 08 00 00 ff ff 00 90 ff e0 0a 5c 06 14 00 26 03 07 00 00 00 07 02 64 04 84 00 00 ff ff 00 90 fd c0 0c 18 06 14 00 26 03 07 00 00 00 07 03 c3 Data Ascii: &&\#!5"$54$32'2654&#"b99bbbbfzdf5@\&d&
2024-11-08 13:28:56 UTC	8698	IN	Data Raw: 00 08 20 08 1c 00 26 03 e2 68 00 00 07 08 4e ff 04 ff f8 ff ff 00 3c 00 00 08 80 08 1c 00 27 03 e2 00 c8 00 00 00 07 09 a2 ff 78 00 00 00 03 ff c8 00 00 0a 48 08 1c 00 2a 00 30 00 3b 00 00 21 35 21 35 26 02 11 34 12 12 24 33 32 04 12 12 15 10 02 07 15 21 15 21 11 36 36 12 35 34 02 24 23 22 06 06 02 15 14 12 16 17 11 01 15 23 01 35 21 21 15 14 06 06 07 27 36 36 35 35 03 38 01 ac c6 e6 85 f2 01 4b c6 c6 01 4b f2 85 e6 c6 01 ac fd 28 84 de 86 aa fe d4 c2 91 f4 b1 62 86 de 84 fd 1c 80 fe c4 01 20 fe a0 3b 71 50 6c 36 3a dc 10 81 01 a8 01 23 db 01 6d 01 0a 92 92 fe f6 fe 93 db fe dd fe 58 81 10 dc 01 18 38 e7 01 41 c0 d6 01 5a cc 75 d1 fe eb a1 c0 fe bf e7 38 fe e8 06 4c 14 01 b4 1c 70 50 8e 76 2c 54 3f 92 63 68 ff ff ff c8 00 00 09 e0 08 1c 00 27 03 e2 02 28 Data Ascii: &hN<'xH*0;!5!5&4$32!!6654$#"#5!!'66558KK(b ;qPl6:#mX8AZu8LpPv,T?ch'(
2024-11-08 13:28:56 UTC	534	IN	Data Raw: 01 16 16 33 32 36 33 17 06 06 25 01 13 23 01 05 a0 74 af 31 fe 90 48 3c 29 5d 84 62 3c 12 5e 3c a5 de 41 02 0c 0e 2e 3c 0c 23 09 34 1d 39 fa a6 02 58 60 20 fe 68 15 88 8d 04 1c a8 9c 6a 6a 14 18 d0 08 14 ac b0 fa 78 27 4d 04 d0 07 07 16 06 5c fe 40 fb 64 00 02 00 b4 fd e0 05 3c 08 1c 00 17 00 37 00 00 01 07 26 23 22 06 06 15 14 16 33 33 15 23 22 24 26 35 34 36 24 33 32 16 01 33 15 23 22 06 06 15 14 16 17 17 16 16 15 0e 02 07 27 36 36 35 34 26 27 27 24 00 35 10 00 05 0c 28 b5 87 7b b0 5d e5 cf c4 cc d3 fe c3 b0 a8 01 2a c4 68 c2 ff 00 cc c4 aa ea 78 bc b0 9c c6 a6 01 3d 6c 4a a0 5d 2f 5c 74 4c fe c6 fe d6 01 9a 07 e4 d8 34 42 7e 5a 8b 97 a4 77 d8 91 8e d6 78 1e fc ce a4 62 c4 94 9e d6 2a 24 2e 82 6e 44 96 93 41 78 65 6b 24 3e 41 19 10 41 01 28 f7 01 36 01 Data Ascii: 3263%#t1H<)]b<^<A.<#49X` hjjx'M\@d<7&#"33#"$&546$323#"'6654&''$5({]hx=lJ]/\tL4B~Zwxb$.nDAxek$>AA(6
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: fe c4 fb 20 00 01 00 90 fd fc 05 64 06 14 00 27 00 00 01 32 04 12 15 21 34 26 23 22 06 06 15 15 14 16 16 17 1e 02 15 14 06 07 27 36 36 35 34 26 27 26 24 02 35 35 34 12 24 03 24 ad 01 03 90 fe fc b1 8f 7f bb 66 75 e3 a4 a0 a9 3f 93 65 90 52 32 57 7d de fe d7 95 a1 01 29 06 14 8c fe fc b4 ab bd 91 fe a5 38 75 c6 93 2a 29 54 63 40 79 eb 54 7c 5d 63 32 44 36 1c 33 c0 01 1d bc 38 ea 01 61 c5 00 03 00 a4 ff e4 06 4c 05 d0 00 15 00 27 00 2b 00 00 13 35 34 12 24 33 1e 02 17 1e 02 15 15 14 02 04 23 22 24 02 25 15 14 16 16 33 32 36 36 35 35 34 26 26 23 22 06 06 01 15 21 35 a4 9f 01 29 d0 2c 4a 5a 44 7a b0 5e 9d fe d7 d2 d2 fe d5 9f 01 14 51 ad 8a 88 ab 51 51 ad 8a 88 ab 51 04 94 fc f0 02 d8 20 ce 01 4a c0 04 34 44 1c 32 b7 fb 98 1c b4 fe c0 c8 c8 01 56 f6 20 90 f4 Data Ascii: d'2!4&#"'6654&'&$554$$fu?eR2W})8u*)Tc@yT\|]c2D638aL'+54$3#"$%3266554&&#"!5),JZDz^QQQQ J4D2V
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 00 00 00 01 00 bc fe 0c 02 38 01 18 00 0b 00 00 01 07 06 02 06 07 23 36 36 12 37 37 02 38 10 11 45 4a 18 b4 0d 2a 2b 0e 0c 01 18 6c 72 fe fc e6 44 40 d2 01 03 87 70 00 01 00 d0 ff f0 02 38 01 58 00 0c 00 00 05 22 26 35 34 36 33 32 16 15 14 06 06 01 84 4a 6a 6a 4a 4a 6a 31 51 10 6a 4a 4a 6a 6a 4a 31 52 31 ff ff 00 d0 ff f0 08 38 01 58 00 26 05 7c 00 00 00 27 05 7c 03 00 00 00 00 07 05 7c 06 00 00 00 ff ff 00 d0 ff f0 05 38 01 58 00 26 05 7c 00 00 00 07 05 7c 03 00 00 00 00 02 00 d0 ff f0 02 38 05 cc 00 0c 00 19 00 00 05 22 26 35 34 36 33 32 16 15 14 06 06 03 22 26 35 34 36 33 32 16 15 14 06 06 01 84 4a 6a 6a 4a 4a 6a 31 51 32 4a 6a 6a 4a 4a 6a 31 51 10 6a 4a 4a 6a 6a 4a 31 52 31 04 74 6a 4a 4a 6a 6a 4a 31 52 31 00 02 00 d0 01 06 02 38 06 7a 00 0c 00 19 00 Data Ascii: 8#66778EJ*+lrD@p8X"&54632JjjJJj1QjJJjjJ1R18X&\|'\|\|8X&\|\|8"&54632"&54632JjjJJj1Q2JjjJJj1QjJJjjJ1R1tjJJjjJ1R18z
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 01 01 17 01 21 15 21 01 04 96 fc 80 03 80 9a fd 86 0a aa f5 56 02 7a 03 80 03 80 98 fd 86 dc fd 88 00 01 01 16 00 00 1c 20 07 00 00 08 00 00 21 01 01 17 01 21 15 21 01 04 96 fc 80 03 80 9a fd 86 19 6a e6 96 02 7a 03 80 03 80 98 fd 86 dc fd 88 00 03 01 16 00 00 09 20 07 00 00 05 00 09 00 0d 00 00 21 01 01 17 09 02 27 21 15 01 37 21 15 04 96 fc 80 03 80 9a fd 18 02 e8 fd d6 dc 06 f6 f9 0a dc 06 1a 03 80 03 80 9a fd 1a fd 18 01 8c dc dc 01 dc dc dc 00 03 01 16 00 00 0d 60 07 00 00 05 00 09 00 0d 00 00 21 01 01 17 09 02 27 21 15 01 37 21 15 04 96 fc 80 03 80 9a fd 18 02 e8 fd d6 dc 0b 36 f4 ca dc 0a 5a 03 80 03 80 9a fd 1a fd 18 01 8c dc dc 01 dc dc dc 00 01 01 60 00 00 09 6a 07 00 00 08 00 00 21 27 01 21 35 21 01 37 01 05 ea 9a 02 7a f9 96 06 6a fd 86 9a 03 Data Ascii: !!Vz !!!jz !'!7!`!'!7!6Z`j!'!5!7zj
2024-11-08 13:28:56 UTC	11977	IN	Data Raw: b4 04 1c 09 04 00 0d 00 11 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 25 13 33 03 03 3c e0 e1 c3 c3 e1 e0 58 6c 69 5b fe ec 94 e0 e0 07 d4 7e a2 a2 7e 3f 5d 5d 5f 01 10 fe f0 00 02 00 d4 06 b4 04 1c 09 04 00 0d 00 11 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 27 03 33 13 03 3c e0 e1 c3 c3 e1 e0 58 6c 69 5b f4 e0 e0 94 07 d4 7e a2 a2 7e 3f 5d 5d 5f 01 10 fe f0 00 02 00 e4 06 b4 04 0c 09 a8 00 0d 00 1d 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 27 23 27 36 36 35 34 26 23 37 32 16 15 14 06 07 03 34 d8 d7 bd ba da d8 56 66 66 56 50 bc 04 63 59 7a 5a 0c c9 cb 7d 4b 07 d4 7e a2 a2 7e 3f 5d 5d 5b b0 03 1e 27 2a 22 74 6d 57 4e 45 09 00 01 fc 3c 06 60 03 c4 07 fc 00 15 00 00 01 23 2e 03 23 22 0e 02 07 23 3e 02 24 33 32 04 16 16 03 c4 dc 27 95 c8 e9 Data Ascii: 3#"&53326%3<Xli[~~?]]_3#"&53326'3<Xli[~~?]]_3#"&53326'#'6654&#724VffVPcYzZ}K~~?]]['*"tmWNE<`#.#"#>$32'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49728	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	712	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
2024-11-08 13:29:10 UTC	801	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 08 Nov 2024 13:29:10 GMT Content-Length: 0 Connection: close Set-Cookie: AWSALB=Ez/h3FNMbocgxTkuRvFH3IditCvqQ3h6YLp3NtEnJ8YnD3m5vsJBYqahyI3bQRJ6ITpr+Ioeza1dAKE6RI2K+41dOkvZs4GzG2qoT6vZreFfK/AjBuuA5johhCqk; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/ Set-Cookie: AWSALBCORS=Ez/h3FNMbocgxTkuRvFH3IditCvqQ3h6YLp3NtEnJ8YnD3m5vsJBYqahyI3bQRJ6ITpr+Ioeza1dAKE6RI2K+41dOkvZs4GzG2qoT6vZreFfK/AjBuuA5johhCqk; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Location: https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en&try=1 Server: unknown

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49729	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	708	OUT	GET /websafe/images/loginbg.gif HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
2024-11-08 13:28:55 UTC	971	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:55 GMT Content-Type: image/gif Content-Length: 51646 Connection: close Set-Cookie: AWSALB=/i2jlVMUWd8/ZvVwpHuNzYVUm96sRCFdTIZvgr3hYIYU0R3IscGw2NOGZN4RhmcwX1UDjq94GPiU2j2w66+U7755YbOxiqf1Ai9eYX6niqm+PdYt8w5j7QHNJ/ZA; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/ Set-Cookie: AWSALBCORS=/i2jlVMUWd8/ZvVwpHuNzYVUm96sRCFdTIZvgr3hYIYU0R3IscGw2NOGZN4RhmcwX1UDjq94GPiU2j2w66+U7755YbOxiqf1Ai9eYX6niqm+PdYt8w5j7QHNJ/ZA; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=E350ADC59035727E9434306A244D575B; Path=/websafe; Secure; HttpOnly Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-c9be" Server: unknown
2024-11-08 13:28:55 UTC	8459	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2024-11-08 13:28:55 UTC	9000	IN	Data Raw: 01 0e 16 47 a6 50 d8 27 b0 02 c8 c5 a0 ac c0 16 72 1c ba 10 b2 5e 40 34 0d 47 03 01 43 04 86 4a 7b 01 40 20 01 8a 46 00 20 18 01 31 92 89 97 3e 43 01 88 02 00 94 c7 28 4a a3 e0 80 25 11 39 2f 82 25 55 4c 01 52 82 50 70 42 e0 80 a6 10 27 91 e4 00 03 21 20 4b f2 2b 22 4f 23 80 09 1c 88 00 60 20 c8 04 48 40 48 48 0b 23 91 80 0b 52 62 3d 0a 8e 82 ca 00 84 d0 93 d8 3c d0 9d b7 02 86 00 02 6c 13 08 28 04 86 28 00 33 78 66 89 c9 36 4d 8a ac 0b 80 81 80 0b 21 23 10 00 68 c2 04 d0 14 04 a6 54 80 08 60 02 80 18 00 a4 60 20 07 e4 45 9c a2 f5 22 ce 00 a9 84 2d 75 23 52 b8 01 72 80 49 40 e0 05 12 09 40 e3 cc 20 02 46 2e 21 00 30 25 a1 a0 08 01 88 00 91 88 0a 43 12 18 00 00 00 99 05 b2 40 43 89 d4 45 20 18 00 00 04 0a ce 06 9c 80 c0 52 39 00 00 92 64 0a 14 8a 49 6c 06 Data Ascii: GP'r^@4GCJ{@ F 1>C(J%9/%ULRPpB'! K+"O#` H@HH#Rb=<l((3xf6M!#hT`` E"-u#RrI@@ F.!0%C@CE R9dIl
2024-11-08 13:28:55 UTC	9000	IN	Data Raw: a0 1b 10 d8 80 8c f5 1d 75 18 2d 40 b2 4a 24 00 00 00 02 40 00 24 68 91 72 87 00 36 13 00 c8 9c 01 a5 5c 8d 93 42 98 10 f0 2c 0d 92 44 50 d6 a2 1a d4 aa b1 31 83 02 19 2c a6 44 10 5e 35 26 59 49 04 ae a0 4a 43 81 f2 5d 4c dd 98 17 c4 a5 a9 87 26 69 db 72 ca 35 00 04 02 24 a6 48 19 f7 7e d3 9e bf 72 3b 22 45 f8 d1 05 80 01 40 12 20 08 60 20 00 28 91 c8 53 08 27 90 b9 a0 2e 04 67 cc 5c c0 d6 50 a4 ce d8 c9 1c c0 de 45 c8 c3 f2 12 fb a4 1d 1c 85 c8 e7 fc 81 cc 0e d1 88 65 08 45 09 81 2c a2 59 40 03 10 c0 42 63 13 02 44 31 10 4d f0 8c 97 09 c6 19 b3 52 27 55 13 b8 02 70 a0 e7 be a7 4a 4c c9 ce c0 2e da 72 6f 5a 41 9d 65 bc 8d 3c ea 02 75 f3 40 aa b7 62 7a 8d 01 aa 55 aa c1 0f 8e e1 55 91 35 ea 02 fa 07 35 da 03 87 a8 70 0a 96 ff 00 e4 97 b0 13 6f fb 85 6a 28 Data Ascii: u-@J$@$hr6\B,DP1,D^5&YIJC]L&ir5$H~r;"E@ ` (S'.g\PEeE,Y@BcD1MR'UpJL.roZAe<u@bzUU55poj(
2024-11-08 13:28:55 UTC	9000	IN	Data Raw: f2 01 48 60 c6 d6 bd 37 27 f3 37 ac 01 b3 d4 9e 52 cc ab 6e 5a 9b 2a ad d0 0e ae 59 d3 db d4 e7 4a a8 df b5 69 61 17 74 71 d2 ce 62 4e db 9c 54 fb 98 56 bc 98 f9 04 02 41 0f 90 73 14 09 a0 38 21 b0 86 77 f6 ad 54 da ae 3c ca 7d d4 ba b2 ab 83 8b 6a 4e da e9 1e 41 f4 5d c3 5f 11 b7 5c c6 80 70 e7 a2 1a e5 5d 0d 9f 65 ce 16 0d 2b d8 ea 80 8a ff 00 b0 eb ae 4e 8a f7 d5 b5 33 fc 75 ae b0 1c e9 5d c8 8e 95 0f 46 37 9d 72 70 be ea 5a 17 4f f6 36 60 6f c1 2c a7 ec 29 fd 2b cc 1c eb b9 93 ab 6e 59 5a 91 2a 9c 9c e7 db 05 70 aa cb 26 d2 be d4 62 eb 67 a8 69 ad bb 89 a8 5a 7a 93 5a f2 71 fa 93 c1 f4 3a 3b 5d be 2a 5e ac 83 58 8c 04 72 f4 17 2a a7 1b 99 df b8 9d 67 39 fd 45 f8 87 7e ea aa 9a ef a1 85 bb 9b 67 de 3b 70 e4 ab 2f e9 c1 0f 83 7f 71 56 60 e7 3d 7e 07 45 Data Ascii: H`7'7RnZYJiatqbNTVAs8!wT<}jNA]_\p]e+N3u]F7rpZO6`o,)+nYZp&bgiZzZq:;]^Xrg9E~g;p/qV`=~E
2024-11-08 13:28:55 UTC	9000	IN	Data Raw: c6 2d 04 03 32 ee 5a 32 5d ec aa b2 71 da ce ce 59 54 36 ec 35 66 88 45 20 36 4c de a7 3d 4e 9a e9 82 0d 96 80 4d ae a8 a6 c4 7e 6a ae a5 1a c0 ab ae 4a 90 c0 43 81 40 c1 39 d3 20 15 97 ec 2f 8f 99 09 b4 5a b0 52 6a 37 27 89 69 6e 34 04 f1 6f 71 f1 7d 4a 18 11 0c 72 ca 10 0a 7c 85 cb c9 94 00 4f 21 c8 c0 05 23 00 80 09 26 41 c1 36 f2 00 4e 59 72 42 a8 43 5a 01 72 27 64 43 ab 29 24 02 96 c6 aa 8a 80 80 18 0a 03 8a 01 81 3c 50 f8 a0 18 0a 10 68 00 4a d4 a8 22 32 05 68 38 08 12 01 f1 42 e2 54 04 00 a1 86 42 06 04 cb e8 3e 48 60 02 94 31 71 42 e0 80 a1 0b 88 43 40 25 82 c8 72 09 b0 2c 09 9e a1 c8 0a 01 48 48 0c 09 90 90 28 09 e4 c2 58 14 04 cb 1c b0 1b 44 c8 e5 89 c8 14 04 4b 45 4b 02 80 9c 86 40 a0 24 60 04 5c b8 22 c0 43 d0 8f f5 f4 65 b7 82 3f d7 78 64 1b Data Ascii: -2Z2]qYT65fE 6L=NM~jJC@9 /ZRj7'in4oq}Jr\|O!#&A6NYrBCZr'dC)$<PhJ"2h8BTB>H`1qBC@%r,HH(XDKEK@$`\"Ce?xd
2024-11-08 13:28:55 UTC	7187	IN	Data Raw: 95 64 9a 7e 3c 75 12 ca f2 ea 0b 29 27 88 c8 67 0f ca 40 76 5c 52 4b 5d 86 d4 66 72 36 de bd 13 9f 22 54 f2 d3 3d 7c 79 7c 40 2a a7 1b 60 a5 f5 42 78 59 15 57 f9 6d d3 c6 a2 51 10 b3 80 0b 37 ab f6 7b 42 65 43 1b fb 57 89 27 55 a6 20 0b ab 85 3e cc fe 9f a8 57 aa 0f 2e 82 ae 9e b9 f6 79 fb 40 6d 36 bf f2 d0 99 85 e5 af b5 e8 5c ae 5e 73 eb fd 0c f0 9b 5a 81 7a d9 ac ac 02 ce 35 c7 c9 8a b6 ca 5b 60 34 4d 2d 26 00 6b 32 ba 0a bf 2f 1e 3a 95 57 16 7d 5a d0 53 0a 3d 3d c0 2d 26 3d 70 26 d2 52 b0 5f 15 98 d1 8a b9 c3 c7 1f 87 8f 90 09 29 c3 59 42 56 4d cf f7 6f 1b f8 41 31 9d 85 30 bd 1f cc 02 21 cb 58 d3 f6 2f 1e c6 4b 5a cb c6 80 d4 ed e4 bd 40 76 87 ae 1c 47 90 28 df 5d 19 52 b3 ac 2d 88 7d 34 9f 18 03 44 bf ba 3d f8 33 aa 8f 28 cf bc ba e5 28 59 8f 98 9a Data Ascii: d~<u)'g@v\RK]fr6"T=\|y\|@*`BxYWmQ7{BeCW'U >W.y@m6\^sZz5[`4M-&k2/:W}ZS==-&=p&R_)YBVMoA10!X/KZ@vG(]R-}4D=3((Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49724	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	567	OUT	GET /fonts/Inter/Inter-Light.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:55 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 304092 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "60c8f64064078554b6469eeda25944eb" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: v8JIgS1fQERG4p8K2mi8AFfZ4H_cJkwyzzmXzlC677C99C6zLVZyRw== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-11-08 13:28:55 UTC	15618	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 3b 6c 00 00 04 12 47 50 4f 53 44 54 7b 36 00 03 3f 80 00 01 21 64 47 53 55 42 be 7f 66 78 00 04 60 e4 00 00 42 b4 4f 53 2f 32 22 33 6e 62 00 02 6e 98 00 00 00 60 53 54 41 54 ee 4d d9 3f 00 04 a3 98 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 6e f8 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 3b 64 00 00 00 08 67 6c 79 66 97 e6 ea 0c 00 00 01 0c 00 02 1d 71 68 65 61 64 2d c3 61 46 00 02 46 70 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 6e 74 00 00 00 24 68 6d 74 78 e5 18 e6 d0 00 02 46 a8 00 00 27 ca 6c 6f 63 61 09 5d 8d 80 00 02 1e a0 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 1e 80 00 00 00 20 6e 61 6d 65 35 9c 5c a6 00 02 d4 8c 00 00 02 38 70 6f 73 74 a7 a8 35 72 00 02 d6 c4 00 00 64 9e 70 72 65 Data Ascii: GDEF11;lGPOSDT{6?!dGSUBfx`BOS/2"3nbn`STATM?Dcmap/.negasp;dglyfqhead-aFFp6hheant$hmtxF'loca]'maxp name5\8post5rdpre
2024-11-08 13:28:55 UTC	372	IN	Data Raw: 02 26 01 99 00 00 00 07 08 62 06 bb 00 00 ff ff 00 94 fd d5 06 61 08 00 02 26 01 99 00 00 00 07 06 89 06 7b 00 00 00 01 00 94 00 00 06 ac 08 00 00 10 00 00 01 15 21 11 23 11 21 22 06 06 15 15 23 35 34 36 33 06 ac fd 77 bb fe 98 48 55 24 ab c1 aa 08 00 a8 f8 a8 07 58 3d 6c 46 3e 68 a6 c7 00 02 00 94 fd c1 06 61 08 00 00 0d 00 15 00 00 21 15 14 16 33 33 15 23 22 2e 02 35 35 01 35 21 15 21 11 23 11 03 d8 84 63 48 72 4d 89 67 3b fd 77 05 cd fd 77 bb bb 7f 5d a8 32 62 90 5e bd 07 58 a8 a8 f8 a8 07 58 00 02 00 94 fe fc 06 61 09 04 00 03 00 0b 00 00 01 01 33 01 01 35 21 15 21 11 23 11 01 65 03 ab ad fc 55 fe 82 05 cd fd 77 bb fe fc 0a 08 f5 f8 08 5c a8 a8 f8 a8 07 58 ff ff 00 94 00 00 06 61 08 00 02 06 01 99 00 00 00 01 01 10 ff dd 07 20 08 00 00 15 00 00 01 33 Data Ascii: &ba&{!#!"#5463wHU$X=lF>ha!33#".555!!#cHrMg;ww]2b^XXa35!!#eUw\Xa 3
2024-11-08 13:28:55 UTC	998	IN	Data Raw: 90 39 fe 54 bb c4 fe a3 e7 e6 fe a2 c4 bb 92 01 09 b2 b2 01 0a 91 08 87 ad ea 7e 09 98 09 5a a6 0a fa b4 d1 fe b7 bd be 01 48 d1 05 4c fa c1 a3 ff 92 92 ff a3 ff ff 01 10 ff dd 07 20 0a 9b 02 26 01 a5 00 00 00 07 06 66 00 cb 02 00 ff ff 01 10 ff dd 07 20 0a 9b 02 26 01 a5 00 00 00 07 06 64 01 73 02 00 ff ff 01 10 ff dd 07 20 0a 50 02 26 01 a5 00 00 00 07 06 6a 01 a8 02 00 ff ff 01 10 ff dd 07 20 0a 08 02 26 01 a5 00 00 00 07 06 69 00 b8 00 25 ff ff 01 10 ff dd 07 20 0a 18 02 26 01 a5 00 00 00 07 06 6b 01 59 02 00 ff ff 01 10 ff dd 07 20 09 d3 02 26 01 a5 00 00 00 07 06 6d 01 e9 02 00 ff ff 01 10 ff dd 07 20 0a 00 02 26 01 a5 00 00 00 07 06 6e 01 b0 02 00 ff ff 01 10 ff dd 07 20 0a 99 02 26 01 a5 00 00 00 07 06 72 02 83 00 00 ff ff 01 10 ff dd 07 20 0a 50 Data Ascii: 9T~ZHL &f &ds P&j &i% &kY &m &n &r P
2024-11-08 13:28:55 UTC	16384	IN	Data Raw: 06 e1 f8 00 06 c9 f9 37 ff ff 00 43 00 00 09 f8 0a 50 02 26 01 c8 00 00 00 07 06 6a 02 ad 02 00 ff ff 00 43 00 00 09 f8 0a 9b 02 26 01 c8 00 00 00 07 06 66 01 d0 02 00 ff ff 00 43 00 00 09 f8 0a 9b 02 26 01 c8 00 00 00 07 06 64 02 78 02 00 ff ff 00 43 00 00 09 f8 0a 08 02 26 01 c8 00 00 00 07 06 69 01 bd 00 25 ff ff 00 43 00 00 09 f8 0a 08 02 26 01 c8 00 00 00 07 06 70 03 e8 02 00 ff ff 00 43 fe 25 09 f8 08 00 02 26 01 c8 00 00 00 07 06 8b 08 48 00 10 00 01 00 53 00 00 06 88 08 00 00 0d 00 00 01 01 33 01 33 01 01 23 01 23 01 23 01 01 01 30 02 37 0d 02 37 dd fd 6d 02 93 dd fd c9 0d fd c9 dd 02 9d fd 63 08 00 fc 87 03 79 fc 00 fc 00 03 6f fc 91 04 00 04 00 ff ff 00 53 00 00 06 88 0a 08 02 26 01 cf 00 00 00 07 06 70 02 38 02 00 ff ff 00 53 00 00 06 88 0a 08 Data Ascii: 7CP&jC&fC&dxC&i%C&pC%&HS33###077mcyoS&p8S
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 26 03 07 00 00 00 07 09 96 01 27 00 b0 ff ff 00 9c ff e0 05 e4 08 93 02 26 03 07 00 00 00 07 09 9d 01 75 00 90 00 03 00 9c ff e0 05 e4 06 15 00 03 00 13 00 23 00 00 01 15 21 35 01 22 24 02 35 34 12 24 33 32 04 12 15 14 02 04 27 32 36 12 35 34 02 26 23 22 06 02 15 14 12 16 05 6f fb a4 02 2d c7 fe cf ac ac 01 31 c7 c7 01 30 ad ac fe cf c7 a0 de 73 73 de a0 9f df 73 73 de 03 4f 9e 9e fc 91 ca 01 65 ea ec 01 67 c9 ca fe 9a ec ea fe 9b ca a3 ac 01 1e ac ac 01 20 ae ae fe e0 ac ac fe e2 ac ff ff 00 9c ff e0 05 e4 06 15 02 06 03 35 00 00 ff ff 00 9c ff e0 05 e4 06 15 02 06 03 07 00 00 ff ff 00 9c ff e0 05 e4 08 08 02 06 03 08 00 00 ff ff 00 9b ff e0 0a 5c 06 15 00 26 03 07 ff 00 00 07 02 64 04 95 00 00 ff ff 00 9c fd c0 0b d8 06 15 00 26 03 07 00 00 00 07 03 c3 Data Ascii: &'&u#!5"$54$32'2654&#"o-10ssssOeg 5\&d&
2024-11-08 13:28:56 UTC	2048	IN	Data Raw: ff e4 05 5d 08 b3 02 26 04 44 00 00 00 07 09 8f 01 2d 00 b0 ff ff 00 9c ff e4 05 5d 08 b3 02 26 04 44 00 00 00 07 09 96 00 e3 00 b0 ff ff 00 9c ff e4 05 5d 08 93 02 26 04 44 00 00 00 07 09 9d 01 30 00 90 00 02 00 91 fd f5 05 01 08 00 00 21 00 25 00 00 01 33 15 01 0e 02 15 06 16 17 17 16 16 15 14 06 07 27 36 36 35 26 26 27 27 26 02 37 34 3e 02 37 01 21 15 21 04 ab 56 fe 1a 78 a2 52 01 85 80 a5 aa b6 73 67 6f 40 44 01 79 71 79 c7 d5 01 33 62 94 60 fe 14 04 38 fb c8 08 00 8f fd 97 98 e3 db 8d 82 ae 2b 35 38 95 5d 55 c4 5d 62 46 84 2f 30 52 25 26 3f 01 09 be 74 cc c4 cb 72 02 9c a8 00 01 00 eb fd c0 05 75 06 14 00 16 00 00 01 11 23 11 33 15 33 36 36 33 32 16 16 15 11 23 11 34 26 23 22 06 06 01 9d b2 ad 10 36 e5 a9 9b eb 83 b2 d2 b2 78 bd 6d 03 c0 fc 40 06 00 Data Ascii: ]&D-]&D]&D0!%3'665&&''&74>7!!VxRsgo@Dyqy3b`8+58]U]bF/0R%&?tru#336632#4&#"6xm@
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 81 00 00 00 07 07 fe fe c1 fb 17 00 01 00 90 fd fd 05 43 06 15 00 27 00 00 01 32 16 16 15 23 34 26 07 22 06 02 15 15 06 16 16 17 1e 02 15 14 06 07 27 36 36 35 34 26 27 26 24 02 37 35 34 12 24 03 11 a8 fd 8d c3 cc a3 8d ce 6f 01 70 ef bf 9b ab 45 7c 5e 70 4e 39 6b 99 e4 fe da 8e 01 9d 01 20 06 15 86 f7 a9 b1 ce 01 99 fe ea bd 2a 8c d5 97 30 27 52 65 44 69 d2 55 62 55 72 37 48 46 23 35 b8 01 18 c4 2a f0 01 62 c2 00 03 00 a0 ff e3 06 2b 05 d1 00 15 00 27 00 2b 00 00 13 35 34 12 24 33 1e 02 17 16 16 12 15 15 14 02 04 23 22 24 02 37 15 14 12 16 33 32 36 12 35 35 34 02 26 23 22 06 02 01 15 21 35 a0 9d 01 22 c9 28 43 4f 3b 82 b5 5f 9d fe dd c8 c8 fe dc 9f cd 65 c7 92 91 c5 64 61 c5 94 95 c5 64 04 be fc fd 02 d7 17 d3 01 4e c2 04 28 33 17 2e bb fe fb 9f 15 c4 fe Data Ascii: C'2#4&"'6654&'&$754$opE\|^pN9k 0'ReDiUbUr7HF#5b+'+54$3#"$7326554&#"!5"(CO;_edadN(3.
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: cf fe 0c 02 13 01 18 00 0b 00 00 01 07 06 02 06 07 23 3e 02 37 37 02 13 12 11 3e 42 18 89 0d 29 2c 12 0e 01 18 6b 6c fe fc ea 47 44 d2 ff 87 70 00 01 00 e9 ff f1 02 09 01 11 00 0c 00 00 05 22 26 35 34 36 33 32 16 15 14 06 06 01 79 3b 55 55 3b 3c 54 27 41 0f 55 3b 3c 54 54 3c 27 42 27 ff ff 00 e5 ff f1 08 30 01 11 00 26 05 7c fc 00 00 27 05 7c 03 11 00 00 00 07 05 7c 06 27 00 00 ff ff 00 e5 ff f1 05 1b 01 11 00 26 05 7c fc 00 00 07 05 7c 03 11 00 00 00 02 00 e9 00 27 02 09 05 9b 00 0c 00 19 00 00 25 22 26 35 34 36 33 32 16 15 14 06 06 03 22 26 35 34 36 33 32 16 15 14 06 06 01 79 3b 55 55 3b 3c 54 27 41 28 3b 55 55 3b 3c 54 27 41 27 54 3c 3b 55 55 3b 28 41 27 04 54 54 3c 3b 55 55 3b 28 41 27 00 02 00 e9 01 33 02 09 06 62 00 0c 00 19 00 00 01 22 26 35 34 36 Data Ascii: #>77>B),klGDp"&54632y;UU;<T'AU;<TT<'B'0&\|'\|\|'&\|\|'%"&54632"&54632y;UU;<T'A(;UU;<T'A'T<;UU;(A'TT<;UU;(A'3b"&546
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: fd 4a 00 01 01 16 00 00 0d 60 07 00 00 08 00 00 21 01 01 17 01 21 15 21 01 04 96 fc 80 03 80 76 fd 48 0b 0c f4 f4 02 b8 03 80 03 80 74 fd 48 a8 fd 4a 00 01 01 16 00 00 1c 20 07 00 00 08 00 00 21 01 01 17 01 21 15 21 01 04 96 fc 80 03 80 76 fd 48 19 cc e6 34 02 b8 03 80 03 80 74 fd 48 a8 fd 4a 00 03 01 16 00 00 09 20 07 00 00 05 00 09 00 0d 00 00 21 01 01 17 09 02 27 21 15 01 37 21 15 04 96 fc 80 03 80 76 fc f4 03 0c fd b3 a7 07 08 f8 f8 a7 06 61 03 80 03 80 75 fc f5 fc f5 01 d6 a8 a8 01 c2 a8 a8 00 03 01 16 00 00 0d 60 07 00 00 05 00 09 00 0d 00 00 21 01 01 17 09 02 27 21 15 01 37 21 15 04 96 fc 80 03 80 76 fc f4 03 0c fd b3 a7 0b 48 f4 b8 a7 0a a1 03 80 03 80 75 fc f5 fc f5 01 d6 a8 a8 01 c2 a8 a8 00 01 01 60 00 00 09 6a 07 00 00 08 00 00 21 27 01 21 35 Data Ascii: J`!!!vHtHJ !!!vH4tHJ !'!7!vau`!'!7!vHu`j!'!5
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 9f 32 2d 75 4d 52 75 8f ff 00 fe a9 c9 75 8e a8 6b c6 88 a0 f4 88 81 e8 99 de f5 00 02 00 dd 06 c9 03 a3 09 17 00 0d 00 11 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 27 13 33 03 02 f8 ab be a5 a5 be ab 56 62 60 58 f9 96 b0 d2 07 d5 77 95 95 77 44 5a 5a 6f 01 17 fe e9 00 02 00 dd 06 c9 03 a3 09 15 00 0d 00 11 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 27 03 33 13 02 f8 ab be a5 a5 be ab 56 62 60 58 dd d2 b0 96 07 d5 77 95 95 77 44 5a 5a 6f 01 15 fe eb 00 02 00 f2 06 c9 03 a2 09 a5 00 0d 00 1d 00 00 01 33 14 06 23 22 26 35 33 14 16 33 32 36 27 23 27 36 36 27 26 26 27 37 32 16 15 14 06 07 02 fd a5 b7 a1 9f b9 a5 55 5e 5e 55 60 93 03 5e 58 01 01 75 5b 0c ad b7 74 4a 07 d5 77 95 95 77 44 5a 5a 5e ab 04 21 2a 31 28 01 62 6b 53 4a 48 08 00 01 fc 6b 06 Data Ascii: 2-uMRuuk3#"&53326'3Vb`XwwDZZo3#"&53326'3Vb`XwwDZZo3#"&53326'#'66'&&'72U^^U`^Xu[tJwwDZZ^!*1(bkSJHk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49725	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	570	OUT	GET /fonts/Inter/Inter-SemiBold.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:55 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 309432 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "1753a05196abeef95c32f10246bd6473" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 b04a6cb0bde4a78c29099913e07f9056.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: 7YqQfuA4yJBQUBZor2uCfgHPi_aUGcpxqHo3gRK7LgYEmqrxpy7wCg== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-11-08 13:28:55 UTC	15618	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 44 98 00 00 04 12 47 50 4f 53 9b af 91 74 00 03 48 ac 00 01 2d 14 47 53 55 42 be 7f 66 78 00 04 75 c0 00 00 42 b4 4f 53 2f 32 23 5f 6e 62 00 02 77 ac 00 00 00 60 53 54 41 54 ef 79 d9 45 00 04 b8 74 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 78 0c 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 44 90 00 00 00 08 67 6c 79 66 6a 1b 9d 97 00 00 01 0c 00 02 26 86 68 65 61 64 2d c3 61 46 00 02 4f 84 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 77 88 00 00 00 24 68 6d 74 78 24 35 88 39 00 02 4f bc 00 00 27 ca 6c 6f 63 61 09 84 29 ed 00 02 27 b4 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 27 94 00 00 00 20 6e 61 6d 65 37 5c 60 0e 00 02 dd a0 00 00 02 50 70 6f 73 74 a7 a8 35 72 00 02 df f0 00 00 64 9e 70 72 65 Data Ascii: GDEF11DGPOStH-GSUBfxuBOS/2#_nbw`STATyEtDcmap/.xegaspDglyfj&head-aFO6hheaw$hmtx$59O'loca)''maxp' name7\`Ppost5rdpre
2024-11-08 13:28:55 UTC	1338	IN	Data Raw: 00 00 06 d2 0a 76 02 26 01 99 00 00 00 07 06 73 00 be 02 00 ff ff 00 70 fd 68 06 d2 08 00 02 26 01 99 00 00 00 07 06 77 02 20 00 00 ff ff 00 70 00 00 06 d2 0a 63 02 26 01 99 00 00 00 07 06 70 02 20 02 00 ff ff 00 70 fd d7 06 d2 08 00 02 26 01 99 00 00 00 07 06 8b 06 ba 00 00 ff ff 00 70 fe 25 06 d2 08 00 02 26 01 99 00 00 00 07 08 62 06 ed 00 00 ff ff 00 70 fd c2 06 d2 08 00 02 26 01 99 00 00 00 07 06 89 06 f3 00 00 00 01 00 70 00 00 07 38 08 00 00 10 00 00 01 11 21 11 21 11 23 22 06 06 15 15 21 35 34 00 33 07 38 fd 87 fe 90 e1 4e 55 21 fe c6 01 0a f4 08 00 fe c9 f9 37 06 c9 47 6f 3d 68 ab df 01 08 00 02 00 70 fd c0 06 d2 08 00 00 0d 00 15 00 00 21 15 14 16 33 33 11 23 22 2e 02 35 35 01 11 21 11 21 11 21 11 04 59 8b 56 53 b2 5e b3 8e 53 fd 87 06 62 fd 87 Data Ascii: v&sph&w pc&p p&p%&bp&p8!!#"!5438NU!7Go=hp!33#".55!!!YVS^Sb
2024-11-08 13:28:55 UTC	12792	IN	Data Raw: 07 00 00 01 01 33 01 21 01 21 01 01 dc 02 15 15 02 14 01 98 fd 2e fe 36 fd 2f 08 00 f9 b4 06 4c f8 00 08 00 ff ff 00 45 00 00 07 b2 0a 47 02 26 01 c5 00 00 00 07 06 6b 01 3b 02 00 ff ff 00 45 fd d7 07 b2 08 00 02 26 01 c5 00 00 00 07 06 8b 07 15 00 00 00 01 00 37 00 00 0a dc 08 00 00 0f 00 00 21 01 21 01 33 01 21 01 33 01 21 01 21 01 23 01 02 79 fd be 01 8f 01 71 13 01 8a 01 6b 01 8b 12 01 71 01 8f fd be fe 92 fe 66 10 fe 65 08 00 fa 1f 05 e1 fa 1e 05 e2 f8 00 05 9d fa 63 ff ff 00 37 00 00 0a dc 0a 76 02 26 01 c8 00 00 00 07 06 6a 02 a6 02 00 ff ff 00 37 00 00 0a dc 0a 93 02 26 01 c8 00 00 00 07 06 66 02 37 02 00 ff ff 00 37 00 00 0a dc 0a 93 02 26 01 c8 00 00 00 07 06 64 02 e1 02 00 ff ff 00 37 00 00 0a dc 0a 5b 02 26 01 c8 00 00 00 07 06 69 02 7e 00 20 Data Ascii: 3!!.6/LEG&k;E&7!!3!3!!#yqkqfec7v&j7&f77&d7[&i~
2024-11-08 13:28:55 UTC	6396	IN	Data Raw: 2e 02 37 01 11 21 11 aa 01 6a 54 48 36 45 49 3e 6c b2 6b fe e8 be fd 47 a4 ab a8 4a 78 b7 67 01 01 6a c3 86 6a bb 8e 51 01 01 6a fe 96 01 73 fd f4 46 5b 4c 35 30 48 6e 59 ff d4 e8 38 64 4d 2c 65 ad 6a 6b b5 6e 48 87 bf 75 08 3d f8 00 08 00 ff ff 00 c0 00 00 04 4c 08 00 00 26 02 d3 06 00 00 07 06 70 01 f9 fc cd ff ff 00 ba 00 00 03 25 0a 93 02 26 02 d3 00 00 00 07 06 64 fe c5 02 00 ff ff 00 4d fd 68 02 24 08 00 02 26 02 d3 00 00 00 06 06 77 ef 00 ff ff 00 ba 00 00 04 00 08 66 00 26 02 d3 00 00 00 07 07 f8 01 f1 00 00 ff ff 00 9d fd d7 02 40 08 00 02 26 02 d3 00 00 00 07 06 8b 04 88 00 00 ff ff ff 8d fd d7 03 4e 0a 00 02 26 02 d3 00 00 00 27 06 8b 04 88 00 00 00 07 06 6d fe 89 02 00 ff ff ff 8e fe 25 03 50 08 00 02 26 02 d3 00 00 00 07 08 62 04 bc 00 00 ff Data Ascii: .7!jTH6EI>lkGJxgjjQjsF[L50HnY8dM,ejknHu=L&p%&dMh$&wf&@&N&'m%P&b
2024-11-08 13:28:56 UTC	15628	IN	Data Raw: 02 26 03 56 00 00 00 07 07 fe fe d6 fe d2 00 02 00 ba fd c0 04 72 06 16 00 03 00 17 00 00 13 11 21 11 01 11 21 11 33 36 36 33 32 16 17 03 26 26 23 22 06 06 15 11 ba 01 6a fe 96 01 5f 10 2a cc 85 3e 68 28 70 1d 46 2c 5e 98 59 fd c0 02 40 fd c0 02 40 06 00 ff 00 85 91 1e 1a fe d4 0e 12 54 95 62 fc 79 ff ff 00 ba 00 00 04 72 08 93 02 26 03 56 00 00 00 06 06 64 be 00 ff ff 00 4d fd 68 04 72 06 16 02 26 03 56 00 00 00 06 06 77 ef 00 ff ff 00 5f 00 00 04 72 08 76 02 26 03 56 00 00 00 06 06 73 84 00 ff ff ff c2 00 00 04 72 08 93 02 26 03 56 00 00 00 07 06 7b 05 3b 00 00 ff ff 00 90 00 00 04 72 08 8a 02 26 03 56 00 00 00 07 06 7f 05 c7 00 b6 ff ff 00 ba 00 00 04 72 08 63 02 26 03 56 00 00 00 07 06 70 00 e6 00 00 ff ff 00 9e fd d7 04 72 06 16 02 26 03 56 00 00 00 Data Ascii: &Vr!!36632&&#"j_*>h(pF,^Y@@Tbyr&VdMhr&Vw_rv&Vsr&V{;r&Vrc&Vpr&V
2024-11-08 13:28:56 UTC	15345	IN	Data Raw: 96 ff 1d 00 ae ff ff 00 13 ff ee 03 46 09 c7 02 26 04 6c 00 00 00 07 09 91 ff 92 00 a8 ff ff ff d4 ff ee 03 46 09 c7 02 26 04 6c 00 00 00 07 09 98 ff 53 00 a8 ff ff 00 29 ff ee 03 46 08 94 02 26 04 6c 00 00 00 07 09 9d ff 75 00 9c ff ff ff a8 ff ee 03 4f 08 10 02 26 04 6c 00 00 00 07 06 6e fe e3 00 00 ff ff ff 9a ff ee 03 5b 08 00 02 26 04 6c 00 00 00 07 06 6d fe 96 00 00 ff ff ff 70 ff ee 03 84 09 7d 02 26 04 6c 00 00 00 07 09 9b fe e2 00 a8 ff ff ff 7a ff ee 03 7b 08 ef 02 26 04 6c 00 00 00 07 09 8b fe e3 00 00 ff ff ff 76 ff ee 03 8a 0a 08 02 26 04 6c 00 00 00 07 09 8c fe e8 00 a8 00 02 00 4e ff e8 06 4b 08 1c 00 1b 00 20 00 00 05 22 26 27 01 03 27 2e 02 07 03 36 36 33 32 04 17 01 16 16 33 32 36 37 13 06 06 25 01 13 23 01 05 b5 83 c4 34 fe d8 88 3a 25 Data Ascii: F&lF&lS)F&luO&ln[&lmp}&lz{&lv&lNK "&''.66323267%#4:%
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 00 00 01 15 22 06 15 15 14 0e 02 23 11 32 36 36 35 11 34 3e 02 01 32 1e 02 15 15 14 16 33 15 22 2e 02 35 11 34 26 26 23 01 11 21 11 03 f7 aa 87 55 a4 ec 96 76 7e 2f 34 8a ff fd 20 96 ec a4 55 87 aa cc ff 8a 34 2f 7e 76 03 ac fe c3 03 4a af 8b 9d fe a9 d8 78 2f 01 15 42 86 68 01 48 4c 86 65 39 04 f0 2f 78 d8 a9 ff 9d 8b af 39 65 86 4d 01 48 68 86 41 fc c7 fe b0 01 50 00 02 00 9e fd c2 0a 84 07 e1 00 4e 00 5e 00 00 01 20 24 00 02 03 12 12 00 24 21 20 04 00 12 15 14 02 06 06 07 06 26 26 27 23 0e 02 27 2e 02 02 35 34 3e 02 37 36 16 16 17 33 35 21 11 16 16 33 32 36 12 27 36 02 26 26 24 23 22 04 02 02 15 14 12 00 04 33 32 36 36 37 17 0e 02 03 32 36 36 27 34 26 26 23 22 06 06 15 14 16 16 05 c1 fe c5 fe 17 fe b0 ae 01 01 b0 01 52 01 e8 01 37 01 25 01 c5 01 39 a1 Data Ascii: "#26654>23".54&&#!Uv~/4 U4/~vJx/BhHLe9/x9eMHhAPN^ $$! &&'#'.54>7635!326'6&&$#"32667266'4&&#"R7%9
2024-11-08 13:28:56 UTC	2804	IN	Data Raw: 21 13 21 01 02 3e 01 3b 01 48 fe 8c fd 12 fd 01 46 fe c3 06 9e 01 a2 fe 5e 01 a2 fe 5e 00 01 01 9b 06 ca 03 dd 08 93 00 03 00 00 01 01 21 13 02 ce fe cd 01 63 df 06 ca 01 c9 fe 37 00 01 01 12 06 b4 02 c2 08 8d 00 03 00 00 01 13 21 03 01 12 5d 01 53 d3 06 b4 01 d9 fe 27 00 02 01 1e 06 e2 04 f8 08 5b 00 0b 00 17 00 00 01 22 26 35 34 36 33 32 16 15 14 06 21 22 26 35 34 36 33 32 16 15 14 06 01 e0 4f 73 73 4f 51 6f 6f 02 07 4f 73 73 4f 51 6f 6f 06 e2 70 4c 50 6d 6d 50 4c 70 70 4c 50 6d 6d 50 4c 70 00 02 01 1e 08 c2 04 f8 0a 3b 00 0b 00 17 00 00 01 22 26 35 34 36 33 32 16 15 14 06 21 22 26 35 34 36 33 32 16 15 14 06 01 e0 4f 73 73 4f 51 6f 6f 02 07 4f 73 73 4f 51 6f 6f 08 c2 70 4c 50 6d 6d 50 4c 70 70 4c 50 6d 6d 50 4c 70 00 01 00 db 06 b8 04 eb 08 76 00 08 00 Data Ascii: !!>;HF^^!c7!]S'["&54632!"&54632OssOQooOssOQoopLPmmPLppLPmmPLp;"&54632!"&54632OssOQooOssOQoopLPmmPLppLPmmPLpv
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: a0 ce 02 69 fa 25 05 db fd 97 ce 03 ca 4a cc 02 69 01 2a 02 68 cd fc 36 00 01 01 60 ff b6 0d aa 07 4a 00 08 00 00 05 27 01 21 11 21 01 37 01 09 e0 ce 02 69 f5 e5 0a 1b fd 97 ce 03 ca 4a cd 02 68 01 2a 02 69 cc fc 36 00 01 01 60 ff b6 1c 6a 07 4a 00 08 00 00 05 27 01 21 11 21 01 37 01 18 a0 ce 02 69 e7 25 18 db fd 97 ce 03 ca 4a cd 02 68 01 2a 02 69 cc fc 36 00 03 01 60 ff b6 09 6a 07 4a 00 05 00 09 00 0d 00 00 05 27 01 01 37 01 01 11 21 01 01 11 21 01 05 a0 ce 02 fe fd 02 ce 03 ca f7 f6 06 d7 fe dc fa 4d 05 b3 01 24 4a cc 02 fe 02 fd cd fc 36 fe 6c 01 22 fe de 02 06 01 22 fe de 00 03 01 60 ff b6 0d aa 07 4a 00 05 00 09 00 0d 00 00 05 27 01 01 37 01 01 11 21 01 01 11 21 01 09 e0 ce 02 fe fd 02 ce 03 ca f3 b6 0b 17 fe dc f6 0d 09 f3 01 24 4a cc 02 fe 02 fd Data Ascii: i%Jih6`J'!!7iJhi6`jJ'!!7i%Jh*i6`jJ'7!!M$J6l""`J'7!!$J
2024-11-08 13:28:56 UTC	2804	IN	Data Raw: 71 a8 a8 00 02 00 c2 06 99 04 71 08 e2 00 0d 00 11 00 00 01 21 06 06 23 22 26 35 21 14 16 33 32 36 25 13 21 03 03 6e 01 03 01 ff d9 d9 fd 01 00 61 75 73 62 fe c3 a7 01 0f f0 07 d4 8b b0 b0 8b 3d 5f 5f 47 01 04 fe fc 00 02 00 c2 06 9c 04 71 08 e2 00 0d 00 11 00 00 01 21 06 06 23 22 26 35 21 14 16 33 32 36 25 03 21 13 03 6e 01 03 01 fd db d9 fd 01 00 61 75 72 63 fe e0 f2 01 0f a5 07 d6 89 b1 b1 89 3d 5f 5f 45 01 04 fe fc 00 02 00 c4 06 9c 04 6b 09 ad 00 0d 00 1d 00 00 01 21 16 06 23 22 26 27 33 16 16 33 32 36 27 23 27 36 36 27 36 26 23 37 32 16 07 16 06 07 03 6a 01 00 01 fb da d7 fa 01 fe 01 62 71 73 62 5d ec 13 65 5b 01 01 74 57 0c e4 e9 01 01 81 4e 07 d4 8b ad ad 8b 3e 58 59 64 9a 03 1f 21 2c 1e 8b 6e 60 4a 46 09 00 01 fb de 06 25 03 ca 07 fc 00 15 00 00 Data Ascii: qq!#"&5!326%!nausb=__Gq!#"&5!326%!naurc=__Ek!#"&'3326'#'66'6&#72jbqsb]e[tWN>XYd!,n`JF%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49727	13.32.121.62	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:54 UTC	566	OUT	GET /fonts/Inter/Inter-Bold.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:55 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 309772 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "d17c0274915408cee0308d5476df9f45" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: 6wxKA5pouI3Q4d0jc_AEl-UN5mmfbTL8_ORw5zv-VEG64FSDG-rvfg== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-11-08 13:28:55 UTC	16384	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 46 04 00 00 04 12 47 50 4f 53 ab ef 32 2f 00 03 4a 18 00 01 2c fc 47 53 55 42 be 7f 66 78 00 04 77 14 00 00 42 b4 4f 53 2f 32 23 c3 6e 42 00 02 79 50 00 00 00 60 53 54 41 54 ef dd d9 47 00 04 b9 c8 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 79 b0 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 45 fc 00 00 00 08 67 6c 79 66 05 f3 35 d8 00 00 01 0c 00 02 28 2b 68 65 61 64 2d c4 61 46 00 02 51 28 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 79 2c 00 00 00 24 68 6d 74 78 37 f0 22 d7 00 02 51 60 00 00 27 ca 6c 6f 63 61 09 88 86 18 00 02 29 58 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 29 38 00 00 00 20 6e 61 6d 65 30 30 54 df 00 02 df 44 00 00 02 18 70 6f 73 74 a7 a8 35 72 00 02 e1 5c 00 00 64 9e 70 72 65 Data Ascii: GDEF11FGPOS2/J,GSUBfxwBOS/2#nByP`STATGDcmap/.yegaspEglyf5(+head-aFQ(6hheay,$hmtx7"Q`'loca)X'maxp)8 name00TDpost5r\dpre
2024-11-08 13:28:55 UTC	604	IN	Data Raw: 00 00 00 07 06 76 02 6f 00 02 ff ff 00 b2 ff e3 07 54 0a 7e 02 26 01 a5 00 00 00 07 06 73 00 ee 02 00 ff ff 00 b2 ff e3 07 54 0c 00 02 26 01 a5 00 00 00 07 08 0e 07 70 00 00 ff ff 00 b2 ff e3 07 54 0b e9 02 26 01 a5 00 00 00 07 08 08 06 23 00 00 ff ff 00 b2 ff e3 07 54 0b 78 02 26 01 a5 00 00 00 07 08 0a 07 8e 02 38 ff ff 00 b2 ff e3 07 54 0b 17 02 26 01 a5 00 00 00 07 08 0c 07 84 02 38 ff ff 00 b2 ff e3 07 54 0a 8d 02 26 01 a5 00 00 00 07 06 7b 06 fd 02 00 ff ff 00 b2 ff e3 07 54 0a 96 02 26 01 a5 00 00 00 07 06 7f 07 6a 02 c2 ff ff 00 b2 fd bd 07 54 08 00 02 26 01 a5 00 00 00 07 06 8d 08 42 ff fc ff ff 00 b2 fd d7 07 54 08 00 02 26 01 a5 00 00 00 07 06 90 07 c1 ff fc ff ff 00 b2 fd b6 07 54 08 00 02 26 01 a5 00 00 00 07 06 89 07 70 ff fc ff ff 00 b2 ff Data Ascii: voT~&sT&pT&#Tx&8T&8T&{T&jT&BT&T&p
2024-11-08 13:28:55 UTC	16384	IN	Data Raw: 08 00 ff ff 00 43 00 00 07 f6 0a 51 02 26 01 c5 00 00 00 07 06 6b 01 5d 02 00 ff ff 00 43 fd c1 07 f6 08 00 02 26 01 c5 00 00 00 07 06 8b 07 23 00 00 00 01 00 35 00 00 0b 30 08 00 00 0f 00 00 21 01 21 01 33 01 21 01 33 01 21 01 21 01 23 01 02 7f fd b6 01 d9 01 53 11 01 76 01 95 01 75 12 01 53 01 d9 fd b6 fe 5a fe 7a 10 fe 7b 08 00 fa 71 05 8f fa 6e 05 92 f8 00 05 3b fa c5 ff ff 00 35 00 00 0b 30 0a 7e 02 26 01 c8 00 00 00 07 06 6a 02 9e 02 00 ff ff 00 35 00 00 0b 30 0a 8d 02 26 01 c8 00 00 00 07 06 66 02 61 02 00 ff ff 00 35 00 00 0b 30 0a 8d 02 26 01 c8 00 00 00 07 06 64 03 03 02 00 ff ff 00 35 00 00 0b 30 0a 69 02 26 01 c8 00 00 00 07 06 69 02 c2 00 24 ff ff 00 35 00 00 0b 30 0a 75 02 26 01 c8 00 00 00 07 06 70 04 18 02 00 ff ff 00 35 fd c7 0b 30 08 00 Data Ascii: CQ&k]C&#50!!3!3!!#SvuSZz{qn;50~&j50&fa50&d50i&i$50u&p50
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 07 07 f1 ff 52 ff e0 ff ff 00 6c ff e2 06 70 09 1c 02 26 03 07 00 00 00 07 07 f2 00 b7 ff d7 ff ff 00 6c ff e2 06 54 09 20 02 26 03 07 00 00 00 06 07 f3 28 d3 ff ff 00 6c fd c1 06 54 08 7e 02 26 03 07 00 00 00 26 06 6a 4b 00 00 07 06 8b 06 66 00 00 ff ff 00 6c ff e2 06 f4 08 8d 02 26 03 0b 00 00 00 07 06 64 00 b1 00 00 ff ff 00 6c ff e2 06 f4 08 8d 02 26 03 0b 00 00 00 06 06 66 0e 00 ff ff 00 6c ff e2 06 f4 09 07 02 26 03 0b 00 00 00 07 06 80 07 08 00 0a ff ff 00 6c ff e2 06 f4 08 51 02 26 03 0b 00 00 00 07 06 6b 00 a0 00 00 ff ff 00 6c fd c1 06 f4 06 5a 02 26 03 0b 00 00 00 07 06 8b 06 66 00 00 ff ff 00 6c ff 9e 06 54 08 8a 02 26 03 0a 00 00 00 07 06 64 00 b1 ff fe ff ff 00 6c ff e2 06 54 06 14 02 06 03 07 00 00 ff ff 00 6c ff e2 06 54 08 a4 02 26 03 07 Data Ascii: Rlp&lT &(lT~&&jKfl&dl&fl&lQ&klZ&flT&dlTlT&
2024-11-08 13:28:56 UTC	2048	IN	Data Raw: 21 14 02 06 04 03 22 2e 02 35 34 36 24 33 32 04 16 12 15 21 34 26 26 23 22 06 15 14 16 33 33 15 03 38 c3 fe cb b2 3f 89 da 9b af 54 4c 72 3f 79 7e 9c ad 01 94 71 c5 ff 00 fc 90 ce 84 3f a4 01 26 c2 95 01 03 c2 6d fe 6c 5a 97 5c 72 68 70 74 54 1c 6d c8 89 52 8c 6a 3b 9e 2b 53 3e 46 67 f3 01 02 ce fe cd cb 63 03 06 3d 68 85 46 8e c5 67 5e bd fe df c5 ad c9 55 64 42 45 58 b1 ff ff 00 6c ff e4 05 de 06 14 02 06 04 44 00 00 00 02 00 62 ff e4 05 d5 06 14 00 1b 00 35 00 00 01 32 1e 02 17 06 06 04 23 22 2e 02 27 21 16 16 33 32 36 35 34 26 26 23 23 35 15 35 33 32 36 35 34 26 23 22 06 07 21 36 36 24 33 32 04 16 15 14 0e 02 23 03 78 9f e4 93 46 01 01 be fe bd ca 85 f0 bc 71 05 01 97 0b 8d 8d 8c 94 53 83 4b da da 7c 8a 84 7f 71 91 09 fe 65 07 b0 01 24 b5 c9 01 36 b2 Data Ascii: !".546$32!4&&#"338?TLr?y~q?&mlZ\rhptTmRj;+S>Fgc=hFg^UdBEXlDb52#".'!32654&&##5532654&#"!66$32#xFqSK\|qe$6
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 07 09 8f ff 42 00 b0 ff ff 00 24 ff ee 03 99 08 ae 02 26 04 6c 00 00 00 07 09 96 ff 2f 00 ae ff ff 00 2d ff ee 03 7a 09 cd 02 26 04 6c 00 00 00 07 09 91 ff aa 00 a8 ff ff ff e0 ff ee 03 7a 09 cd 02 26 04 6c 00 00 00 07 09 98 ff 5d 00 a8 ff ff 00 43 ff ee 03 7a 08 94 02 26 04 6c 00 00 00 07 09 9d ff 83 00 a0 ff ff ff a7 ff ee 03 85 08 18 02 26 04 6c 00 00 00 07 06 6e fe ef 00 00 ff ff ff ae ff ee 03 7d 08 00 02 26 04 6c 00 00 00 07 06 6d fe 7a 00 00 ff ff ff 74 ff ee 03 b0 09 87 02 26 04 6c 00 00 00 07 09 9b fe ea 00 a8 ff ff ff 8a ff ee 03 a1 08 f9 02 26 04 6c 00 00 00 07 09 8b fe ef 00 00 ff ff ff 7e ff ee 03 ba 0a 1c 02 26 04 6c 00 00 00 07 09 8c fe f4 00 a8 00 02 00 46 ff e6 06 69 08 1c 00 1b 00 20 00 00 05 22 26 27 01 03 27 2e 02 07 03 36 36 33 32 04 Data Ascii: B$&l/-z&lz&l]Cz&l&ln}&lmzt&l&l~&lFi "&''.6632
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 26 08 60 00 03 00 00 01 01 21 01 02 b7 fd 6c 01 6f 02 94 fe cc 09 94 f6 6c 00 01 00 c1 02 a0 04 67 03 f2 00 03 00 00 01 11 21 11 04 67 fc 5a 03 f2 fe ae 01 52 ff ff 00 c1 02 a0 04 67 03 f2 02 06 05 51 00 00 00 01 00 00 02 a0 05 80 03 f2 00 03 00 00 01 11 21 11 05 80 fa 80 03 f2 fe ae 01 52 00 01 00 00 02 a0 07 80 03 f2 00 03 00 00 01 11 21 11 07 80 f8 80 03 f2 fe ae 01 52 00 01 00 00 02 a0 0b 00 03 f2 00 03 00 00 01 11 21 11 0b 00 f5 00 03 f2 fe ae 01 52 ff ff 00 00 02 a0 0b 00 03 f2 02 06 05 55 00 00 00 01 00 d5 01 78 04 45 04 e8 00 0f 00 00 01 22 26 26 35 34 36 36 33 32 16 16 15 14 06 06 02 8d 79 c8 77 77 c8 79 7a c7 77 77 c7 01 78 77 c8 79 7a c7 77 77 c7 7a 79 c8 77 00 02 00 d5 01 78 04 45 04 e8 00 0f 00 1b 00 00 01 22 26 26 35 34 36 36 33 32 16 16 15 Data Ascii: &`!lolg!gZRgQ!R!R!RUxE"&&546632ywwyzwwxwyzwwzywxE"&&546632
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 36 26 27 01 af c4 10 67 83 01 01 fe ea fb 04 7e 8f 03 02 62 68 08 57 10 7a 69 95 b1 be 3d 40 3d 40 0d 00 01 00 78 fd c2 02 ba 00 73 00 14 00 00 01 22 26 27 26 36 36 37 05 06 06 17 06 16 33 32 36 37 17 06 06 01 d6 85 b3 17 0f 23 69 58 01 3d 5e 78 01 01 32 30 21 34 14 2c 25 73 fd c2 89 7f 52 a6 8a 27 73 2c 66 48 30 34 11 07 dc 15 27 00 01 00 42 fd 70 02 48 ff 5e 00 03 00 00 13 13 21 03 42 7c 01 8a db fd 70 01 ee fe 12 ff ff fd 72 06 c6 ff d0 08 8d 00 07 06 64 fb 5c 00 00 00 02 fa 46 06 c6 fc 80 08 8d 00 03 00 07 00 00 01 03 21 03 21 03 21 03 fb 00 10 01 90 52 fe 3d 25 01 84 38 06 c6 01 c7 fe 39 01 c7 fe 39 00 01 fa b8 06 95 fd 97 08 40 00 03 00 00 01 01 21 01 fc 81 01 16 fe aa fe 77 08 40 fe 55 01 ab 00 02 fa 4e 06 c6 fe 9b 08 8d 00 03 00 07 00 00 01 01 21 Data Ascii: 6&'g~bhWzi=@=@xs"&'&6673267#iX=^x20!4,%sR's,fH04'BpH^!B\|prd\F!!!R=%899@!w@UN!
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 00 00 00 00 07 06 68 03 07 02 00 00 01 00 00 03 5e 04 ba 04 f2 00 17 00 00 01 25 34 36 33 32 1e 02 33 32 36 37 05 06 06 07 22 2e 02 23 22 06 01 16 fe ea db 9e 51 75 5d 55 30 42 44 02 01 11 03 d9 9d 56 75 58 52 34 3a 48 03 5e 03 bf cd 2d 3b 2d 55 45 06 be cc 02 2d 3b 2e 52 00 02 fa d8 06 f0 fe 3e 08 e8 00 03 00 0f 00 00 01 13 21 01 01 36 36 33 32 16 07 16 06 23 22 26 fc 40 ca 01 34 fe e8 fd b2 01 6a 55 59 6a 01 01 6a 59 56 69 06 f0 01 60 fe a0 01 54 44 60 61 43 44 60 61 00 02 fb da 06 95 fe c8 0a 46 00 03 00 0f 00 00 01 01 21 01 01 36 36 33 32 16 07 16 06 23 22 26 fb ea 01 18 01 c6 fe 78 fe 9a 02 76 5e 62 74 01 01 75 61 5f 75 06 95 01 ab fe 55 02 f0 54 6d 6e 53 53 6c 6c ff ff 02 32 fe 2e 04 90 ff f5 00 07 06 64 00 1c f7 68 ff ff ff fa 06 c6 02 59 08 8d 00 Data Ascii: h^%46323267".#"Qu]U0BDVuXR4:H^-;-UE-;.R>!6632#"&@4jUYjjYVi`TD`aCD`aF!6632#"&xv^btua_uUTmnSSll2.dhY
2024-11-08 13:28:56 UTC	16384	IN	Data Raw: 33 32 16 16 33 32 36 01 26 36 33 32 16 17 06 06 23 22 26 25 34 36 33 32 16 17 06 06 23 22 26 fd 6f af 84 64 4b 68 5d 3c 27 35 ac 01 7e 67 3d 6b 6a 3a 26 37 fd 1d 01 69 56 56 6d 01 01 6b 58 55 6a 02 63 6a 58 55 6a 01 01 69 56 58 6a 07 c7 31 64 95 2e 2e 46 31 30 62 9a 2e 2d 44 01 26 44 60 5f 45 45 5b 5b 44 45 60 60 44 45 5d 5c 00 03 fa 52 06 b9 fe 99 0a 0b 00 0b 00 17 00 31 00 00 01 34 36 33 32 16 15 14 06 23 22 26 25 34 36 33 32 16 15 14 06 23 22 26 17 17 14 06 06 23 22 2e 02 23 22 06 15 27 34 36 36 33 32 1e 02 33 32 36 fa 52 73 53 54 73 70 57 56 70 02 b9 72 55 56 71 71 56 55 72 90 f4 55 93 5d 44 61 52 57 38 2f 44 f3 54 92 5c 38 60 5a 5d 35 30 47 09 59 4b 67 67 4b 4a 69 6a 49 4a 67 67 49 4c 65 65 cb 0d 66 a9 65 24 2f 24 42 3e 0d 62 a8 67 23 2d 24 41 00 01 Data Ascii: 32326&632#"&%4632#"&odKh]<'5~g=kj:&7iVVmkXUjcjXUjiVXj1d..F10b.-D&D`_EE[[DE``DE]\R14632#"&%4632#"&#".#"'46632326RsSTspWVprUVqqVUrU]DaRW8/DT\8`Z]50GYKggKJijIJggILeefe$/$B>bg#-$A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49713	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:55 UTC	1220	OUT	GET /keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=52xI58nYg51U9LzhuQZdo4+gVi6C+TIIpwKCOoTh6i4yxN8wzj/ptUSftcDmmEsDswfvPk/ZnD2kJBIQDrKJ4APZlXPV7DfhwUqjNeE8YFv3i4w/k5PZAF5an64/
2024-11-08 13:28:55 UTC	885	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:55 GMT Content-Type: text/javascript;charset=ISO-8859-1 Content-Length: 1382 Connection: close Set-Cookie: AWSALB=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/ Set-Cookie: AWSALBCORS=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie; Expires=Fri, 15 Nov 2024 13:28:55 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Set-Cookie: JSESSIONID=626DB04AC1BA509E99A0C62243116F48; Path=/keyserver; Secure; HttpOnly Cache-Control: no-cache Pragma: no-cache Server: unknown
2024-11-08 13:28:55 UTC	1382	IN	Data Raw: 69 66 28 6c 5f 29 0d 0a 6c 5f 28 7b 0d 0a 22 52 50 43 52 65 66 22 3a 70 61 79 6c 6f 61 64 2e 72 70 63 2c 0a 22 63 61 6c 6c 62 61 63 6b 22 3a 71 72 0d 0a 2c 27 61 63 74 69 6f 6e 27 3a 27 6f 70 65 6e 27 0d 0a 2c 27 73 74 61 74 75 73 27 3a 31 31 0d 0a 2c 27 6d 65 73 73 61 67 65 27 3a 27 50 6c 65 61 73 65 20 65 6e 72 6f 6c 6c 20 62 65 66 6f 72 65 20 6f 70 65 6e 69 6e 67 20 74 68 69 73 20 52 65 67 69 73 74 65 72 65 64 20 45 6e 76 65 6c 6f 70 65 2e 27 0d 0a 2c 27 73 74 61 74 65 27 3a 31 0d 0a 2c 27 72 65 71 54 69 6d 65 27 3a 31 37 33 31 30 37 32 35 33 33 38 30 35 0d 0a 2c 27 72 65 71 4e 75 6d 62 65 72 27 3a 31 0d 0a 2c 27 72 65 63 69 70 69 65 6e 74 49 64 65 6e 74 69 66 69 65 64 27 3a 66 61 6c 73 65 0d 0a 2c 27 73 75 63 63 65 73 73 27 3a 74 72 75 65 0d 0a 2c 27 Data Ascii: if(l_)l_({"RPCRef":payload.rpc,"callback":qr,'action':'open','status':11,'message':'Please enroll before opening this Registered Envelope.','state':1,'reqTime':1731072533805,'reqNumber':1,'recipientIdentified':false,'success':true,'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49732	54.234.149.46	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:56 UTC	686	OUT	GET /websafe/images/loginbg.gif HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=48DAF49D4AD0F29937E90157B4B60CD0; AWSALB=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; AWSALBCORS=/i2jlVMUWd8/ZvVwpHuNzYVUm96sRCFdTIZvgr3hYIYU0R3IscGw2NOGZN4RhmcwX1UDjq94GPiU2j2w66+U7755YbOxiqf1Ai9eYX6niqm+PdYt8w5j7QHNJ/ZA
2024-11-08 13:28:56 UTC	881	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:56 GMT Content-Type: image/gif Content-Length: 51646 Connection: close Set-Cookie: AWSALB=GYfP5Gh4N/LpZExrEkT1Iws3HS2mO+R5FaizPj2N/Nydk4NpASNGg5UIcwMCzWiQUKhxIJWpyuryLrYzgT5Ryw23pK0ZD1EuAkD/2kGd5khdg2kFyEqBIt2BaE0E; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/ Set-Cookie: AWSALBCORS=GYfP5Gh4N/LpZExrEkT1Iws3HS2mO+R5FaizPj2N/Nydk4NpASNGg5UIcwMCzWiQUKhxIJWpyuryLrYzgT5Ryw23pK0ZD1EuAkD/2kGd5khdg2kFyEqBIt2BaE0E; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-c9be" Server: unknown
2024-11-08 13:28:56 UTC	8549	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2024-11-08 13:28:56 UTC	9000	IN	Data Raw: 23 80 09 1c 88 00 60 20 c8 04 48 40 48 48 0b 23 91 80 0b 52 62 3d 0a 8e 82 ca 00 84 d0 93 d8 3c d0 9d b7 02 86 00 02 6c 13 08 28 04 86 28 00 33 78 66 89 c9 36 4d 8a ac 0b 80 81 80 0b 21 23 10 00 68 c2 04 d0 14 04 a6 54 80 08 60 02 80 18 00 a4 60 20 07 e4 45 9c a2 f5 22 ce 00 a9 84 2d 75 23 52 b8 01 72 80 49 40 e0 05 12 09 40 e3 cc 20 02 46 2e 21 00 30 25 a1 a0 08 01 88 00 91 88 0a 43 12 18 00 00 00 99 05 b2 40 43 89 d4 45 20 18 00 00 04 0a ce 06 9c 80 c0 52 39 00 00 92 64 0a 14 8a 49 6c 06 d9 2e c2 08 08 91 c0 c2 40 ba e8 24 3a 39 42 40 1c 82 64 20 cd f9 01 6d 23 37 00 e7 71 a4 f6 c0 13 0f 7d 01 26 f6 92 be 95 ff 00 26 56 58 18 42 73 ea 2e 2e 67 69 1c 67 da 35 86 41 9c 7c 87 3d 73 a1 a4 ce a2 e3 d3 a8 54 2a a7 b8 ff 00 1f 98 71 f9 0f 28 06 ab 1b 87 04 0a Data Ascii: #` H@HH#Rb=<l((3xf6M!#hT`` E"-u#RrI@@ F.!0%C@CE R9dIl.@$:9B@d m#7q}&&VXBs..gig5A\|=sT*q(
2024-11-08 13:28:56 UTC	9000	IN	Data Raw: 24 a6 48 19 f7 7e d3 9e bf 72 3b 22 45 f8 d1 05 80 01 40 12 20 08 60 20 00 28 91 c8 53 08 27 90 b9 a0 2e 04 67 cc 5c c0 d6 50 a4 ce d8 c9 1c c0 de 45 c8 c3 f2 12 fb a4 1d 1c 85 c8 e7 fc 81 cc 0e d1 88 65 08 45 09 81 2c a2 59 40 03 10 c0 42 63 13 02 44 31 10 4d f0 8c 97 09 c6 19 b3 52 27 55 13 b8 02 70 a0 e7 be a7 4a 4c c9 ce c0 2e da 72 6f 5a 41 9d 65 bc 8d 3c ea 02 75 f3 40 aa b7 62 7a 8d 01 aa 55 aa c1 0f 8e e1 55 91 35 ea 02 fa 07 35 da 03 87 a8 70 0a 96 ff 00 e4 97 b0 13 6f fb 85 6a 28 cb 40 92 ea 82 15 bd 76 34 5a 10 d5 7a ed d0 d2 b1 b4 80 aa db f4 15 ab cb 71 a7 90 b3 c7 40 27 8a 51 2e 42 c9 b5 12 92 81 63 e2 0e ba 4e 35 02 6b 48 ba 72 b4 35 b2 84 db c9 8f 25 ca a9 2d b5 7a 9a 5f 46 06 0a f0 6d 5b a7 83 9c 60 74 c7 40 4e 0c 6b 66 b5 36 56 90 2e 40 Data Ascii: $H~r;"E@ ` (S'.g\PEeE,Y@BcD1MR'UpJL.roZAe<u@bzUU55poj(@v4Zzq@'Q.BcN5kHr5%-z_Fm[`t@Nkf6V.@
2024-11-08 13:28:56 UTC	9000	IN	Data Raw: c3 5f 11 b7 5c c6 80 70 e7 a2 1a e5 5d 0d 9f 65 ce 16 0d 2b d8 ea 80 8a ff 00 b0 eb ae 4e 8a f7 d5 b5 33 fc 75 ae b0 1c e9 5d c8 8e 95 0f 46 37 9d 72 70 be ea 5a 17 4f f6 36 60 6f c1 2c a7 ec 29 fd 2b cc 1c eb b9 93 ab 6e 59 5a 91 2a 9c 9c e7 db 05 70 aa cb 26 d2 be d4 62 eb 67 a8 69 ad bb 89 a8 5a 7a 93 5a f2 71 fa 93 c1 f4 3a 3b 5d be 2a 5e ac 83 58 8c 04 72 f4 17 2a a7 1b 99 df b8 9d 67 39 fd 45 f8 87 7e ea aa 9a ef a1 85 bb 9b 67 de 3b 70 e4 ab 2f e9 c1 0f 83 7f 71 56 60 e7 3d 7e 07 45 31 55 e7 9d 0c 38 55 e1 58 e8 bc 25 ae 8a 01 71 93 b2 b5 8b e5 1d 7c 7b 08 a7 15 96 c6 ed 4e a0 f8 6e eb cf e0 2e 49 ff 00 4f d8 8f a5 e9 64 3f c6 f6 68 2f c6 94 4a cf 68 5d 0d ad d0 54 a7 15 06 4e 5b f5 24 45 2a ef be c1 0e 61 3f 1d 43 94 2f 97 ee 3a e9 9d ca 87 6b 71 Data Ascii: _\p]e+N3u]F7rpZO6`o,)+nYZp&bgiZzZq:;]^Xrg9E~g;p/qV`=~E1U8UX%q\|{Nn.IOd?h/Jh]TN[$Ea?C/:kq
2024-11-08 13:28:56 UTC	9000	IN	Data Raw: 10 0a 7c 85 cb c9 94 00 4f 21 c8 c0 05 23 00 80 09 26 41 c1 36 f2 00 4e 59 72 42 a8 43 5a 01 72 27 64 43 ab 29 24 02 96 c6 aa 8a 80 80 18 0a 03 8a 01 81 3c 50 f8 a0 18 0a 10 68 00 4a d4 a8 22 32 05 68 38 08 12 01 f1 42 e2 54 04 00 a1 86 42 06 04 cb e8 3e 48 60 02 94 31 71 42 e0 80 a1 0b 88 43 40 25 82 c8 72 09 b0 2c 09 9e a1 c8 0a 01 48 48 0c 09 90 90 28 09 e4 c2 58 14 04 cb 1c b0 1b 44 c8 e5 89 c8 14 04 4b 45 4b 02 80 9c 86 40 a0 24 60 04 5c b8 22 c0 43 d0 8f f5 f4 65 b7 82 3f d7 78 64 1b 36 d0 f2 16 1e 59 42 58 28 97 20 80 4f ee 2c 8d cb 00 89 22 20 a0 01 48 a8 36 89 ab 03 40 27 90 72 01 b4 2c a0 91 c8 0b 96 0c d3 8d 4d 19 8d b5 01 b6 4b 2a 05 80 24 ba e5 0a d0 99 55 78 64 15 45 0b 53 43 2e db 35 28 ce da 96 8c ed a9 a2 20 01 00 14 31 31 89 81 16 d0 28 Data Ascii: \|O!#&A6NYrBCZr'dC)$<PhJ"2h8BTB>H`1qBC@%r,HH(XDKEK@$`\"Ce?xd6YBX( O," H6@'r,MK*$UxdESC.5( 11(
2024-11-08 13:28:56 UTC	7097	IN	Data Raw: 82 ae 9e b9 f6 79 fb 40 6d 36 bf f2 d0 99 85 e5 af b5 e8 5c ae 5e 73 eb fd 0c f0 9b 5a 81 7a d9 ac ac 02 ce 35 c7 c9 8a b6 ca 5b 60 34 4d 2d 26 00 6b 32 ba 0a bf 2f 1e 3a 95 57 16 7d 5a d0 53 0a 3d 3d c0 2d 26 3d 70 26 d2 52 b0 5f 15 98 d1 8a b9 c3 c7 1f 87 8f 90 09 29 c3 59 42 56 4d cf f7 6f 1b f8 41 31 9d 85 30 bd 1f cc 02 21 cb 58 d3 f6 2f 1e c6 4b 5a cb c6 80 d4 ed e4 bd 40 76 87 ae 1c 47 90 28 df 5d 19 52 b3 ac 2d 88 7d 34 9f 18 03 44 bf ba 3d f8 33 aa 8f 28 cf bc ba e5 28 59 8f 98 9a 88 ce 50 0e 78 b9 d2 31 1e a4 be ab fb 77 f9 84 4c c7 c7 7f 1b 0e af e9 6d e8 06 7a e3 4f 1f 39 34 ac 35 89 9d ff 00 5c 91 30 bd 17 c3 d4 2a f3 d2 40 d1 6b 0f c6 fe c1 66 21 e7 4f 0b d1 0e ca 7d 11 2d ce 62 63 12 03 b5 63 1e 10 f8 b6 fa 78 cf b4 4b 2a 26 5f 8f e9 ea 09 Data Ascii: y@m6\^sZz5[`4M-&k2/:W}ZS==-&=p&R_)YBVMoA10!X/KZ@vG(]R-}4D=3((YPx1wLmzO945\0@kf!O}-bccxK&_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49734	54.234.149.46	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:56 UTC	1213	OUT	GET /keyserver/keyserver?su=LFRANCO%40HAIGROUP.COM&df=&tf=&lp=en&v=2&m=%7c1__a74d4cff00000192f784015a956f8f48082d051c%40mail10688.corpmailsvcs.com&s=1&f=0&d=1731072533805&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36 HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=WEF8Oiduf8qx3yWeWfZRpBu6sGLHKMfpdqTWXAlkThCpZ/H7Zh10wbTdRM9YKem5/dh7obz+6L9MeN8RX3DaAGepynDnDJ6vIdh7FnnpvnCcUmnQr0aK0eSjDPkN; AWSALBCORS=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie
2024-11-08 13:28:56 UTC	885	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:56 GMT Content-Type: text/javascript;charset=ISO-8859-1 Content-Length: 1392 Connection: close Set-Cookie: AWSALB=+07DuOHJp5TUvPB2TuyJnaS9RY4S6Hz7KIDnE7eU9sUZif7rGQzyz4XAkfrS7mJcwF1pOD6rT/PQ+Lp8ynB5eMibjtBaYtph2DTyUfzm2yraCem0HWC85qwtK2fA; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/ Set-Cookie: AWSALBCORS=+07DuOHJp5TUvPB2TuyJnaS9RY4S6Hz7KIDnE7eU9sUZif7rGQzyz4XAkfrS7mJcwF1pOD6rT/PQ+Lp8ynB5eMibjtBaYtph2DTyUfzm2yraCem0HWC85qwtK2fA; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Set-Cookie: JSESSIONID=B40B0CDBD89B66AE5193A2D79F434E57; Path=/keyserver; Secure; HttpOnly Cache-Control: no-cache Pragma: no-cache Server: unknown
2024-11-08 13:28:56 UTC	1392	IN	Data Raw: 69 66 28 6c 5f 29 0d 0a 6c 5f 28 7b 0d 0a 22 52 50 43 52 65 66 22 3a 70 61 79 6c 6f 61 64 2e 72 70 63 2c 0a 22 63 61 6c 6c 62 61 63 6b 22 3a 71 72 0d 0a 2c 27 61 63 74 69 6f 6e 27 3a 27 6f 70 65 6e 27 0d 0a 2c 27 73 74 61 74 75 73 27 3a 31 31 0d 0a 2c 27 6d 65 73 73 61 67 65 27 3a 27 50 6c 65 61 73 65 20 65 6e 72 6f 6c 6c 20 62 65 66 6f 72 65 20 6f 70 65 6e 69 6e 67 20 74 68 69 73 20 52 65 67 69 73 74 65 72 65 64 20 45 6e 76 65 6c 6f 70 65 2e 27 0d 0a 2c 27 73 74 61 74 65 27 3a 31 0d 0a 2c 27 72 65 71 54 69 6d 65 27 3a 31 37 33 31 30 37 32 35 33 33 38 30 35 0d 0a 2c 27 72 65 71 4e 75 6d 62 65 72 27 3a 31 0d 0a 2c 27 72 65 63 69 70 69 65 6e 74 49 64 65 6e 74 69 66 69 65 64 27 3a 66 61 6c 73 65 0d 0a 2c 27 73 75 63 63 65 73 73 27 3a 74 72 75 65 0d 0a 2c 27 Data Ascii: if(l_)l_({"RPCRef":payload.rpc,"callback":qr,'action':'open','status':11,'message':'Please enroll before opening this Registered Envelope.','state':1,'reqTime':1731072533805,'reqNumber':1,'recipientIdentified':false,'success':true,'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49733	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:56 UTC	722	OUT	GET /websafe/images/pullFeature/arrowDown.svg HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=Hb9M/yD8QKSKFZnhSsSfyRgxO9IK+cSa6xHUk9WEzlNufDP+VI55F72ax0L7hCJG5/pMwjxGKF9rWMntewDFgX1w2WvYQN6SJix+YdpgsDZcERcjxfhswrO64Iie
2024-11-08 13:28:56 UTC	972	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:56 GMT Content-Type: image/svg+xml Content-Length: 387 Connection: close Set-Cookie: AWSALB=ff/ih7FVU30M/JR3oSG4GjM5tOwfmg/lf1Rr1anY1UwmPyvwRrcokj0dHULZWqlXX3THOXUkjpY3fUlSX9ofDUVqup7g0XoUOMh5icn3Vl9/qdRnMKheTksNrN+M; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/ Set-Cookie: AWSALBCORS=ff/ih7FVU30M/JR3oSG4GjM5tOwfmg/lf1Rr1anY1UwmPyvwRrcokj0dHULZWqlXX3THOXUkjpY3fUlSX9ofDUVqup7g0XoUOMh5icn3Vl9/qdRnMKheTksNrN+M; Expires=Fri, 15 Nov 2024 13:28:56 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=96CAF30A42473F2ED087767E8F40EB09; Path=/websafe; Secure; HttpOnly Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-183" Server: unknown
2024-11-08 13:28:56 UTC	387	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 76 67 20 69 64 3d 22 61 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 0a 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 3e 0a 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 62 7b 66 69 6c 6c 3a 23 66 66 66 66 66 66 3b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 64 65 66 73 3e 0a 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 33 2e 38 38 31 2c 36 2e 31 33 31 63 2e 33 34 32 2d 2e 33 34 32 2c 2e 38 39 36 2d 2e 33 34 32 2c 31 2e 32 33 37 2c 30 6c 32 2e 38 38 31 2c 32 2e 38 38 31 2c 32 2e 38 38 31 2d 32 2e 38 38 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><defs><style>.b{fill:#ffffff;fill-rule:evenodd;}</style></defs><path class="b" d="M3.881,6.131c.342-.342,.896-.342,1.237,0l2.881,2.881,2.881-2.881

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49735	54.234.149.46	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:57 UTC	700	OUT	GET /websafe/images/pullFeature/arrowDown.svg HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=48DAF49D4AD0F29937E90157B4B60CD0; AWSALB=GYfP5Gh4N/LpZExrEkT1Iws3HS2mO+R5FaizPj2N/Nydk4NpASNGg5UIcwMCzWiQUKhxIJWpyuryLrYzgT5Ryw23pK0ZD1EuAkD/2kGd5khdg2kFyEqBIt2BaE0E; AWSALBCORS=ff/ih7FVU30M/JR3oSG4GjM5tOwfmg/lf1Rr1anY1UwmPyvwRrcokj0dHULZWqlXX3THOXUkjpY3fUlSX9ofDUVqup7g0XoUOMh5icn3Vl9/qdRnMKheTksNrN+M
2024-11-08 13:28:57 UTC	882	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 13:28:57 GMT Content-Type: image/svg+xml Content-Length: 387 Connection: close Set-Cookie: AWSALB=eJiC2DypbG33AEhnb/AiAuaxYhaVMIzNYhay4aKYgk8LlTprNRwicD1nuCIdvft1WcJ6kzihA7uYga33lVJf8RIdKZlpgK/AbF9HsZwGNL7/iR+ycF6Kj0XBJ+bq; Expires=Fri, 15 Nov 2024 13:28:57 GMT; Path=/ Set-Cookie: AWSALBCORS=eJiC2DypbG33AEhnb/AiAuaxYhaVMIzNYhay4aKYgk8LlTprNRwicD1nuCIdvft1WcJ6kzihA7uYga33lVJf8RIdKZlpgK/AbF9HsZwGNL7/iR+ycF6Kj0XBJ+bq; Expires=Fri, 15 Nov 2024 13:28:57 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Last-Modified: Thu, 24 Oct 2024 09:17:12 GMT ETag: "192bdd0cdd8-183" Server: unknown
2024-11-08 13:28:57 UTC	387	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 76 67 20 69 64 3d 22 61 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 0a 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 3e 0a 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 62 7b 66 69 6c 6c 3a 23 66 66 66 66 66 66 3b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 64 65 66 73 3e 0a 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 33 2e 38 38 31 2c 36 2e 31 33 31 63 2e 33 34 32 2d 2e 33 34 32 2c 2e 38 39 36 2d 2e 33 34 32 2c 31 2e 32 33 37 2c 30 6c 32 2e 38 38 31 2c 32 2e 38 38 31 2c 32 2e 38 38 31 2d 32 2e 38 38 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><defs><style>.b{fill:#ffffff;fill-rule:evenodd;}</style></defs><path class="b" d="M3.881,6.131c.342-.342,.896-.342,1.237,0l2.881,2.881,2.881-2.881

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49736	13.32.121.35	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:57 UTC	360	OUT	GET /CRES_login_bg.jpg HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 13:28:57 UTC	723	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 155249 Connection: close Date: Fri, 08 Nov 2024 13:28:56 GMT Last-Modified: Wed, 20 Sep 2023 11:59:56 GMT ETag: "c3598f2d3bf6694df3378aafc792bfee" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P1 X-Amz-Cf-Id: Qle83uYRY6PDRqk-BATsLqHHw6rcEY09X2VUJMObbeuz8bAnBvUUZQ== Age: 2 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Vary: Origin
2024-11-08 13:28:57 UTC	15661	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2024-11-08 13:28:57 UTC	329	IN	Data Raw: b3 9e d4 5b 93 46 db 4a 84 02 66 66 ac c8 00 00 00 00 43 20 06 21 94 02 63 13 01 00 01 03 00 02 87 a0 af 55 65 b9 6a 52 52 27 48 d0 0c e9 79 2a d6 9d 35 07 45 65 2b 52 15 bb ea 41 b5 6c ec 54 49 95 25 e8 68 9c ea 50 e1 04 8c 20 04 63 1b af 9e 86 e6 75 f9 9b f8 01 70 38 00 00 00 00 02 5b e8 89 b5 fa 21 57 00 5a ac 0d f8 8b 2c 70 06 13 b5 e0 d1 5f 71 6e a9 99 d7 d2 e1 90 5e 42 3b 94 05 0a 10 c0 00 00 00 00 00 00 00 52 12 01 6d 08 e3 be e5 0f 52 c8 db b5 cc f9 80 95 d2 70 cd 26 4c f9 12 4a 47 6b 42 03 0e 46 d5 87 c7 ea 70 25 5d ee 0e 85 c7 54 44 52 49 00 c0 aa 40 30 00 00 14 80 c0 52 45 bd 5e 94 04 4b 9d c6 d2 88 d9 88 1d 12 80 2a 43 23 00 26 18 6d 28 97 68 f3 01 e1 13 2e da 68 1b 67 2c b0 25 55 22 80 52 03 26 da 04 83 4d 80 55 ca 45 19 d2 b8 2e 00 24 24 30 Data Ascii: [FJffC !cUejRR'Hy5Ee+RAlTI%hP cup8[!WZ,p_qn^B;RmRp&LJGkBFp%]TDRI@0RE^KC#&m(h.hg,%U"R&MUE.$$0
2024-11-08 13:28:57 UTC	1908	IN	Data Raw: 10 16 04 c0 64 06 d8 22 2c d8 eb 6c 01 60 12 00 26 a7 53 36 9d 7c 8d 40 09 59 ca 61 91 35 19 5f 70 eb 69 f3 01 c8 4a 18 a2 40 60 4c 04 b4 04 f2 5a 0b d4 84 fb 93 c7 6e 84 1a c0 0c 0a 16 45 28 a0 02 61 04 34 38 14 3e 80 29 ee 61 6a 4e 51 d1 2f a8 61 81 c6 93 ea 6a ad 0a 10 f9 6b d5 18 a6 44 74 d2 91 97 a9 7e 04 56 d8 2a af 05 55 01 9d 2d b9 be c6 a0 00 00 00 27 54 c6 00 4c 76 61 2d 14 00 4e e2 80 5b 50 0c 09 80 96 b5 02 84 29 04 e4 09 bd 5b 45 a8 6b 03 21 a8 ca 02 c0 95 64 ca 01 0c 00 09 75 42 87 d0 b0 03 9f e5 b4 b3 65 64 63 79 dc a7 43 7c 30 09 19 3b 50 43 40 50 13 2d 6a 3d c8 06 02 90 d4 00 9b 5a 30 b2 c4 ed 2e 2a 35 5d ba 6a 01 5a c6 5e 59 41 03 00 00 00 00 00 00 00 00 21 88 b6 48 0d 14 24 20 1c 80 a0 40 0d 12 50 98 12 20 02 20 2a b3 d0 93 4a 05 54 be Data Ascii: d",l`&S6\|@Ya5_piJ@`LZnE(a48>)ajNQ/ajkDt~VU-'TLva-N[P)[Ek!duBedcyC\|0;PC@P-j=Z0.5]jZ^YA!H$ @P *JT
2024-11-08 13:28:58 UTC	16384	IN	Data Raw: 80 c0 50 10 01 20 30 01 64 20 60 00 73 d9 ed b6 0e 83 3b ad d8 02 aa e4 a3 24 f6 b8 66 a0 00 20 90 18 0b 21 00 31 48 40 c0 42 6e 32 51 8f 2d ba 01 95 9e e6 6f 45 0a 19 1c 75 9c b3 72 0c 1a 74 72 8d 55 93 52 82 ca 51 8c ed 72 be e2 8e 80 25 59 30 90 28 09 c8 40 0e 49 b3 e8 b5 1e 16 48 ac b7 2c 0a aa 69 41 50 04 bb 46 3a 80 e1 22 2d 67 fb 51 4a b3 a8 db 48 82 78 d3 89 34 22 ac a9 48 a1 81 33 d8 59 f2 02 89 77 5d 32 1b 13 d7 25 25 00 44 d9 e9 81 7d 36 f5 66 a0 04 2a 24 54 0c 00 94 a2 c5 12 f0 d0 e4 06 02 94 12 03 33 5f 33 2a 5f 63 25 3b 98 1b 81 19 0f 50 16 26 28 7d c9 b4 a4 05 57 42 8c a9 30 54 30 2c 08 c8 f2 03 b6 83 33 b3 84 8a dc 05 00 b7 20 90 19 16 88 2c 8b b0 15 6b d4 79 45 21 81 90 f7 33 41 42 01 6f 45 6a 66 e8 98 b6 35 a0 1a 42 16 d2 37 b5 aa 29 5d Data Ascii: P 0d `s;$f !1H@Bn2Q-oEurtrURQr%Y0(@IH,iAPF:"-gQJHx4"H3Yw]2%%D}6f$T3_3_c%;P&(}WB0T0,3 ,kyE!3ABoEjf5B7)]
2024-11-08 13:28:58 UTC	16384	IN	Data Raw: c9 dc ce 6d f6 07 7b 01 b8 a4 e5 7c 96 25 f2 5b b0 1d 4e e4 5a e7 2b e4 b9 3b ec 07 4e f2 5d ce 5d f6 13 b5 c0 e8 77 27 79 86 eb 75 32 b5 ec 80 ea 77 21 dc c3 78 b7 a0 35 76 16 e3 3d e8 5b 90 1a 6e 21 d8 49 c9 36 70 05 3b 0b 71 8e f6 1b bc 40 d5 d8 96 c8 95 dc 22 74 4c 07 21 b8 3e 9b 7d 97 98 dd 12 f9 99 44 ee 2f 8e 96 e5 b6 da 65 9d 5e df d8 3e 6f 53 f4 d3 bb eb e4 7b 1c 74 a7 15 62 91 4a f7 ea c0 f2 3f ec a9 6b 42 4b 4e c7 25 94 70 d7 ed d4 f6 6f 67 29 ab 3a b4 4f 27 15 39 ea b7 42 7e 1a 01 e7 5b fe 7a f8 4f e4 3e 0e 67 c6 af 2b 75 25 4d 7e da 33 ae fe d9 ae 5d d9 d1 f8 9c 96 e1 b5 29 6c 6a ff 00 40 8d 2f c2 b9 2b 4b 70 a6 ea a3 d2 f5 59 21 3f 5d df f9 7f 50 55 b2 7c 7b 65 3c 68 74 57 6f 35 ac 9a d9 76 be 6f da f2 15 c6 ff 00 e2 5e 6f f3 3b 57 3a 77 7c Data Ascii: m{\|%[NZ+;N]]w'yu2w!x5v=[n!I6p;q@"tL!>}D/e^>oS{tbJ?kBKN%pog):O'9B~[zO>g+u%M~3])lj@/+KpY!?]PU\|{e<htWo5vo^o;W:w\|
2024-11-08 13:28:58 UTC	16384	IN	Data Raw: 39 79 3b 1a c1 c3 60 33 dd fe 7a 7c 2e 43 e3 6d 42 e4 a6 91 aa 39 ff 00 b7 a7 47 f6 fb 88 b7 05 2b ab 53 1d c8 ae 9f a3 7f ff 00 69 4f fd 48 aa f1 5d 7e fa ff 00 ea 38 3e 95 7b af bc 3e 95 7b a1 83 db 49 46 5d 5b f3 42 49 37 96 be f4 79 14 e1 e3 7f 33 83 7f ec f8 da 95 63 3c 45 75 39 7c 9a af bd 1d 7c 72 ab f0 3c 75 ed 6a dc 49 d5 56 b8 ea a8 ed b6 11 78 1b 5e ed 30 bb 71 e9 69 1c 37 e1 e3 79 ad e7 b9 9f d1 5a ef 24 8b af 4e b7 b4 6a a4 cd f2 5d 3e 87 3f 1f b2 57 52 ac 16 f6 2d 69 63 4c b6 7c ed 60 bd d2 b0 a4 e0 fe df a6 e4 6b 5f 68 df ee 03 a5 25 68 56 aa 3d 1e 2a 2a d6 12 83 c5 5e d1 cc 6e 3b 17 b0 b4 7f c9 62 0d 9f 24 5d 57 b9 a3 5b 96 4f 2d 70 5a 9c 8a 6d 30 6f c9 cf d2 b6 ca f0 28 d1 f0 da af 0a 51 95 ad d0 d7 8b dc b7 8b eb e0 6b 6a 52 f9 03 24 f0 Data Ascii: 9y;`3z\|.CmB9G+SiOH]~8>{>{IF][BI7y3c<Eu9\|\|r<ujIVx^0qi7yZ$Nj]>?WR-icL\|`k_h%hV=**^n;b$]W[O-pZm0o(QkjR$
2024-11-08 13:28:58 UTC	14808	IN	Data Raw: 42 5e d6 9a 41 11 e4 bb 72 27 1b 9f de 52 e4 e5 dd 1b 99 eb 7f 6f 47 d0 3f b7 a7 60 39 bd bd f7 52 6f 6b 49 75 dd 6b 46 e6 91 b7 f6 f5 e9 82 ab c0 93 99 28 f3 b9 39 79 68 da 57 95 f0 2a fc dc 94 87 57 88 3d 0f ed f8 df 42 6b c1 4b 2c e4 8a e0 fe e7 95 65 bd 7c 0d 3f b9 e4 4e 1b fc 0e cf ed a8 fa 0d 7b 7a 76 03 85 73 f2 bb 6d 6f f0 07 cf c9 2d 26 a1 78 1d ff 00 42 89 ca d4 3e 85 1f 40 38 57 b9 e4 6a 67 f0 2b fb 9e 4e eb ee 3a ff 00 b7 a0 bf b7 a0 1c bf dc 72 f8 7d c3 5e e3 93 ac 7d c7 57 d0 a8 fe 8d 40 e6 fe e3 93 c0 6b dc 5f c0 e8 fa 35 0f a3 50 39 fe bd fc 0a af 3d 9b 4a 10 b9 6a eb f2 a9 0a 5f 2a 50 1b da aa eb 26 5c 30 ed e4 2f 71 6a a4 83 86 c9 37 00 5c 3b 5c c7 99 ad da 49 4e cd 5f 77 49 37 ad 94 b9 f8 30 30 e3 bb ae 87 5a 52 4b 75 78 70 3a c5 71 25 Data Ascii: B^Ar'RoG?`9RokIukF(9yhWW=BkK,e\|?N{zvsmo-&xB>@8Wjg+N:r}^}W@k_5P9=Jj_P&\0/qj7\;\IN_wI700ZRKuxp:q%
2024-11-08 13:28:58 UTC	16384	IN	Data Raw: af 96 ab f8 87 59 ba e0 e4 e1 bb 6e 53 27 fb 6b bf da 53 e4 a3 ce dd 7f cc c9 7c 95 fe 9f bd b0 72 97 c1 68 9c 7d e8 e7 bd 1a 70 6e f9 14 42 ad 4d 1f 25 36 ac a4 fb 41 12 ff 00 2e 2a f1 b6 75 53 db 4a c9 9b e6 4b 4c fe 05 2f 77 64 a1 24 4e 6b 33 23 da f6 74 55 e3 5e 09 99 2a 6c e2 7f e6 65 7b 5e 58 e0 4e dd bf 36 74 59 7a 6a 8c f9 e3 fe 5a 95 cd c6 9a e3 e3 5d ed 6b 7e 66 3e f2 ae cf 8e bd ee 7a 4a 9e 9a 63 a3 33 e4 49 5d 59 af f8 d3 b7 c7 44 66 df f7 4f 87 97 ce f7 7b 8b dd e9 4f d3 08 e3 bd a5 c9 e9 5f 89 46 de ba db cd 98 72 70 55 60 e9 f6 8d 7c 63 b3 dd 39 7c 56 ff 00 3a fc 51 c7 c9 c2 fe ad bf d4 7a 5c 94 9e 2a db fa 5d 59 5c ae b5 bb 96 94 8d 4f 3c 57 81 6e 3b 26 c9 da d6 a7 af 67 5b 38 4e af e2 43 e1 5a c0 fb 7e 61 c3 ca 19 e8 5b db d6 de 04 7f 69 Data Ascii: YnS'kS\|rh}pnBM%6A.uSJKL/wd$Nk3#tU^le{^XN6tYzjZ]k~f>zJc3I]YDfO{O_FrpU`\|c9\|V:Qz\*]Y\O<Wn;&g[8NCZ~a[i
2024-11-08 13:28:58 UTC	197	IN	Data Raw: d4 33 7f 57 4c ef ac bc ca fd 0f 36 8e 7d bd d7 f4 d9 33 bf 82 96 b5 2b d3 06 3c 1c 1e 9e 5a 3e df 93 38 f8 e2 d6 7d 3c fa 39 ab 0a f1 da c7 67 1f d3 e3 4e 5a fc d9 85 bd cf f4 af bc ea 71 90 eb ed 9b 3d 1e 3a d7 8f db 5d 5b a4 9e 43 e6 e4 b3 d5 fc 0f 53 d9 7b 7b f2 71 5e 8d 46 ee af c8 67 e5 35 3e eb 9e f6 e4 8a fa 53 4b 3d 74 3c d5 c5 6b da 2a 9d 99 ee df 8f 8e 29 7b 4d de d8 c6 98 39 b9 79 2d 3b 6b 1c 6b fc ba fd e5 6b 3e d1 cd 5f 65 b3 3c b6 54 f0 59 66 8a f5 e3 ff 00 8a bf f9 5b 5f b8 6b 81 fc d6 f4 af ea b3 fb 36 56 da d2 bb a3 72 fe ab 7a 6b f0 fd cc 2e 49 db 9e d6 77 9b 5d bb Data Ascii: 3WL6}3+<Z>8}<9gNZq=:][CS{{q^Fg5>SK=t<k*){M9y-;kkk>_e<TYf[_k6Vrzk.Iw]
2024-11-08 13:28:58 UTC	16384	IN	Data Raw: 25 f7 7f 03 9e 2c 9e eb 2d 7f 23 b6 2f cc b7 72 56 cb 8b a6 c5 f8 b5 a9 d2 b8 1c 6e a3 5c 95 f0 d5 79 a2 a7 17 f8 79 fc 7c 69 2c 69 a9 d7 2b 6c 78 0f 92 a9 4a 5e 44 3c e0 8e 7e bb 63 ee 35 a2 f1 35 f6 5f bb cc c7 9b e7 4f fa 11 b7 b2 f4 d1 be a1 96 dc 89 51 5a fd f0 bc 4e 6a 38 ac bc 22 f9 6c ee e1 98 d9 ce 3a 01 a7 1e bb 99 1c 9c 82 df 08 e7 73 77 0b 2c 09 cd dc 2d 4d 79 78 39 38 7f e4 ab af 89 ea 7b 6f 6c b8 73 6c d9 fe 1f cc ef a3 9c 3c a0 3e 5c 24 f6 bd c7 b1 e3 e4 73 c7 e8 7d ba 7f 23 cc e6 f6 bc 9c 2b 75 97 a7 ba 0a c5 5d ac 6a bb 10 d5 5e 9e 9f c8 86 d9 af 0f 0d f9 dc 51 6e 68 a3 27 56 85 93 7e 7f 6d 7e 06 95 d4 4f 8c 98 00 d5 da 35 5e e2 eb a9 9c 02 03 a9 7b a9 c5 91 a2 e5 9e a7 0b 58 92 66 08 3d 3d 7a 86 d9 3c e5 c8 d1 a2 e6 60 76 ec 31 bf 1c 13 Data Ascii: %,-#/rVn\yy\|i,i+lxJ^D<~c55_OQZNj8"l:sw,-Myx98{olsl<>\$s}#+u]j^Qnh'V~m~O5^{Xf==z<`v1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49738	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:58 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-08 13:28:58 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=11835 Date: Fri, 08 Nov 2024 13:28:58 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49739	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:28:59 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-08 13:29:00 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=11843 Date: Fri, 08 Nov 2024 13:28:59 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-08 13:29:00 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49740	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:29:03 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C4vuXkggBWFuftH&MD=P1xDs3ns HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-08 13:29:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2a9b2856-4c7a-4606-a9c1-bef446694809 MS-RequestId: 431a30d2-0573-4e42-8297-e24f0340d601 MS-CV: wb/wb45ToUqRk1Wn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 08 Nov 2024 13:29:02 GMT Connection: close Content-Length: 24490
2024-11-08 13:29:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-08 13:29:03 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49741	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:29:10 UTC	722	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=google&lp=en&try=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=1kKxToIYsRZDBy2H3zLT/VHGVb2SRzcdREUBn1BahAMyVPkuYU5i3YKVoWfj19a8cDSOWcjiv1p6tQRZ4SAAiArkGsPaZAk690oaHtTXF3k4zdmqM6Id29hbxdC+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49742	54.161.165.135	443	6928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:29:10 UTC	718	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4zMzcxOjEzNTk2/gCVdrxCug0HP4HxHokZCk3cF0JvafI.XzHUADwopgIGs.rSMguUhFI8U9JQHbcRNYKMGS0RsPlbanESfOqNAyHGm0htzLfhZ9Q!!/?button=ok&lp=en&try=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=Ez/h3FNMbocgxTkuRvFH3IditCvqQ3h6YLp3NtEnJ8YnD3m5vsJBYqahyI3bQRJ6ITpr+Ioeza1dAKE6RI2K+41dOkvZs4GzG2qoT6vZreFfK/AjBuuA5johhCqk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49743	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 13:29:40 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C4vuXkggBWFuftH&MD=P1xDs3ns HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-08 13:29:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 007d3623-1d44-43e3-bdfb-f641590c1304 MS-RequestId: 4624d0ae-d845-4812-8219-366fd78ea3c2 MS-CV: A8FRqU5/JkeNY+xw.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 08 Nov 2024 13:29:39 GMT Connection: close Content-Length: 30005
2024-11-08 13:29:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-08 13:29:41 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	08:28:50
Start date:	08/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\securedoc_20241104T081116.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:28:51
Start date:	08/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1856,i,12630501653004195865,3579003092620535402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: securedoc_20241104T081116.html	HTTP Parser: Subrogation <subrogation_svc@optum.com>
Source: securedoc_20241104T081116.html	HTTP Parser: Secure Message from subrogation_svc@optum.com
Source: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html	HTTP Parser: {'name':null,'msgID':'\|1__a74d4cff00000192f784015a956f8f48082d051c@mail10688.corpmailsvcs.com','keysize':24,'flags':3073,'rid':'ImxmcmFuY29AaGFpZ3JvdXAuY29tIiA8bGZyYW5jb0BoYWlncm91cC5jb20+','algnames':{'encryption':{'data':'AES'}},'algparams':{'encryption':{'data':{'IV':'KcAt6m7ewViKVN03X+bJAA=='}}},'keyserverhost':'res.cisco.com:443','securereplyhost':'res.cisco.com:443','openerhost':'res.cisco.com:443','toc':[['Body-1730729476447.txt',1,'','',13,[0,16417],'Body-1730729476447.txt','ISO-8859-1'],['attachment2024-11-04-09.11.10.pdf',2,'','attachment2024-11-04-09.11.10.pdf',5,[16417,66199],'attachment2024-11-04-09.11.10.pdf','ISO-8859-1'],['MessageBar.html',4,'','',1,[82616,33405],'MessageBar.html','ISO-8859-1']],'salt':'DTJqJGnNKxiWH++/QjzuDWHX1jc=','data':['','','']}
Source: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html	HTTP Parser: lfranco@haigroup.com

Source: securedoc_20241104T081116.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20241104T081116.html	HTTP Parser: No favicon

Source: securedoc_20241104T081116.html	HTTP Parser: document.write
Source: securedoc_20241104T081116.html	HTTP Parser: location.href
Source: securedoc_20241104T081116.html	HTTP Parser: .location
Source: securedoc_20241104T081116.html	HTTP Parser: .location

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report securedoc_20241104T081116.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Static File Info

Windows Analysis Report
securedoc_20241104T081116.html