Edit tour

Windows Analysis Report
https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOG

Overview

General Information

Sample URL:	https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNz
Analysis ID:	1555190
Infos:

Detection

KnowBe4

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected KnowBe4 simulated phishing

AI detected suspicious URL

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,6779728348533419189,3921659482374428394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_77	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:17:28.273029+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.16	49739	TCP
2024-11-13T15:18:06.234919+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.16	49745	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906

Avira URL Cloud: detection malicious, Label: malware

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_77, type: DROPPED

Source: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49745 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49739
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49745

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906 HTTP/1.1Host: employeeportal.net-login.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /helpimg/landing_pages/css/dd.css HTTP/1.1Host: s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H2v4H2zSPDzDOkT&MD=5yr69fTA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H2v4H2zSPDzDOkT&MD=5yr69fTA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: employeeportal.net-login.com
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 14:17:23 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 069009b2-8d50-44d0-bb4f-0d950cd165f6X-Runtime: 0.010544Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 14:17:23 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: f0d6390f-fb72-4506-ad49-313c98212c33X-Runtime: 0.021151Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 14:17:24 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: a40dde32-9312-4e26-9f01-32bcc0c12fe2X-Runtime: 0.101629Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 14:17:24 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 030b9743-e294-460f-a45d-643ba174d568X-Runtime: 0.116983Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 14:17:25 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 88f94958-e9f7-49e6-8d29-4bf868df111fX-Runtime: 0.011508Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Source: chromecache_74.1.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_77.1.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_77.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_68.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_74.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_77.1.dr	String found in binary or memory: https://i.imgur.com/QRF01zv.png
Source: chromecache_77.1.dr	String found in binary or memory: https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Source: chromecache_69.1.dr	String found in binary or memory: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlh

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49745 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@18/47@20/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,6779728348533419189,3921659482374428394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,6779728348533419189,3921659482374428394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected suspicious URL

Source: Email	JoeBoxAI: AI detected Brand spoofing attempt in URL: URL: https://employeeportal.net-login.com
Source: Email	JoeBoxAI: AI detected Typosquatting in URL: URL: https://employeeportal.net-login.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906	100%	Avira URL Cloud	malware

Name	IP	Active	Malicious	Reputation
cdn2.hubspot.net	104.18.90.62	true	false	high
s3.amazonaws.com	16.15.192.138	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	172.217.18.4	true	false	high
secured-login.net	54.161.127.194	true	false	high
landing.training.knowbe4.com	44.221.189.90	true	false	high
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	high
employeeportal.net-login.com	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://secured-login.net/assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js	false	high
https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09	false	high
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css	false	high
https://secured-login.net/packs/js/vendor-69f70dd3792dc7287ac8.js	false	high
https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css	false	high
https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906	false	high
https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	high
https://secured-login.net/favicon.ico	false	high
https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js	false	high
https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	high
https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css	false	high
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false	high
https://i.imgur.com/QRF01zv.png	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://getbootstrap.com)	chromecache_74.1.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_74.1.dr	false	high
https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlh	chromecache_69.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.88.62	unknown	United States	13335	CLOUDFLARENETUS	false
54.161.127.194	secured-login.net	United States	14618	AMAZON-AESUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
104.18.90.62	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
16.15.192.138	s3.amazonaws.com	United States	unknown	unknown	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
44.221.189.90	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555190
Start date and time:	2024-11-13 15:16:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@18/47@20/10

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 172.217.18.14, 74.125.71.84, 34.104.35.123, 142.250.185.170, 142.250.186.163, 142.250.185.78
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, fonts.gstatic.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://employeeportal.net-login.com
URL: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMi Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "You clicked on a simulated phishing test!", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://secured-login.net
URL: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMi Model: claude-3-haiku-20240307	```json { "brands": [ "KnowBe4" ] }
	```json { "brands": [ "KnowBe4" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 13:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9781724867486306
Encrypted:	false
SSDEEP:	48:8adjTL7nH3idAKZdA1FehwiZUklqehHy+3:8eLRoy
MD5:	C34DE93F12A0A8DDB3528B52641C39E8
SHA1:	C75C0D126A37D4BB821002A6520B5BCEB831D5BC
SHA-256:	D6EE9A04BF253C8A662306AF254F5BEB89447E9B3D7B665B870D13212AE5B8DF
SHA-512:	4090D578C09228E6E33245091FD5889884A9124CAB51D19868867C5BEB7428FF26676D7D735D6D57794266785B889AA9E4508A17690D28248BAAC1FBA5D460F4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....y...5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmYr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 13:17:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9938084198982184
Encrypted:	false
SSDEEP:	48:8VLdjTL7nH3idAKZdA1seh/iZUkAQkqehYy+2:8VNLH9Qdy
MD5:	9A91B7D1537573A174B89FDDC89999A6
SHA1:	4F543EEB2FBB5D7EA09A58CD039EDBCB40591AA2
SHA-256:	A334D6396D3AD9E60A9DC1837E03D6FBD0489F1D0F9F73E95323AC739CABECE7
SHA-512:	C2F163D4D77B450C45754B3F5F3C03E91D85E73C759F23B7A3C6DFA881A26FB034AB6B9523CE150F1BDC7435D043E33BC7B6B5B863A6EF4AE1EFA34F6522FA9F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmYr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.004834070284892
Encrypted:	false
SSDEEP:	48:8gdjTL7AH3idAKZdA14meh7sFiZUkmgqeh7s2y+BX:8wLKnky
MD5:	D9CF4DD901DA4E5D3D4A0CB5EF774864
SHA1:	40D2C62E60715016D1197B743BA4E9D0D1763189
SHA-256:	33CDE5F564F8FCDFDA39B88348390B6D886E18341A2A66DE9F7D3C38D65AE880
SHA-512:	0506030942915930326427AF60338AAA878816C6AC50C33C03B0B6DB785C8F0A4866635A4A1DCAFECE93F32049FED355C274EBC0874C9B80494B49033CCE82E3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 13:17:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9942312526431696
Encrypted:	false
SSDEEP:	48:8mdjTL7nH3idAKZdA1TehDiZUkwqehcy+R:8iL0uy
MD5:	7D8979772D18EEE91398A42FF12B165F
SHA1:	93AC0FE8D115BBF9B4232ED52F9E92F2A1631A99
SHA-256:	9A8F21A7C9ADD86FBEAEFD33B4CB2AD719D34616BF0546300C2351037B127755
SHA-512:	FA6012C9F5BE0367B4E82A35FE593036BAB30C008A306E80BD645C3ABF5B6C1F748F7F3356309061514FE1AAC88138CAF0E9EB415DE7CABF653B8D33958FF898
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....?\|..5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmYr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 13:17:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981595330333061
Encrypted:	false
SSDEEP:	48:80djTL7nH3idAKZdA1dehBiZUk1W1qehyy+C:8ML09Sy
MD5:	4902A9D90C9AAB623EDC7C2213E18642
SHA1:	62E366F7B552D4FD93A76C134C976DABA83EFD61
SHA-256:	E9889C74AAEC60CD93148F8731262DF008C10E78E48A974A8D52F3F1F71419A0
SHA-512:	9A4DBD470EA56C15BED6121E76862EB95B00CCFC3A70096DCA4B39016D26FD34613252000FE54DF35E102ACE8E40012006B551A9FEDAC3D74B20CE700FA8C433
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....9_...5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmYr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 13:17:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.989355121797498
Encrypted:	false
SSDEEP:	48:86djTL7nH3idAKZdA1duTeehOuTbbiZUk5OjqehOuTbky+yT+:8+LGTfTbxWOvTbky7T
MD5:	90B71C2C37DB16B4B5D7ABB4CB5D1E6C
SHA1:	53092C3CCB0367DF0A9D9CA4A60B7FBCA9D0DE30
SHA-256:	2C2C09169A05EA58DFE9EE6E78ED69678EC36660EC9BFA3D849C225201C6C16E
SHA-512:	BB366D10FDF24F6983972371D775343EAFE271F142B5C1CFAB3DA766E4741D000FEDA2E5795FB22285DEF5E4907AC4C9D34EB84953CBE8D12BF1D929B6AF61A5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......r..5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY(r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY(r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY(r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmYr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2368
Entropy (8bit):	7.857782123483033
Encrypted:	false
SSDEEP:	48:eN+jd/MwX0F4lR7ZlqMmlNl08Q0+mNUjxulVE2Uh9wg0n:Njd/M62KJZVmlDJQ0+mGxykh9wg0
MD5:	402214A564EAB22101571DF8C6E30B79
SHA1:	D5E452981A5C325383F92BFB964BA28ECEA6FFA6
SHA-256:	8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
SHA-512:	D7FD2C24B182ACEA57713FB9EFD19371802B1AE748F7B01FA82D822A86F70267D94C5105FB6BD1967BCDBC1FC43DE484F2B647DFD1EC729531BD4E89814CA42C
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Preview:	RIFF8...WEBPVP8L,.../.@...0..M._.w..1..WVaU.W,K..m..}.J.]...=..:].Dz.=....~......M.O.PneX(.......3.4..........;.f;..I2..L.....$[J....wA.a....,....@.$.].m.m.m..l.N.mcO..l.-....[t...5....-.%.....A.f ..D.`._@+.q.?.....8...(..-.^.i.,...]f..a...i....Tw.p..B....."...J'......O..J9..L.%P...{..H..JP.jP-.Cu...P{jFU..%.P[.%B....3....X.'PO.Y.....bE....P........?J.U...P!......O5.M..rT./LQ"JI..uCR...BR...S...-U.].YR...(..R..t4.....J...c..J1)\|....) ^.C....=`.bR..~+.h.5.T......".....GS.u..\|.._Dj..".D....,.7....<1.PU.t...X}.[8H1;T!+....H...R..I.\..f..V..P.S..+...m..s.659FlS.I....Ph.).....GhV.v+...&......l...K.^Q.)...7....5.<....a..%.t....<.(.....;2.n....K...9.J.B....Lf...T..!a..(....0H....E1......Qn.+.j.....v.R6.1G..?B......~.....&R....F...2.....}.(m.....).....]..I.....~.e.Z.T..U..C.OE.[......Zq..F.hc.W..,E.\|.Bu..SQ;..`.a.......\|..?..}..COX4.....!{'P..J.8:..U...\..S.{8U1......J.P.N*._...9L......#<...v..n...M...8..##.r..]\..e\|.....D.t.@...

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9344, version 1.0
Category:	downloaded
Size (bytes):	9344
Entropy (8bit):	7.975595436620788
Encrypted:	false
SSDEEP:	192:iy1J4xqYLC2akqiC1YV/R582UeGFc/AUGlF0djsT7qWPcC/Cdv:D2J7h5bV/37WUFGT7lPcC/Cdv
MD5:	CBCA61F27F93FD71171FE8D314C66AB9
SHA1:	C46A51672FFFF100945F84C3EB87826B7844A1E2
SHA-256:	F9A9A7A4B9D40BCC3047928DFA60695D53E6AE1D6EE699EA70146E171322ACAD
SHA-512:	7F9E8520DFB64197CE233AF7671A5A5643AE116478C6E2F5F67FBD8A092117126ADF1E2EDDA13FF1C19D68AEA3D04288310A2109D7C81183330F2B8DAD0785D4
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVIGxA.woff2
Preview:	wOF2......$.......A`..$..........................L.. ....`?STAT^.t..\|.......t.Z..N..6.$.... ..x..h....B;%c[.08.@D..=.E...O...q2.0..i......v.p.0......Y. ..P)......N.C...K,.W!.Wutp..I.2...6.....Y..X...W..z.U.nq.j^;.8.zO..gw.d.^U?p.........7.. ....S..d......d./.-.7....$...V(V(\|.........c~........B[H.D(.$2.1<....N7..n.9k...D.@.(.(...H.D....qsQ."..O..{Oh..r.T.Iw..9I...rq.2.n....SW.O..\b5B.n..M.06.j..L.Sx?.........t.\|z}..V...G..J....x..Co].5HC..6p..,.2..&..}`.I.n......S}'....$..iV.[.....W......6...m.I'M...a......c...\|.a.FK.d.zW9xi'Y8v..lWi....T-..F\...^p.<.TT!wvQ.i0.0.f.\.A.. .Hq..J...=/.....\.]..Dq...:..+...W..]4uZ.._.l...e-..........k..."p....c......X..=.9..1.....2.......],.....R\|J......r.x./...pa...ef.......{..&.........=.5..>....5@...x.v..o.Io.L.t[Wu^.=..Z.r?xV..V..jV..`...+.2..8..P....[.r.....4.,Y....&.\|.W<..7..Y.s.=,2..A.i..je..P..`pV..!VW-...`.>YBRJY[...!rY5...l........Z.5_..B.....cP.....v1....(.5...[....n.....vlx=I.*1..9R....=..2..u\..p...iFD...

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Y/B:Y/B
MD5:	D8F4A1993546CC4B850CDE3599E27AEC
SHA1:	094B763B4CFCC0B05E5D040581CD513C3CA08067
SHA-256:	907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
SHA-512:	7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css
Preview:	not found

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	6193
Entropy (8bit):	5.401714743814202
Encrypted:	false
SSDEEP:	96:ZOEbaJJOEbaiDFZ8OEbaXkOEbahYOEbalOEba5y+aZjzBrWOEbafubqGIFuV4UOQ:aJKAXzhXm5qJ2bqGIwV4jlZYF
MD5:	F2D1D2937C3546E15C471236646AC74E
SHA1:	DD8D90F6D4AC8D72C718C10424788612689D89DB
SHA-256:	719D2FC548145FA8D8361205F6FCB49EEFC54C71FBB18E6320A60A263F40637A
SHA-512:	7B400281407249F805AB4695E0B7D3CDF4F7F5F776F9F7E60872D5208B7324DADDDAD79D76AC9991C74563520FB6BFF3A6343C8C10591C9EB5682733592668A4
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) for

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (398)
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	5.826864343763866
Encrypted:	false
SSDEEP:	12:3R+xnAN7wITx9T7N3h7Uxclrkkj73c4AEdeIQL:3Ekwkb3GOdT3cNEkj
MD5:	BDF756B8DFAE0B5C05B3B485134E0E27
SHA1:	94A4FBE841E1799330FE4C86A3FEE9FB53766F60
SHA-256:	F7C8A8E5DCFFA9C4F44F8631D3095230A60AF314349D019C253350E104154E54
SHA-512:	94732F0E291D6D2DF1126407B1F02A11DAB98F0986ABF9531B04CBD106D0270628ACF647D984FEDFE07839C3427AD54B82ECE4ECBD0FA7E2B02A44FCCA5BE2A3
Malicious:	false
Reputation:	low
URL:	https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906
Preview:	<html>. <head>. <script>window.location.href = 'https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 10180, version 1.0
Category:	downloaded
Size (bytes):	10180
Entropy (8bit):	7.978606996128046
Encrypted:	false
SSDEEP:	192:TjKCG1yMl5z0LihNuJ/FDGVhh+wixFbjXRvtZ0j99NpI3JWKUOVKB:nKhyMvzOibuVih+7tXBC99NHIKB
MD5:	31C3253C6146D2A15CEDFCFBC975EF7D
SHA1:	11F185BE446D870DDBAA7BFFF3382E428DDDF853
SHA-256:	37C813E5C95A107D3992C300F1B03A488E70570166EB45687FEDAB8D1F3B6C7B
SHA-512:	3F706CA90A78C6970234F1A8EE67C650B8AB264006B77477CAF6B581AF13F0D9B4E64532E47CE9E557518E0D6259DE691CEB6B1B948D560A16E5CB9FEB2B7E16
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVIGxA.woff2
Preview:	wOF2......'.......Il..'^..............................j.`?STAT^.....\|.......`.D..j..6.$..>. ..x.......A........(....i....\| e.L...E.M.w.<3..my.[S.0..]wJ...JL.i...........J.co.a1....BX}..L..k..}..>.../...;k7.a9u......1..IL....7o._..'j..H.E_,..G:...X>..f....6..0..#...AiA.L.B..F..0.#'....U..........{g.._...9.....Z.f.^.....5. ..a...\.,y2.&.m..5....<.O^.......r..LW...%.x_....J~ ..... .U...(U.i.Y..'.VK.j...'..9....(. .L....n@._k.....V2...7e...I.t..).....\...[.MH.......m..,..f..\..K..K.T`N..^g.....P....(............@.....E...s..hB.]a..8.3.8..5A,./.r ..>..yt....+..NA..R.....u..;.....=,X....\.f-.._..........lO...U.;.n..D. X.......E..a@D+...`a.A..@....... s\|[.3.@.....c..v.c....}.....Ra.Y.....?x.'..<.MI.BO......>%..x.....F.}.f.H..&$.H....M..cp<.Rd..eFY1e{..A.H>.D,.:.....'%...Oy....?@6....$......"..K5.........!..u.F.t.YD.].c.~Y..8..3n..S.J?.....Rz.0.M^..@........^...`"t.)@.>.i.W..g)!..d.;.=At.J5P6..Rx.........]7.?..i....=k.....%\^.X?(G.....88...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Y/B:Y/B
MD5:	D8F4A1993546CC4B850CDE3599E27AEC
SHA1:	094B763B4CFCC0B05E5D040581CD513C3CA08067
SHA-256:	907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
SHA-512:	7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
Preview:	not found

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17576, version 1.0
Category:	downloaded
Size (bytes):	17576
Entropy (8bit):	7.986135354736866
Encrypted:	false
SSDEEP:	384:9FlzBIAFMur/ziLBGLlbxN8j/70j6vmoXB:bIEbXiNhP0+mox
MD5:	EFB3F28447C9EF35FD5882FB763B37C3
SHA1:	158DDD8C0348DEFA3192F26DA60A746727F4A8A3
SHA-256:	6D4370B59E36AC955C8B97F12FD5E86F7D3E80285D6AF2BFF0DAFA8E122D3C3B
SHA-512:	C0521D7C7BE4F635F70F0F466BC7A179C647C43C5AB400C8E490466BDDDE7175809B594C3D7B1A2F2AE9841CDE2F9AABFB8A967618FFB2CC7456A9B3231E0CDD
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVIGxA.woff2
Preview:	wOF2......D.......}...D=.........................N.......`?STAT^.....\|........<.....T..6.$..$. ..x........n'...........#.`.........9IE.LZLJ....Cf.`....0....I.Y\|...`.{j.K....EW..zG=xA..P.6....6..n.+V....+..J.. ........ ..6~.f.....o.........}.H?..1.j^.^..?...z^.J.X.6.._...I....."..5..3<Bc.......oI.av}.s.{>.. z.c...........&@-w.S..P_.~..f..~..'+.....m..s...`D..(.....`.b...U.Vcn:..5.\.j.......v.. .I..K..mS#.=...w.%[.}I..>.O..'.k.k..}Gh...v..eB.....E..'"!.I...I.D...jo2.X.U.....OC.......H......8..[.... @..M.....=U/...E<.BH.I}h.j..H'..R.&O...i...kE%.....oTns.U..9.7...._....fL8....Um.@...g.[...%...0vU_.<.........Mp.."R.l.A....t..&..... X@.P..o..wI..4...c.........n.~9....U.`....gj...pu.... ..'.B,..C.\T!.v.......x.b...(0(....J......2...$...'..+..s.u]..m.E]....QS.......}.Z=.$.....q.0..2.kKK.....[.\|kg.....y....`DZGC.....A8....'.....,.Iy...h.K#........)r.P)~...!o.2t........._AAvQ~.!.@hy;c.-....p.'...:4...5......!..yS4A..........yD...T..A.!......dK

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 7728, version 1.0
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	7.973684421983582
Encrypted:	false
SSDEEP:	192:RqbUht1WYnRpoFA36C6PZgm9hGwy+ymZMcVB:Q4h3WIoKqxPZp9hDy8ZMcVB
MD5:	80210D1FF4DE56C6704607F3831E8F6C
SHA1:	32FB4E1E177D5DE97AAD6E0D57100755D8DD2CFD
SHA-256:	F515A6F8BAE422286936B110653FB8EE0F58FE32D61390EE5DE77029BE23EFD6
SHA-512:	E24520E29F2073F03A0FF1E72EB632CCFB6FC1451BCB0735671EAE03CAFFB1CA6731050318F43544CC99AC7127015664464A0DEF587058535F9F7F743F166713
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVIGxA.woff2
Preview:	wOF2.......0......:..............................V..\..f.`?STAT^..4..\|............$..6.$..D. ..x..,.....4%...<...}G.H..T.0...L.F...._[e.'.B"...).J...55. ).M.u..J}bV.,.q.#.I.C.(O....0.J....$...c...}.E'/.n.k...A..#m..d...9{.fV...!..[qj.,5...P..u..p.T.N\...{...d...f+.pt...+..y.A...Z.3&..H.VuX...^..R9.q@...s...]...c.pMS .GH...z..e?.n.....Z...V........,.8..t......p....X..i.w.....j.....2]sP.%Z.....XQU.....7..3.u.]...+.I.....!......c.ey...b_...M.....aXp: ..$.....^........8+..Z.~.!..BXR..E#WbC....1..P;@...e...c....&<0.(..2..,.e.....n..C.`....n,7\.DV.B..._.=...Ko}..O......A.......@C.}I}.....z.8._J....5.t....&.$....a.PS.}.....^....$..@...;.<.'.F.t.....\........~.w."..w...7...8..-r...r.Z.`.K..Y.R8.#R.....Ijz.vc.Xk....g..E.n...Q.x........>....gH..t...:Z..v..+.z.^H..A.@.....\|W9.}+.Ury.......Q,@...!.. .'kN..X..RA.oHWF$O...<..r.....\|N..!.fT...F.....~.....1..(jD...e..i..!....cD.h.Y.....A....r.dfD5.P..x...g.../@..._g\.h....pH..~..e..../MR.....).]

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65371)
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8572, version 1.0
Category:	downloaded
Size (bytes):	8572
Entropy (8bit):	7.968224802101464
Encrypted:	false
SSDEEP:	192:7kVuVBCnQlLJQwaKzxipCMvtCYuZQ9lABAbdsPyY5pfFqC:7+uVKI9OOMnuZQIBcb0Th
MD5:	776FDC253D54124DD63F274BF5EA35F0
SHA1:	7761DAC9A7FBB2814989092003506BA594C6EE45
SHA-256:	0B81CC8358F236821ADA286C94726C7FEBC9CAD8BD4F59FB39C515956B644E99
SHA-512:	4689A0D6723243E796D5DC1B031F5E1E8CE1D038921F1CC612169F179147DFC1B74CCA87CD7E2C8BEB38D9A8ED99F42FF369BDCB2FA9EA80B1BC00CC36CAEB10
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVIGxA.woff2
Preview:	wOF2......!\|......G@..!..........................j..l..&.`?STAT^..8..\|.......$."..&..6.$..H. ..x..T.....A...........ZuVQ.......Kn..`...%.$T6I....\G.Q.X9uK8.ct?..........P.\5..;.I{...r}E......?.E7....8A..R.k."....^.4..^..j?.2h..bg.8.5.....7;..I..JH..j...4B!jI_v....=..S.."+eQX....h...X11........t.....rw-.2..X..J..z@.8@.a.........+JCV..df.p.4..B.U ....]..n. ...u..+..d.C.P8.,.8F.P.L.bL...=..=...5..O..T.<..I...].....O...`.Q.9....WT...r.>.b...3U..`.&.. .<..X-.'.s-....E;?.T."c.%4....ue.>...0A+`.X/.y..T.......O`...sHEE8E>...f...........%.p.t ....RrH.Sy!..)...Z....E...w^....V"..z..=O....B.........&XV..{..B.....>...=........]..Z.._..c.I.....U.^..j...B..A....Z.......T..N.F822.....G......h.(.`'E1..;..)...q.....%........... uK......@...7..DEd....N.l..,.,....oI...z... .eq.t:.HG/;4..3.F+...A........WFNm..._.\|-! Y.Utv.},......,..G.O.#...w.G..?.C..5_.)O{.G<.^.u..b..p,...P.MR.... ./C.)...s..{.,.}..z.....L..A...~..J..W.)}....r/u..:Q..aM......W...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15368, version 1.0
Category:	downloaded
Size (bytes):	15368
Entropy (8bit):	7.986184968554377
Encrypted:	false
SSDEEP:	384:nTJg6Q5K8YWSW9moijiyOckZiSFQsiEVxU1L:nTJH0K7iUoaOfZigxBe
MD5:	BE7B70AB1265B1047BD93422397C655E
SHA1:	E10BBC7D8529AE3E64D8B08C9F7CD55C98F83D60
SHA-256:	B452C0F212E8BF33965905032F5BA1FAE29CD6F9539DCBC673704E66CE943B2B
SHA-512:	A9A913559EFE29685B7C12456326C3F8C7053D639B849261108A69348EEA02C617BA923561C1CDBE36082B2CEC1C0ADCC22511389791DB328ABC99A57F011F5A
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVIGxA.woff2
Preview:	wOF2......<.......x0..;...........................>..\..\|.`?STAT^..J..\|........\.i.....6.$..,. ..x........l..]{N..#R.-...0.Q.%.T.......Q...U...L..R.)KFQ0.)p..L%d......!3..;..v8..9.........A..'..........v5D80.......&...M...}....g.6.'N..M.y......gk....B.{....}.....q>j...].......o!..AL....b.....f......F..FE,@.Q..cF..6n....g.....Ey..O....^.3...P.)U...AH.y..Z...'%.?8/.......T.S............S..8.w 7..>`.5...........0#.._..(_.P.W....s=......i+i.....`Dn.)k.$.....G...]..=.....w.....n..\|."..4.g.....H.2M..P.(oRg..l~G..dJ.<.U..q..u..4%......<...`.-$.....$[..".....TuM.V..7.[.{.l.. ,....>.&...P9].....S.lg.B.tK..B..\..z..RS.i....3.D."u..Bz..T.E^R.=m...U.\.X...IZ....n]....]...}i.......K.kL.D.6.".5..V..u.....?...\|.a.=.;..0..cL..HpU..t.p)1.k.....^G..:.u.q(E.Q5.o.k.1.0..R....c..`.....A..3.g.0&....$....\| .....C.H....(..F.. .::.......&.$Z4...$N....$.<.%.A6..y.1.?.......w...}....~$....V..Q......x..A'......+...I<n. .......t@...w$ ...@...9..H.h..B...Q

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2164)
Category:	downloaded
Size (bytes):	107493
Entropy (8bit):	6.021808833416954
Encrypted:	false
SSDEEP:	1536:roXPSJWBXtcydjm9aU5JqjtF5FsuqJ0+GutFIDFzFv7aaXVVoi7fyPw+uzukA13N:8/f9yydjrU5m1FBW
MD5:	A513EA5F7AA6CD677A8613C7D1662A82
SHA1:	4A8605FDDFC9264DF8A7CB7C6F9D9572098C71D5
SHA-256:	CFB2F5DCA84A69014F40514E38519920777F9B4B6CCC415DEC3E82B4A221D7E2
SHA-512:	E17CD7ED919DC5B643B9FAF920FC33854C7E10DAF2C5FE7DC9DF81A889286CE3B5100D309F31CDD33165C7F4EDDEFF6336E529CE8FD904C5E7E26D6D41F9EF28
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />.. </head>. .<meta name="viewport" content="width=device-width, initial-scale=1.0" charset="UTF-8">.<link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.988119248989337
Encrypted:	false
SSDEEP:	384:1stcBfAVaR8i6XzMsb4fcjakBudFyBqrgeU0hipgwfqj09nOt/a:1k0F6Xz1bFjaPbyBqr9hIgkM3Fa
MD5:	8655D20BBCC8CDBFAB17B6BE6CF55DF3
SHA1:	90EDBFA9A7DABB185487B4774076F82EB6412270
SHA-256:	E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
SHA-512:	47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Preview:	wOF2......H...........H..........................\|.....h.`?STAT^..0..\|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I..h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J\|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=\|......uOGA{.7.....h....q.d.4$.x<.....^0\|...@....@Q[RC.0....b....'...RID

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	7.843362903299294
Encrypted:	false
SSDEEP:	48:1E3hTvNbvJkGGv0nnr5I2rk5boP0gD6EaTMN:1ERb+cr5Z1P0gD6/a
MD5:	29D583007FCD677AA31CA849478BC17A
SHA1:	F354E323218A450060852C344927C3E79D8E7B66
SHA-256:	120EE096F38C1E21083054C15F0F8CFBB02B6740A01D98068E3BE9581E83D453
SHA-512:	4AFC2641D96D1C372D091FD795D39C1AF12149B5EB30DA7BEE6FBFEA0650841067B7D259473BF65706CDD42D1EDF1CC5673B5F5556D1E91F8AE32976490A7E4D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...<...<.....:..r...IIDATh..{.VE.....Y.E.......Uv.B....=. {....ee....G.%....H/).UR1[.G...d...._m......~:.\|.13..~.e.;s...;g......&g.@..w.G..K......{.u+..^...k.....s+...e..R.z...."..............l.z......C.......V.#.}.5(..f5.N`.......e&3".x..g..w..C.......T\|...v"w..Q>-(/2.x.A.L..!....r..noB..g\|...\|.\....U.T...<3.N-...rU.bp%.<.CE........k....0C..\|.Sw~.g....!....uf+y.KG.O+Y.h&.....F.......sB...7.\|;.r\|..\o......;.$...i.wC.ICO.n.h....AJ.N.+.T).........)9..y..?.hs%.".B..k....#.S.....:..!o..Z...\|.w2....a..+y.e;..A...x.p+2G/!..1..jTr.S...S.....D.<.G.z.+2..E..>.Z6L.......e.2..R..3...~..%.C.!..f..s.'.;.M...5..k.1..L._B.vA_\|.c{......{.......d...Y.'Q.TS:.7.......\|...,.:..-...#.V.*NA..&...iO.....SEE.kW!.y.p.y.m..6b..@=.,.n..i,....q..W...w.f..bg.`\|......3.:.K.<..I.[....a..}..%_....{...~..j...)......n}m[...u...._....{....,.t.[ ..g.....&.v.j..2.r5.r5.B..jp..v-.j./.....c.s..$q@..z...oo..g?.z...%..gW.......}.6h....U....o.u.])]..@B);.o.V

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 11116, version 1.0
Category:	downloaded
Size (bytes):	11116
Entropy (8bit):	7.977966003020195
Encrypted:	false
SSDEEP:	192:c5J6FUS8z9yKW3C62e9A3+t4q965ElM9FxWuPpZ6LpjKQZtX9MRFTj1EHUgaflbN:c5J6FDS9yhyy9Dt4265ElM9FxtPT69H6
MD5:	7E05F5267BBA1AA9FB260096F923BDB7
SHA1:	44E5FE17DC41EB94BB2FE85D77C0904AC766325D
SHA-256:	21E75944D3F77408D1F5F2FAB67C89C7FC43F4A80A3B8E4DCF38185F9D9F46E6
SHA-512:	E3442FC98D171DFE08614751267C2023BF6DE2A2E42BE7B7CB54E15DDBE028534D193D93B086A75549432B2818B0EC1824D2BDBB848B00A9329F22C5DDDE619F
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2
Preview:	wOF2......+l......Q...+..........................>.....X.`?STAT^.."..\|.......(.%.....6.$..6. ..x..R.....Iu...8@.}.G"....~x5.`....J.......t.Tm.....".......e..........C..9.9..R...F?..x.i...._.x.<%2R...d...y........{.om......Oe..u..3Z.....x...#4.I..ES...8=........,...Y.^ ...2.=@...a...a..0.P..#w3.'F...b.,l.........1..".......IB.....b.......e......X....?D.[...iK.....$.F.......nM......4..@M......u../.#.C.X.TC3z.n.Wx...........=...@...t.I..UR....6.v...3...X.~i+..s..J.V.Y...g..Kun.IZ,....%O.u..3.(.+B~.)....M(6r.m......>x..p.MZL....P.Z>....@.*..M.0..5....@\.D.&..H. 2M...N..f.E.UM....B).).m.1.J......'.=D....Z.6.{.5..q......4.T.$:=...r....5..3s..zD[.i ......x.Mtq.\|.#G......._.9P=}..PG.a......l8V.m...P.#..5..6R....`.<K}k.a..a....D.6..A.l...e.F...Z..0...7.0...^.....n`p..o.`.........4F.....H.1.).lh.....u..3WB4.$.............E......Z.{..{.[]...E.m.{.V^kZ..J.y?.w.m......o.k.j<.}...g. 7...-3}C?....<..\..ld9s..p...p..3%....>...F;...6..h.Z..GKh>...k.S..V....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	7.902919939139106
Encrypted:	false
SSDEEP:	48:vnJJCJaqcfDoxU8qAg6opvwr+FYc1lWO1pPGDfMexqwFYRFlIe9BhGtAHIWVRs:vnJJ8CESXp66vwPuGDfMexqwALvhTFTs
MD5:	E154B58FD2CD3F1F2E2C6C810BB1E65B
SHA1:	CAEF301E8550A910909ECE9471669DA0C32EA6F0
SHA-256:	E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
SHA-512:	464EC940E824EAB8B7F83EB40852DD3019E84BE7B1A0F75AF288656605426B2EE386FA7FF102E0144AA065F053E88E8356E7C185B4DC393CC4D8EB0ADC877312
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......&........l....IDATx...{h.U..q...Ms"e.ej,..M.,](&..B...)G.F...2.22oY......L.%...iF......L.e.dsn.Oo.@..?...........y...s...=...D-jQ.D..&C1..Mr_9.n...p.8.W...x....8d..Nl.b..=h...b<.`...W .GI...S.Q....l..b ....G.F2.+ ...C..u...2j.?Z.).....!-...d)2]..d.;p.,.t@>F>.3}9....... ......v@.>4.= ..B.5H..e.....5i.?NP....<.Y.LWx.a.>8..?.M.$S> .C...r...:.,...OLWx.a.v8.....c.....Z../...M........m.,..Rl..1.X.Y........j@.@.%.2l....YJR..?.....5 ..G.d.BF./.L\........,J..~...0]...,...q.7x....h}.m..#...."<...0q....8.9.`...e...EV...m..p.M}H.y...H..l.~...x..0...<.....d..Xh.1.~.Y.M`.].Q....:...8.....M1.'..~.h...g{..OD..f.Hc.g.(..)....,.y.w.\.....HO" /A.\..Z@...$...].,.<.G..WavB...q....\...H..<.t=d...-VWTC.I........jv...!....N@..0..M...."._B....%X.R.q.....W.'WAL..'m].+.j.pF.8,...V.Jc..@....E...\|L...=.[..2&^......y....X..1..(.F..,..f.5..dT...b>..q>.;..d....:.O..)N. ..\.......s..R...UcD..d;ct.,+<.c;.W...!K.$..... .g.../.,5.T..g7l.,...p. .8.]...C_4...?

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4524
Entropy (8bit):	5.108931295370594
Encrypted:	false
SSDEEP:	96:AG5XS7vBkRVkhmRaM44/HLPRaByA+zBRNI:AG5XABkAhmRaM44/H1CyrBRNI
MD5:	DD05B711E15EF201B07E20CB5C87F5D8
SHA1:	41B818B243140D90DA4CA917D454335B603A6BDA
SHA-256:	617F793D125F780AB7BB7C9E92AB427D9E757083E7368E241E8E8FA69F013E4F
SHA-512:	243C149BB8AAF5376EEBAC49833A59F75BA26BEC098AFD8A167D12BDACD3E80D98EE1DA1D82915CC7E4C7FAC747FBFF5D2D687D97F20BDF5C81D67CFA0620F39
Malicious:	false
Reputation:	low
URL:	https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Preview:	.borderRadius{-moz-border-radius:5px; border-radius:5px; }...borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}...borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.....ddcommon {position:relative;display:-moz-inline-stack; zoom:1; display:inline-block; display:inline; cursor:default;}...ddcommon ul{padding:0;margin:0;}...ddcommon ul li{list-style-type:none;}...borderRadiusTp ul li:last-child{-moz-border-radius:0 0 5px 5px ; border-radius:0 0 5px 5px;border-bottom:0 none #c3c3c3; }...borderRadiusBtm ul li:first-child{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 0 0 ;border-bottom:1 solid #c3c3c3; }.....ddcommon .disabled img, .ddcommon .disabled span, .ddcommon.disabledAll{..opacity: .5; / standard: ff gt 1.5, opera, safari /..-ms-filter:"alpha(opacity=50)"; / ie 8 /..filter:alpha(opacity=50); / ie lt 7 /..-khtml-opacity:.5; / safari 1.x /..-moz-opacity:.5; / ff lt 1.5, netscape */..color:#999999;..}...ddcommo

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1666
Entropy (8bit):	7.843362903299294
Encrypted:	false
SSDEEP:	48:1E3hTvNbvJkGGv0nnr5I2rk5boP0gD6EaTMN:1ERb+cr5Z1P0gD6/a
MD5:	29D583007FCD677AA31CA849478BC17A
SHA1:	F354E323218A450060852C344927C3E79D8E7B66
SHA-256:	120EE096F38C1E21083054C15F0F8CFBB02B6740A01D98068E3BE9581E83D453
SHA-512:	4AFC2641D96D1C372D091FD795D39C1AF12149B5EB30DA7BEE6FBFEA0650841067B7D259473BF65706CDD42D1EDF1CC5673B5F5556D1E91F8AE32976490A7E4D
Malicious:	false
Reputation:	low
URL:	https://i.imgur.com/QRF01zv.png
Preview:	.PNG........IHDR...<...<.....:..r...IIDATh..{.VE.....Y.E.......Uv.B....=. {....ee....G.%....H/).UR1[.G...d...._m......~:.\|.13..~.e.;s...;g......&g.@..w.G..K......{.u+..^...k.....s+...e..R.z...."..............l.z......C.......V.#.}.5(..f5.N`.......e&3".x..g..w..C.......T\|...v"w..Q>-(/2.x.A.L..!....r..noB..g\|...\|.\....U.T...<3.N-...rU.bp%.<.CE........k....0C..\|.Sw~.g....!....uf+y.KG.O+Y.h&.....F.......sB...7.\|;.r\|..\o......;.$...i.wC.ICO.n.h....AJ.N.+.T).........)9..y..?.hs%.".B..k....#.S.....:..!o..Z...\|.w2....a..+y.e;..A...x.p+2G/!..1..jTr.S...S.....D.<.G.z.+2..E..>.Z6L.......e.2..R..3...~..%.C.!..f..s.'.;.M...5..k.1..L._B.vA_\|.c{......{.......d...Y.'Q.TS:.7.......\|...,.:..-...#.V.*NA..&...iO.....SEE.kW!.y.p.y.m..6b..@=.,.n..i,....q..W...w.f..bg.`\|......3.:.K.<..I.[....a..}..%_....{...~..j...)......n}m[...u...._....{....,.t.[ ..g.....&.v.j..2.r5.r5.B..jp..v-.j./.....c.s..$q@..z...oo..g?.z...%..gW.......}.6h....U....o.u.])]..@B);.o.V

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T15:17:28.273029+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.16	49739	TCP
2024-11-13T15:18:06.234919+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.16	49745	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 15:17:18.859038115 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.859124899 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:18.859220982 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.859417915 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.859466076 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:18.859535933 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.859739065 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.859771967 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:18.859988928 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:18.860008955 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.610958099 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:19.700968027 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.701468945 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.701534033 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.702610970 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.702708006 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.706665039 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.706928015 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.706984043 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.710628986 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.710900068 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.711517096 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.711595058 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.711708069 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.711735964 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.712845087 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.712941885 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.764273882 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.764283895 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.764308929 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.812356949 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.924302101 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:19.977866888 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.977946997 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:19.978090048 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.978827000 CET	49707	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:19.978848934 CET	443	49707	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:20.026076078 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026117086 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.026190042 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026439905 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026470900 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.026531935 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026647091 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026660919 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.026801109 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.026815891 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.527446985 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:20.865637064 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.866116047 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.866185904 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.869811058 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.869936943 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.870963097 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.871104956 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.871273994 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.871279955 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.871308088 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.871436119 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.871443033 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.874244928 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.874480009 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.874564886 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.874634981 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.923223019 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.923237085 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:20.923243046 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:20.971227884 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:21.730235100 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:22.672849894 CET	49689	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:22.723937988 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:22.723979950 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:22.724066019 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:22.724282026 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:22.724289894 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:22.905117035 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905142069 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905148983 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905178070 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905189991 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905200005 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905247927 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.905282021 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.905297041 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.905359983 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.906970978 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.906985044 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.907067060 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.907074928 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.907124996 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.907979965 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.908040047 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.921817064 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.928925037 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.928980112 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.929202080 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.932280064 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.932320118 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.932384014 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.932858944 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.932878971 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.933532000 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.933547020 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.933604002 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.933855057 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.933862925 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.933917046 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.934238911 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.934250116 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.935786963 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.935800076 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.936024904 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:22.936033964 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:22.942661047 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:22.942708015 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:22.942773104 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:22.943006039 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:22.943022966 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:22.944667101 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:22.944700956 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:22.944808006 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:22.945307970 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:22.945317984 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:22.945826054 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:22.945858955 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:22.945919037 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:22.946475983 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:22.946489096 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:22.946904898 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:22.946929932 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:22.946994066 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:22.947196007 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:22.947208881 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:22.967334986 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.023297071 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.023391008 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.023443937 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.023473978 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.023510933 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.023530006 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.024588108 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.024630070 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.024665117 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.024672031 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.024699926 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.024714947 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.027371883 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.027415991 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.027458906 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.027463913 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.027491093 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.027507067 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.110491991 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.110522985 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.110570908 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.110589027 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.110609055 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.110668898 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.111525059 CET	49711	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.111541986 CET	443	49711	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.111917019 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.111965895 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.112042904 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.112607002 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.112623930 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.140239954 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.140273094 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.140331984 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.140404940 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.140415907 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.140474081 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.140474081 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.140790939 CET	49710	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.140831947 CET	443	49710	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.560728073 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.561151028 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.561176062 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.562614918 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.562700987 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.563982010 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.564207077 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.564218044 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.564256907 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.567538977 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.571345091 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.571369886 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.572530031 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.572616100 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.572634935 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.575877905 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.576648951 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.576719999 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.576802015 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.576814890 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.604909897 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.605356932 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.605417967 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.605824947 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.606319904 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.606389046 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.606504917 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.606977940 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.607203960 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.607224941 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.608282089 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:23.608524084 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:23.608540058 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:23.610173941 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:23.610245943 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:23.610831976 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.610913038 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.611212969 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.611249924 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.611308098 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.611484051 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:23.611516953 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.611569881 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:23.611803055 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.611812115 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.615036011 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.615432024 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.615442991 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.615763903 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.616127968 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.616190910 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.616373062 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.627224922 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.636358976 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.636665106 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.636727095 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.637598991 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.637670040 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.637703896 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.638803959 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.638878107 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.638941050 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.639051914 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.639071941 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.646991968 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.647366047 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.647420883 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.647481918 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.648932934 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.649019003 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.649370909 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.649455070 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.649528980 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.649545908 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.659198046 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.659205914 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.659332991 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.659384012 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.659384966 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.659486055 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:23.659497023 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:23.691212893 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.693974972 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.701272964 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701414108 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701505899 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701575041 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.701596022 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701627016 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701673031 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.701719999 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701891899 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.701948881 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.701961994 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.702011108 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.702018976 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.707257032 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:23.746838093 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.747189045 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.747222900 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.749440908 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.749535084 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.750579119 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.750703096 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.750773907 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.755182981 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.755211115 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.783720016 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.784126043 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.784152985 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.785609007 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.785698891 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.786062002 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.786134958 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.786329985 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.786336899 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.790527105 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.790698051 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.791328907 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.791416883 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.791770935 CET	49717	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.791812897 CET	443	49717	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.802194118 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.802217007 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.802265882 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.817723989 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.817919970 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818006992 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818063974 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.818087101 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818439007 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818516970 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.818526983 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818553925 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818600893 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.818641901 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.818689108 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.819181919 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.819380999 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.819467068 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.819530010 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.819551945 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.819619894 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.819920063 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820102930 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820171118 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.820183039 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820261955 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820312023 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.820322037 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820874929 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.820934057 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.820945978 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.822871923 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.822957039 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.822966099 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.823019981 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.823049068 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.823072910 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.823113918 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.823632002 CET	49722	443	192.168.2.16	16.15.192.138
Nov 13, 2024 15:17:23.823646069 CET	443	49722	16.15.192.138	192.168.2.16
Nov 13, 2024 15:17:23.833205938 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.834651947 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.834872961 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.834966898 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.835047007 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.835072994 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.835129976 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.835138083 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.835197926 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.835767031 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.835793972 CET	443	49723	104.18.90.62	192.168.2.16
Nov 13, 2024 15:17:23.835875988 CET	49723	443	192.168.2.16	104.18.90.62
Nov 13, 2024 15:17:23.848644018 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:23.848668098 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:23.848742008 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:23.848975897 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:23.848980904 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:23.849188089 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.861327887 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.861412048 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.861438990 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.881040096 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.881289005 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.881427050 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.881495953 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.881654024 CET	49724	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.881673098 CET	443	49724	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.893126011 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893157959 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893179893 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893218994 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893246889 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.893260956 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893289089 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.893305063 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.893305063 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.893342018 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.895167112 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.895189047 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.895251036 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.895260096 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.895273924 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.897732019 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.897763014 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.897842884 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.898025036 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:23.898035049 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:23.899131060 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.899744987 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.900203943 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.900213957 CET	443	49719	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:23.900229931 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.900259972 CET	49719	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.912184954 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.934938908 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935129881 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935220003 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935343027 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935430050 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935463905 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.935503006 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935523987 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.935564995 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.935573101 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935661077 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935713053 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.935722113 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935815096 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.935863018 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.935873032 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936218023 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936299086 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.936312914 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936444998 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.936482906 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936558008 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.936603069 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936693907 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.936760902 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.936774015 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.937557936 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.937622070 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.937635899 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.937660933 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.937697887 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.937715054 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.937742949 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.938457966 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.938529968 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.938543081 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.938568115 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.938601017 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.938617945 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.938654900 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.939459085 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.939518929 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.939532042 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.939598083 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.944179058 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:23.978204966 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.978394985 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.978455067 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.978455067 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:23.978506088 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:23.978571892 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.011944056 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.012007952 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.012057066 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.012146950 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.012175083 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.012192011 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.012219906 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.013444901 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.013489008 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.013524055 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.013533115 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.013565063 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.013585091 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.014020920 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.014062881 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.014097929 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.014105082 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.014122009 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.014147997 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.052000999 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052146912 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052237034 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052328110 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052347898 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052427053 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052563906 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052628040 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052783966 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052859068 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052877903 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.052937984 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.052972078 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.053024054 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.053036928 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.053134918 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.053134918 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.053163052 CET	443	49720	104.17.24.14	192.168.2.16
Nov 13, 2024 15:17:24.053184032 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.053222895 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.053222895 CET	49720	443	192.168.2.16	104.17.24.14
Nov 13, 2024 15:17:24.056093931 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.056139946 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.056180000 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.056202888 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.056221962 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.056258917 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129549026 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129611969 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129656076 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129693985 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129715919 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129735947 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129760027 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129802942 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129826069 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129833937 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.129861116 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.129880905 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.131107092 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131153107 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131225109 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.131238937 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131263018 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.131279945 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.131876945 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131922007 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131962061 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.131973982 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.131999969 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.132014036 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.135042906 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135093927 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135143042 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.135154009 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135199070 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.135694981 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135740995 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135771990 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.135780096 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.135798931 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.135823011 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.136221886 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:24.173366070 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.173412085 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.173463106 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.173494101 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.173516989 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.173866034 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.186064005 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.186127901 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.187323093 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.187354088 CET	443	49716	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.187370062 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.187370062 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.187688112 CET	49716	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.246712923 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.246736050 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.246819019 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.246841908 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.246864080 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.246887922 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247050047 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247066021 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247128010 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247136116 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247181892 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247226954 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247245073 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247293949 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247302055 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247365952 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247695923 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247713089 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247807980 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247816086 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.247869968 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.247879982 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.248225927 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248241901 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248301029 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.248307943 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248348951 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.248594046 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248610020 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248672009 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.248678923 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.248720884 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249095917 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249113083 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249190092 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249196053 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249241114 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249346972 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249362946 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249438047 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249445915 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249490976 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249880075 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249914885 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249948978 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249954939 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.249974966 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.249999046 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.250189066 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.250201941 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.250236988 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.250263929 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.250271082 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.250298023 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.250317097 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.250361919 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.250421047 CET	49718	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.250437021 CET	443	49718	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.266437054 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:24.266493082 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:24.266577959 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:24.266757965 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:24.266778946 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:24.278211117 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.278244972 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.278342009 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.278549910 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.278562069 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.475734949 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.478084087 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.478097916 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.481647968 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.481759071 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.481765032 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.481806993 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.483520031 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.483573914 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.483661890 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.483665943 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.484738111 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.484812021 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.484872103 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.486887932 CET	49725	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.486901999 CET	443	49725	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.532164097 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.629030943 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.629405022 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.629426003 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.630290985 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.630376101 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.630747080 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.630920887 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.631227016 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.660022974 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660245895 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660322905 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.660336018 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660366058 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660409927 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.660456896 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660592079 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.660645962 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.661149979 CET	49727	443	192.168.2.16	104.18.88.62
Nov 13, 2024 15:17:24.661168098 CET	443	49727	104.18.88.62	192.168.2.16
Nov 13, 2024 15:17:24.673218012 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.673227072 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.721304893 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.755728960 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.755804062 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.755867958 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.755868912 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.755925894 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.756961107 CET	49728	443	192.168.2.16	199.232.196.193
Nov 13, 2024 15:17:24.756974936 CET	443	49728	199.232.196.193	192.168.2.16
Nov 13, 2024 15:17:24.959165096 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.959495068 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.959521055 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.960021973 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.961069107 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:24.961148024 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:24.961256981 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:25.003343105 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:25.156461954 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.156793118 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.156826973 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.158293009 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.158389091 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.158648014 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.158730030 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.158802032 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.158812046 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.160478115 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:25.160557985 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:25.160628080 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:25.161269903 CET	49731	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:25.161303997 CET	443	49731	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:25.214299917 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.441818953 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441852093 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441863060 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441883087 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441893101 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441900969 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.441967964 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.442003965 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.442014933 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.442056894 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.443344116 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.443371058 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.443430901 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.443438053 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.443461895 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.497210026 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.558829069 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.558844090 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.558866978 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.558897972 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.558954000 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.558960915 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.559012890 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.559973955 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.559984922 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.560012102 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.560040951 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.560045004 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.560070038 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.560086966 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.561546087 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.561578035 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.561605930 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.561613083 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.561645031 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.561655998 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.562494993 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.562517881 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.562589884 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.562597990 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.562645912 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676295042 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676328897 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676378965 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676394939 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676434040 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676448107 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676817894 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676841974 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676878929 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676886082 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.676908970 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.676934004 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.677350998 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.677398920 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.677433014 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.677438974 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.677463055 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.677484035 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.682785034 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.682807922 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.682838917 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.682845116 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.682868004 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.682890892 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.683264017 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.683286905 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.683337927 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.683345079 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.683372021 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.683387995 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684089899 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684113026 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684170961 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684175968 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684201002 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684371948 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684600115 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684626102 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684663057 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684669018 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.684691906 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.684714079 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.793211937 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793250084 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793303967 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.793318033 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793365955 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.793639898 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793661118 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793700933 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.793711901 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.793728113 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.793770075 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.794209957 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794229984 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794291019 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.794296980 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794357061 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.794714928 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794735909 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794811010 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.794816971 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.794894934 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.795300007 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.795331001 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.795357943 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.795365095 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.795413971 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.795908928 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.795928955 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.795972109 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.795977116 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.796015024 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.796055079 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.796412945 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.796432972 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.796490908 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.796497107 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.796565056 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.796932936 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.796952963 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797018051 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797023058 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797070980 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797382116 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797403097 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797446966 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797452927 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797502041 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797768116 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797790051 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797847986 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797873020 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797878981 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.797887087 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797928095 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.797940969 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.798002005 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.810085058 CET	49730	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:25.810091972 CET	443	49730	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:25.877799034 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:25.877831936 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:25.877924919 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:25.880022049 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:25.880043030 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:26.641741991 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:26.641783953 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:26.641885996 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:26.643098116 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:26.643111944 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:26.734113932 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:26.734301090 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:26.737135887 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:26.737165928 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:26.737482071 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:26.790860891 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:26.796139002 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:26.839327097 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.039735079 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.039793015 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.039908886 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.041215897 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.041265965 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.041300058 CET	49737	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.041315079 CET	443	49737	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.095803976 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.095840931 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.095928907 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.096205950 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.096218109 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.776979923 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:27.850491047 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:27.850590944 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:27.853007078 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:27.853014946 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:27.853425026 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:27.904244900 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:27.906663895 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:27.947326899 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:27.963259935 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.963385105 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.964488029 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:27.964502096 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.964809895 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:27.966249943 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:28.007328033 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:28.079394102 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:28.093338966 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.093442917 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.093570948 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.093791008 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.093826056 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.215096951 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:28.215241909 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:28.215424061 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:28.216023922 CET	49741	443	192.168.2.16	184.28.90.27
Nov 13, 2024 15:17:28.216049910 CET	443	49741	184.28.90.27	192.168.2.16
Nov 13, 2024 15:17:28.261497974 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261560917 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261581898 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261620045 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261636019 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.261652946 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261665106 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.261677980 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.261699915 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.261709929 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.262089014 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.262162924 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.262170076 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.272216082 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.272227049 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.272244930 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.272871971 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.272953987 CET	443	49739	4.245.163.56	192.168.2.16
Nov 13, 2024 15:17:28.273024082 CET	49739	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:17:28.683378935 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:28.781625032 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.781992912 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.782036066 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.782388926 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.782679081 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.782730103 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.782825947 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.823338032 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.827228069 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.939313889 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:28.949990034 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.950395107 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.950472116 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.950634003 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.950653076 CET	443	49742	54.161.127.194	192.168.2.16
Nov 13, 2024 15:17:28.950671911 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.950696945 CET	49742	443	192.168.2.16	54.161.127.194
Nov 13, 2024 15:17:28.953816891 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:28.953876019 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:28.953978062 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:28.954200029 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:28.954211950 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.648422956 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.648772955 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.648804903 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.649950981 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.650351048 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.650494099 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.650521040 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.690347910 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.814167023 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.814244032 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.814410925 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.814773083 CET	49743	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:17:29.814796925 CET	443	49743	44.221.189.90	192.168.2.16
Nov 13, 2024 15:17:29.898247004 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:32.244373083 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:32.308373928 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:32.548255920 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:33.156244993 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:33.696355104 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:33.696414948 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:33.696542025 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:34.165085077 CET	49715	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:17:34.165162086 CET	443	49715	172.217.18.4	192.168.2.16
Nov 13, 2024 15:17:34.371253014 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:36.782330036 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:37.117330074 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:38.554291010 CET	49673	443	192.168.2.16	204.79.197.203
Nov 13, 2024 15:17:41.589332104 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:17:46.729573965 CET	49678	443	192.168.2.16	20.189.173.10
Nov 13, 2024 15:17:51.196547031 CET	49680	80	192.168.2.16	192.229.211.108
Nov 13, 2024 15:18:04.769443989 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:18:04.769473076 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:18:04.808794975 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:04.808846951 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:04.808963060 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:04.810031891 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:04.810046911 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:05.871987104 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:05.872117996 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:05.873831034 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:05.873851061 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:05.874263048 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:05.876218081 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:05.919348001 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.231515884 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.231583118 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.231627941 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.231682062 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.231715918 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.231914043 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.231914043 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.232498884 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.232544899 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.232589006 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.232603073 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.232637882 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.234620094 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.234653950 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.234677076 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.234819889 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.234858036 CET	443	49745	4.245.163.56	192.168.2.16
Nov 13, 2024 15:18:06.234915972 CET	49745	443	192.168.2.16	4.245.163.56
Nov 13, 2024 15:18:06.285664082 CET	49698	80	192.168.2.16	2.22.50.131
Nov 13, 2024 15:18:06.285670042 CET	49699	80	192.168.2.16	2.22.50.131
Nov 13, 2024 15:18:06.292335987 CET	80	49698	2.22.50.131	192.168.2.16
Nov 13, 2024 15:18:06.292382002 CET	80	49699	2.22.50.131	192.168.2.16
Nov 13, 2024 15:18:06.292407990 CET	49698	80	192.168.2.16	2.22.50.131
Nov 13, 2024 15:18:06.292459965 CET	49699	80	192.168.2.16	2.22.50.131
Nov 13, 2024 15:18:14.581633091 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:18:14.581801891 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:18:14.581958055 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:18:16.173218012 CET	49708	443	192.168.2.16	44.221.189.90
Nov 13, 2024 15:18:16.173290014 CET	443	49708	44.221.189.90	192.168.2.16
Nov 13, 2024 15:18:22.768838882 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:22.768932104 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:22.769032955 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:22.769315958 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:22.769357920 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:23.630140066 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:23.630655050 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:23.630718946 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:23.631447077 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:23.631912947 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:23.632009983 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:23.678590059 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:33.631304979 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:33.631488085 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:33.631586075 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:34.170495987 CET	49747	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:18:34.170537949 CET	443	49747	172.217.18.4	192.168.2.16
Nov 13, 2024 15:18:55.745032072 CET	49701	80	192.168.2.16	192.229.221.95
Nov 13, 2024 15:18:55.745048046 CET	49700	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:18:55.750622988 CET	80	49701	192.229.221.95	192.168.2.16
Nov 13, 2024 15:18:55.750807047 CET	49701	80	192.168.2.16	192.229.221.95
Nov 13, 2024 15:18:55.751610041 CET	443	49700	40.126.32.74	192.168.2.16
Nov 13, 2024 15:18:55.751707077 CET	49700	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:18:59.082935095 CET	49702	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:18:59.088609934 CET	443	49702	40.126.32.74	192.168.2.16
Nov 13, 2024 15:18:59.088874102 CET	49702	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:19:00.600867033 CET	49703	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:19:00.606614113 CET	443	49703	40.126.32.74	192.168.2.16
Nov 13, 2024 15:19:00.606807947 CET	49703	443	192.168.2.16	40.126.32.74
Nov 13, 2024 15:19:22.827872038 CET	49749	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:19:22.827986002 CET	443	49749	172.217.18.4	192.168.2.16
Nov 13, 2024 15:19:22.828095913 CET	49749	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:19:22.828387022 CET	49749	443	192.168.2.16	172.217.18.4
Nov 13, 2024 15:19:22.828427076 CET	443	49749	172.217.18.4	192.168.2.16
Nov 13, 2024 15:19:23.690443993 CET	443	49749	172.217.18.4	192.168.2.16
Nov 13, 2024 15:19:23.737927914 CET	49749	443	192.168.2.16	172.217.18.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 15:17:17.979135990 CET	53	59652	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:18.030659914 CET	53	57644	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:18.826848030 CET	57778	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:18.827107906 CET	60398	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:18.852421045 CET	53	57778	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:18.876737118 CET	53	60398	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:19.269360065 CET	53	55131	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:20.014086008 CET	60066	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:20.014233112 CET	51210	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:20.025373936 CET	53	51210	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:20.025394917 CET	53	60066	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.715461969 CET	57078	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.715643883 CET	53410	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.722852945 CET	53	57078	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.723094940 CET	53	53410	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.929472923 CET	62752	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.929660082 CET	53630	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.931056023 CET	62305	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.931225061 CET	52565	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.934648991 CET	61730	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.934839964 CET	64187	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.935334921 CET	61701	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.935519934 CET	54167	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:22.942023039 CET	53	62752	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.942059994 CET	53	53630	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.943726063 CET	53	64138	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.943797112 CET	53	62305	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.943828106 CET	53	52565	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.944803953 CET	53	61730	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.945368052 CET	53	64187	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.945760965 CET	53	61701	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:22.946259022 CET	53	54167	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:23.839670897 CET	52101	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:23.839855909 CET	65267	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:23.847060919 CET	53	52101	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:23.848176003 CET	53	65267	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:23.883836985 CET	54711	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:23.883908987 CET	55513	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:23.895044088 CET	53	54711	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:23.896153927 CET	53	55513	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:24.253710032 CET	51235	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:24.253837109 CET	58994	53	192.168.2.16	1.1.1.1
Nov 13, 2024 15:17:24.264952898 CET	53	51235	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:24.265971899 CET	53	58994	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:36.231060982 CET	53	50244	1.1.1.1	192.168.2.16
Nov 13, 2024 15:17:55.294020891 CET	53	51334	1.1.1.1	192.168.2.16
Nov 13, 2024 15:18:17.874355078 CET	53	58237	1.1.1.1	192.168.2.16
Nov 13, 2024 15:18:18.256334066 CET	53	52925	1.1.1.1	192.168.2.16
Nov 13, 2024 15:18:23.942176104 CET	138	138	192.168.2.16	192.168.2.255
Nov 13, 2024 15:18:46.234102964 CET	53	55021	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 13, 2024 15:17:18.876828909 CET	192.168.2.16	1.1.1.1	c277	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 15:17:18.826848030 CET	192.168.2.16	1.1.1.1	0xe303	Standard query (0)	employeeportal.net-login.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.827107906 CET	192.168.2.16	1.1.1.1	0xe58f	Standard query (0)	employeeportal.net-login.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:20.014086008 CET	192.168.2.16	1.1.1.1	0x3f4d	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.014233112 CET	192.168.2.16	1.1.1.1	0x2365	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Nov 13, 2024 15:17:22.715461969 CET	192.168.2.16	1.1.1.1	0xf1dd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.715643883 CET	192.168.2.16	1.1.1.1	0x5ca1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:22.929472923 CET	192.168.2.16	1.1.1.1	0x77b2	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.929660082 CET	192.168.2.16	1.1.1.1	0xd423	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:22.931056023 CET	192.168.2.16	1.1.1.1	0x6179	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.931225061 CET	192.168.2.16	1.1.1.1	0x9bbf	Standard query (0)	s3.amazonaws.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:22.934648991 CET	192.168.2.16	1.1.1.1	0xe4b7	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.934839964 CET	192.168.2.16	1.1.1.1	0x1b37	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Nov 13, 2024 15:17:22.935334921 CET	192.168.2.16	1.1.1.1	0x6398	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.935519934 CET	192.168.2.16	1.1.1.1	0x9252	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:23.839670897 CET	192.168.2.16	1.1.1.1	0xe809	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.839855909 CET	192.168.2.16	1.1.1.1	0xd6c1	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Nov 13, 2024 15:17:23.883836985 CET	192.168.2.16	1.1.1.1	0xb792	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.883908987 CET	192.168.2.16	1.1.1.1	0x62eb	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Nov 13, 2024 15:17:24.253710032 CET	192.168.2.16	1.1.1.1	0xa6ec	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.253837109 CET	192.168.2.16	1.1.1.1	0xb692	Standard query (0)	secured-login.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	employeeportal.net-login.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		44.221.189.90	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		52.6.122.174	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		52.44.34.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		52.205.64.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		54.158.46.93	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.852421045 CET	1.1.1.1	192.168.2.16	0xe303	No error (0)	landing.training.knowbe4.com		54.161.127.194	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:18.876737118 CET	1.1.1.1	192.168.2.16	0xe58f	No error (0)	employeeportal.net-login.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		54.161.127.194	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		52.6.122.174	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		44.221.189.90	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		52.205.64.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		54.158.46.93	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:20.025394917 CET	1.1.1.1	192.168.2.16	0x3f4d	No error (0)	secured-login.net		52.44.34.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.722852945 CET	1.1.1.1	192.168.2.16	0xf1dd	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.723094940 CET	1.1.1.1	192.168.2.16	0x5ca1	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 13, 2024 15:17:22.942023039 CET	1.1.1.1	192.168.2.16	0x77b2	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.942023039 CET	1.1.1.1	192.168.2.16	0x77b2	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.942059994 CET	1.1.1.1	192.168.2.16	0xd423	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		16.15.192.138	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		52.217.112.136	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		52.217.133.72	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		54.231.198.80	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		52.217.206.48	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		52.216.246.54	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		52.216.27.166	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.943797112 CET	1.1.1.1	192.168.2.16	0x6179	No error (0)	s3.amazonaws.com		16.182.101.208	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.944803953 CET	1.1.1.1	192.168.2.16	0xe4b7	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.944803953 CET	1.1.1.1	192.168.2.16	0xe4b7	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.944803953 CET	1.1.1.1	192.168.2.16	0xe4b7	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.944803953 CET	1.1.1.1	192.168.2.16	0xe4b7	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.944803953 CET	1.1.1.1	192.168.2.16	0xe4b7	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.945368052 CET	1.1.1.1	192.168.2.16	0x1b37	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Nov 13, 2024 15:17:22.945760965 CET	1.1.1.1	192.168.2.16	0x6398	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:22.945760965 CET	1.1.1.1	192.168.2.16	0x6398	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.945760965 CET	1.1.1.1	192.168.2.16	0x6398	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:22.946259022 CET	1.1.1.1	192.168.2.16	0x9252	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:23.847060919 CET	1.1.1.1	192.168.2.16	0xe809	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.847060919 CET	1.1.1.1	192.168.2.16	0xe809	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.847060919 CET	1.1.1.1	192.168.2.16	0xe809	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.847060919 CET	1.1.1.1	192.168.2.16	0xe809	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.847060919 CET	1.1.1.1	192.168.2.16	0xe809	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.848176003 CET	1.1.1.1	192.168.2.16	0xd6c1	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Nov 13, 2024 15:17:23.895044088 CET	1.1.1.1	192.168.2.16	0xb792	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:23.895044088 CET	1.1.1.1	192.168.2.16	0xb792	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.895044088 CET	1.1.1.1	192.168.2.16	0xb792	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:23.896153927 CET	1.1.1.1	192.168.2.16	0x62eb	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		44.221.189.90	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		54.161.127.194	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		52.205.64.62	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		54.158.46.93	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		52.44.34.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 15:17:24.264952898 CET	1.1.1.1	192.168.2.16	0xa6ec	No error (0)	secured-login.net		52.6.122.174	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

employeeportal.net-login.com

https:

secured-login.net

cdnjs.cloudflare.com

cdn2.hubspot.net

s3.amazonaws.com

i.imgur.com

slscr.update.microsoft.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49707	44.221.189.90	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:19 UTC	991	OUT	GET /XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906 HTTP/1.1 Host: employeeportal.net-login.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:19 UTC	574	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 452 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"f7c8a8e5dcffa9c4f44f8631d3095230" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 31964c68-3999-46da-b1db-f8415661bd22 X-Runtime: 0.096202 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:19 UTC	452	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 64 2d 6c 6f 67 69 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 63 33 39 35 35 62 31 63 34 38 61 2f 58 65 6a 5a 50 53 6d 34 30 56 7a 5a 59 51 7a 68 4c 56 46 51 79 65 6c 5a 74 4e 58 52 72 61 57 35 4a 4c 30 31 47 57 47 56 4d 51 6d 4d 34 59 6e 64 75 62 7a 5a 5a 4e 6c 68 68 55 56 68 43 59 6d 46 59 62 55 31 4f 63 32 4e 55 57 58 5a 71 59 55 4a 52 65 6a 5a 76 56 54 68 55 54 31 45 78 4d 30 78 4c 64 6e 6b 30 4f 47 46 57 62 30 4a 48 4e 33 42 5a 61 57 6b 72 51 6d 78 6b 4e 33 6c 54 54 58 45 32 5a 55 64 4a 54 32 31 33 4e 48 4a 7a 54 33 46 72 63 55 46 75 54 57 35 79 54 56 46 6d Data Ascii: <html> <head> <script>window.location.href = 'https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49710	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:20 UTC	1337	OUT	GET /pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:22 UTC	834	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 107493 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"cfb2f5dca84a69014f40514e38519920" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 7b312ffc-846f-4fe3-9903-a192abf4950d X-Runtime: 1.554005 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:22 UTC	15550	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac
2024-11-13 14:17:22 UTC	16384	IN	Data Raw: 09 09 09 09 09 09 63 37 2e 31 36 2d 34 2e 37 31 2c 31 34 2e 39 2d 38 2e 34 37 2c 32 32 2e 38 35 2d 31 31 2e 36 34 63 2d 30 2e 39 32 2c 30 2e 33 36 2d 31 2e 38 34 2c 30 2e 37 33 2d 32 2e 37 36 2c 31 2e 30 39 63 31 32 2e 31 31 2d 34 2e 37 39 2c 32 34 2e 37 34 2d 38 2e 32 34 2c 33 37 2e 35 32 2d 31 30 2e 37 33 0a 09 09 09 09 09 09 09 63 33 2e 31 36 2d 30 2e 36 32 2c 36 2e 33 33 2d 31 2e 31 36 2c 39 2e 35 32 2d 31 2e 36 63 2d 30 2e 39 2c 30 2e 31 32 2d 31 2e 38 2c 30 2e 32 35 2d 32 2e 37 2c 30 2e 33 37 63 31 36 2e 31 2d 32 2e 32 31 2c 33 32 2e 34 36 2d 33 2e 31 34 2c 34 38 2e 36 38 2d 32 2e 30 35 63 34 2e 37 35 2c 30 2e 33 32 2c 39 2e 34 39 2c 30 2e 38 33 2c 31 34 2e 31 39 2c 31 2e 35 35 0a 09 09 09 09 09 09 09 63 2d 30 2e 38 33 2d 30 2e 31 33 2d 31 2e 36 36 Data Ascii: c7.16-4.71,14.9-8.47,22.85-11.64c-0.92,0.36-1.84,0.73-2.76,1.09c12.11-4.79,24.74-8.24,37.52-10.73c3.16-0.62,6.33-1.16,9.52-1.6c-0.9,0.12-1.8,0.25-2.7,0.37c16.1-2.21,32.46-3.14,48.68-2.05c4.75,0.32,9.49,0.83,14.19,1.55c-0.83-0.13-1.66
2024-11-13 14:17:22 UTC	56	IN	Data Raw: 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 2f 74 64 3e 0a 09 09 09 09 09 3c 2f 74 72 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 63 6f 6c 73 70 61 6e Data Ascii: /div></td></tr><tr><td colspan
2024-11-13 14:17:22 UTC	3028	IN	Data Raw: 3d 22 35 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 70 6f 72 74 22 3e 44 65 6e 6b 65 6e 20 53 69 65 20 64 61 72 61 6e 3a 20 4d 65 6c 64 65 6e 20 53 69 65 20 76 65 72 64 c3 a4 63 68 74 69 67 65 20 45 2d 4d 61 69 6c 73 20 73 74 65 74 73 20 49 68 72 65 6d 20 56 6f 72 67 65 73 65 74 7a 74 65 6e 20 6f 64 65 72 20 64 65 6d 20 49 54 2d 54 65 61 6d 2e 20 43 79 62 65 72 6b 72 69 6d 69 6e 65 6c 6c 65 20 6b 65 6e 6e 65 6e 20 76 69 65 6c 65 20 54 72 69 63 6b 73 2c 20 75 6d 20 53 69 65 20 68 69 6e 74 65 72 73 20 4c 69 63 68 74 20 7a 75 20 66 c3 bc 68 72 65 6e 2e 20 42 6c 65 69 62 65 6e 20 53 69 65 20 77 61 63 68 73 61 6d 2c 20 64 65 6e 6e 20 53 69 65 20 73 69 6e 64 20 64 69 65 20 6c 65 74 7a 74 65 20 56 65 72 74 65 69 64 69 67 75 6e 67 73 6c Data Ascii: ="5"><div class="report">Denken Sie daran: Melden Sie verdchtige E-Mails stets Ihrem Vorgesetzten oder dem IT-Team. Cyberkriminelle kennen viele Tricks, um Sie hinters Licht zu fhren. Bleiben Sie wachsam, denn Sie sind die letzte Verteidigungsl
2024-11-13 14:17:23 UTC	16384	IN	Data Raw: 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 09 09 09 09 3c 74 62 6f 64 79 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 76 61 6c 69 67 6e 3d 22 74 6f 70 22 20 77 69 64 74 68 3d 22 33 30 25 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 6e 75 6d 62 65 72 2d 31 22 3e 30 31 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 74 65 78 74 22 3e 41 6e 74 65 73 20 64 65 20 68 61 63 65 72 20 63 6c 69 63 2c 20 70 69 c3 a9 6e 73 65 6c 6f 20 64 6f 73 20 76 65 63 65 73 2e 3c 2f 64 69 76 3e 0a 09 Data Ascii: e="padding-bottom: 100px;" width="100%"><tbody><tr><td valign="top" width="30%"><div class="rule-container"><div class="rule-number-1">01</div><div class="rule-text">Antes de hacer clic, pinselo dos veces.</div>
2024-11-13 14:17:23 UTC	16384	IN	Data Raw: 69 63 75 72 65 7a 7a 61 2c 20 74 69 65 6e 69 20 61 20 6d 65 6e 74 65 20 71 75 65 73 74 65 20 74 72 65 20 72 65 67 6f 6c 65 3a 3c 2f 68 32 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 22 3e 0a 09 09 09 09 3c 74 62 6f 64 79 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 76 61 6c 69 67 6e 3d 22 74 6f 70 22 20 77 69 64 74 68 3d 22 33 30 25 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 6e 75 6d 62 65 72 2d 31 22 3e 30 31 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: icurezza, tieni a mente queste tre regole:</h2></div><table style="padding-bottom: 100px;"><tbody><tr><td valign="top" width="30%"><div class="rule-container"><div class="rule-number-1">01</div><div class="
2024-11-13 14:17:23 UTC	16384	IN	Data Raw: 09 09 3c 68 32 20 63 6c 61 73 73 3d 22 72 65 6d 65 6d 62 65 72 22 20 74 6b 65 79 3d 22 72 65 6d 65 6d 62 65 72 22 3e 50 61 72 61 20 73 65 20 6d 61 6e 74 65 72 20 73 65 67 75 72 6f 20 6f 6e 6c 69 6e 65 2c 20 6c 65 6d 62 72 65 2d 73 65 20 64 65 73 74 61 73 20 74 72 c3 aa 73 20 72 65 67 72 61 73 3a 3c 2f 68 32 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 22 3e 0a 09 09 09 09 3c 74 62 6f 64 79 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 76 61 6c 69 67 6e 3d 22 74 6f 70 22 20 77 69 64 74 68 3d 22 33 30 25 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 09 Data Ascii: <h2 class="remember" tkey="remember">Para se manter seguro online, lembre-se destas trs regras:</h2></div><table style="padding-bottom: 100px;"><tbody><tr><td valign="top" width="30%"><div class="rule-container">
2024-11-13 14:17:23 UTC	16384	IN	Data Raw: 68 e1 ba ad 6e 2e 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 2f 74 64 3e 0a 09 09 09 09 09 3c 2f 74 72 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 35 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 70 6f 72 74 22 3e 48 c3 a3 79 20 6e 68 e1 bb 9b 3a 20 4c 75 c3 b4 6e 20 62 c3 a1 6f 20 63 c3 a1 6f 20 65 6d 61 69 6c 20 c4 91 c3 a1 6e 67 20 6e 67 e1 bb 9d 20 63 68 6f 20 71 75 e1 ba a3 6e 20 6c c3 bd 20 68 6f e1 ba b7 63 20 c4 91 e1 bb 99 69 20 6e 67 c5 a9 20 43 4e 54 54 20 63 e1 bb a7 61 20 62 e1 ba a1 6e 2e 20 54 e1 bb 99 69 20 70 68 e1 ba a1 6d 20 6d e1 ba a1 6e 67 20 63 c3 b3 20 72 e1 ba a5 74 20 6e 68 69 e1 bb 81 75 20 63 c3 a1 63 68 20 c4 91 e1 bb Data Ascii: hn.</div></div></td></tr><tr><td colspan="5"><div class="report">Hy nh: Lun bo co email ng ng cho qun l hoc i ng CNTT ca bn. Ti phm mng c rt nhiu cch
2024-11-13 14:17:23 UTC	6939	IN	Data Raw: 82 61 20 77 79 73 c5 82 61 6e 61 20 70 72 7a 65 7a 20 66 69 72 6d c4 99 20 4b 6e 6f 77 42 65 34 26 6e 62 73 70 3b 49 6e 63 2e 20 57 79 6d 69 65 6e 69 6f 6e 65 20 77 26 6e 62 73 70 3b 6e 69 65 6a 20 6f 72 67 61 6e 69 7a 61 63 6a 65 20 6e 69 65 20 73 c4 85 20 70 6f 77 69 c4 85 7a 61 6e 65 20 7a 26 6e 62 73 70 3b 66 69 72 6d c4 85 20 4b 6e 6f 77 42 65 34 26 6e 62 73 70 3b 49 6e 63 2e 20 61 6e 69 20 6e 69 65 20 70 6f 6c 65 63 61 6a c4 85 20 6a 65 6a 20 75 73 c5 82 75 67 2e 20 3c 73 70 61 6e 20 74 6b 65 79 3d 22 64 69 73 63 6c 61 69 6d 65 72 2d 32 22 3e 57 69 61 64 6f 6d 6f c5 9b c4 87 20 6d 61 20 6e 61 20 63 65 6c 75 20 70 6f 6b 61 7a 61 6e 69 65 2c 20 6a 61 6b 20 64 7a 69 61 c5 82 61 20 70 68 69 73 68 69 6e 67 20 69 20 c5 bc 65 20 70 6f 64 65 6a 72 7a 61 6e Data Ascii: a wysana przez firm KnowBe4 Inc. Wymienione w niej organizacje nie s powizane z firm KnowBe4 Inc. ani nie polecaj jej usug. <span tkey="disclaimer-2">Wiadomo ma na celu pokazanie, jak dziaa phishing i e podejrzan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:22 UTC	949	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	263	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Tue, 12 Nov 2024 17:16:11 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:23 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49720	104.17.24.14	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	913	OUT	GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	951	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb04010-1d970" Last-Modified: Mon, 04 May 2020 16:17:20 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 517651 Expires: Mon, 03 Nov 2025 14:17:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B7qneLr4OIosYoMeQQ2dqLgxPmcpRwa51ZWKCQA4k%2Frep70VgZFEIkl2%2FhlmrQdwgxH4B1RbJ%2BCiPGhRfqfHzxXQJTpck%2Fc6QitkG0W7Zt0uTukgWeUjJeWSU6K9Zwqnrku%2B6QCa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e1f6292ae6e464e-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 14:17:23 UTC	418	IN	Data Raw: 37 62 66 39 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 33 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b Data Ascii: 7bf9/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f Data Ascii: ,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{bo
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 68 65 69 67 68 74 3a 61 75 74 6f 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 Data Ascii: height:auto}input[type=search]{-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6c 79 70 68 69 63 6f 6e 73 20 48 61 6c 66 6c 69 6e 67 73 27 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 Data Ascii: 1px solid #ddd!important}}@font-face{font-family:'Glyphicons Halflings';src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format('embedded-opentype'),url(../fonts/glyphicons-halflings-regular.woff
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 65 30 31 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 6f 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 36 22 7d 2e 67 6c 79 70 68 69 Data Ascii: e010"}.glyphicon-th:before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphi
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 6f 6e 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 69 74 61 6c 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 65 78 74 2d 68 65 69 67 Data Ascii: on-bookmark:before{content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-heig
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 68 69 63 6f 6e 2d 73 74 65 70 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 65 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 6c 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 69 6e 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 Data Ascii: hicon-step-forward:before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{conte
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 74 77 65 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 Data Ascii: }.glyphicon-comment:before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{conte
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 61 70 65 72 63 6c 69 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 68 65 61 72 74 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 69 6e 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 68 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 75 73 68 70 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 75 73 64 3a 62 65 66 6f Data Ascii: d:before{content:"\e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:befo
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 73 61 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 6f 70 65 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 72 65 64 69 74 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 72 61 6e 73 66 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 38 22 7d 2e 67 6c 79 70 68 69 63 Data Ascii: e{content:"\e173"}.glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49723	104.18.90.62	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	945	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	1331	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: image/webp Content-Length: 2368 Connection: close CF-Ray: 8e1f6292bb1346c6-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 488796 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 27fc50e60026c8530ee4d90073929962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: ASnqDWbdrevKLgnhiOMnaDTkv3gudvqwqpVAkUadUKyNaDG1VOmPTg== X-Amz-Cf-Pop: DFW57-P8 x-amz-id-2: h5g5Dp5hkRRNfU6r2Cdnst8+BtecrNU2ARjJ4QJnqARA2FfTfe8kX57tWiogaXjW11nI97+d3VI= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 0D0GWF3Q1E9HN8Y9 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING
2024-11-13 14:17:23 UTC	597	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 47 4f 75 41 4a 7a 41 31 2e 62 6f 31 76 6a 6f 74 5f 48 73 71 30 6f 77 45 59 39 38 58 6a 59 48 39 0d 0a 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c Data Ascii: x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9X-Cache: RefreshHit from cloudfrontX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\
2024-11-13 14:17:23 UTC	810	IN	Data Raw: 52 49 46 46 38 09 00 00 57 45 42 50 56 50 38 4c 2c 09 00 00 2f c7 40 09 10 e2 30 90 b6 4d e3 5f f8 77 07 11 31 01 e9 57 56 61 55 0f 57 2c 4b db b6 fe 6d 93 a3 7d bc 4a da 5d 8f 80 97 3d 83 ee 3a 5d f7 44 7a 0e 3d 80 9e 01 fd 7e bf ef f7 fd ff 1e 4d b7 4f c9 50 6e 65 58 28 0c e6 e0 bf 0c f2 84 99 93 7f 33 d6 34 cc cc cc cc 8c 8a 03 0a 93 1c 86 3b 8c 66 3b 9c 98 49 32 d3 df 4c 1a cf fc b3 89 24 5b 4a ff 1f df f9 77 41 91 61 00 1d e4 97 05 2c e1 04 11 d8 40 02 24 db a6 5d d9 b6 6d db b6 6d db b6 6d db b6 ed a4 6c db 4e be 6d 63 4f 00 d4 6c db 96 2d db fe b8 bb 5b 74 a9 ae dd 35 b9 bb d3 dc 2d b9 25 97 01 fe 01 d8 82 41 1c 66 20 f9 0a 44 16 60 02 5f 40 2b c7 71 b5 3f fd 03 e0 f5 e9 38 0c d0 7f 28 b6 b5 2d ab 5e dc 69 96 2c b9 0e c0 5d 66 a0 c9 61 0c d0 a0 d1 Data Ascii: RIFF8WEBPVP8L,/@0M_w1WVaUW,Km}J]=:]Dz=~MOPneX(34;f;I2L$[JwAa,@$]mmmlNmcOl-[t5-%Af D`_@+q?8(-^i,]fa
2024-11-13 14:17:23 UTC	1369	IN	Data Raw: 03 94 5d 88 8a 49 a8 c7 90 06 f5 1d 7e 1e 65 84 5a 04 54 a0 03 55 06 c0 43 aa 4f 45 be 5b bb f8 86 0b 01 f5 5a 71 06 a9 46 e8 a0 68 63 cd 57 df e0 2c 45 e5 7c aa 42 75 c1 8e 2a 53 51 3b b9 c9 60 e0 61 02 c5 f5 10 f0 8d 0b 7c ff 0b 3f fc c3 84 7d 0f df be 43 4f 58 34 c0 f6 e6 c0 95 21 7b 27 50 c2 01 4a 05 38 3a 86 e2 55 eb 80 9a ac 04 5c 00 b4 53 b1 7b 38 55 31 dd 00 a8 cb 11 01 4a 02 50 f1 4e 2a 8a 5f d5 fd a9 39 4c e1 1e 0e bd 95 b2 23 3c 03 83 8f 76 a6 e2 6e 07 bd f6 4d b9 e5 13 38 1e fb 23 23 df 72 8a fc 5d 5c 14 9c 65 7c ed e2 12 ba af 44 ce 74 89 40 01 b7 ad b4 d5 19 fc a3 92 a5 68 80 87 40 25 07 a8 3c 50 77 ce ea 38 25 f9 b6 d2 53 71 6a 19 60 d6 08 67 5f 7f 2d 5c bb 89 b3 2b aa 1a 50 69 59 95 db 41 3d 28 cc 94 c5 40 a7 a0 d2 c6 80 8a 76 0c e8 35 c0 Data Ascii: ]I~eZTUCOE[ZqFhcW,E\|BuSQ;`a\|?}COX4!{'PJ8:U\S{8U1JPN_9L#<vnM8##r]\e\|Dt@h@%<Pw8%Sqj`g_-\+PiYA=(@v5
2024-11-13 14:17:23 UTC	189	IN	Data Raw: da 47 16 9d b7 04 3e 1c 55 38 57 7e ff 61 98 fa d6 54 72 68 d7 83 80 83 1a 42 2a ea 05 f0 bf 9a 3c 79 a7 2b ff 8a 03 1b 17 b7 23 ef 93 c5 e7 ad 81 df 6d 54 38 bb d3 bc fa ac b5 4f 1b ef 9c 6f 01 c3 1c 7c 14 a0 fa 5d 08 b5 d3 34 d4 39 37 bf 75 c7 b0 ab ff 5a a0 07 4f 79 f7 bc 7c a5 41 e5 6a 65 bf d2 1e d4 a5 cb c4 3c 75 b5 17 cc 0e b1 f7 b8 b4 e3 84 05 0b 0e bd 73 d7 11 ce 3d a0 ed bd 6d 15 63 d8 f5 17 ec 5e 7b 7a d0 bf 94 d3 f1 aa fa 93 1e 6d d4 dd 67 87 b7 f9 db 95 6f 28 a3 8d 56 01 21 e6 d0 33 3b aa e1 3f 9f bc 41 9b 35 97 76 ec f9 b1 e3 de ab d5 5b 9b e3 00 Data Ascii: G>U8W~aTrhB*<y+#mT8Oo\|]497uZOy\|Aje<us=mc^{zmgo(V!3;?A5v[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49717	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	949	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 069009b2-8d50-44d0-bb4f-0d950cd165f6 X-Runtime: 0.010544 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:23 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49718	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	928	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Tue, 12 Nov 2024 17:16:11 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:23 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-13 14:17:23 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-11-13 14:17:23 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-11-13 14:17:24 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49716	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	928	OUT	GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:24 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 14:17:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: a40dde32-9312-4e26-9f01-32bcc0c12fe2 X-Runtime: 0.101629 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:24 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49722	16.15.192.138	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	886	OUT	GET /helpimg/landing_pages/css/dd.css HTTP/1.1 Host: s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	468	IN	HTTP/1.1 200 OK x-amz-id-2: wTF/U9LxeLy4P7VsrZZSoxiDaH9JpfsO6N3CzUeDJk8PlIqZ09l+upuX0kVAtAHmge5qRVJoSn0bik0q1mzLwHBqkYEaMsLp3/j6bl5jmyM= x-amz-request-id: CXBHM5H92YV4Q917 Date: Wed, 13 Nov 2024 14:17:24 GMT x-amz-replication-status: COMPLETED Last-Modified: Tue, 08 Aug 2017 20:12:22 GMT ETag: "dd05b711e15ef201b07e20cb5c87f5d8" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/css Content-Length: 4524 Server: AmazonS3 Connection: close
2024-11-13 14:17:23 UTC	4524	IN	Data Raw: 2e 62 6f 72 64 65 72 52 61 64 69 75 73 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 54 70 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 30 20 30 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 42 74 6d 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 35 70 78 20 35 70 78 20 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 0d 0a 2e 64 64 63 6f 6d 6d 6f 6e 20 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b Data Ascii: .borderRadius{-moz-border-radius:5px; border-radius:5px; }.borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}.borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.ddcommon {position:relative;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49719	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	881	OUT	GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 14:17:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: f0d6390f-fb72-4506-ad49-313c98212c33 X-Runtime: 0.021151 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:23 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49724	199.232.196.193	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	906	OUT	GET /QRF01zv.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:23 UTC	725	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1666 Content-Type: image/png Last-Modified: Wed, 17 Jul 2019 19:34:43 GMT ETag: "29d583007fcd677aa31ca849478bc17a" X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: _hKeuoxVkYw2QVgTw3r9CekWpMNFy7-2eWH7Tb40OtTj_WUPnqXoZQ== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 13 Nov 2024 14:17:23 GMT Age: 1392636 X-Served-By: cache-iad-kiad7000070-IAD, cache-dfw-kdal2120086-DFW X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 31794, 5 X-Timer: S1731507444.811822,VS0,VE0 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2024-11-13 14:17:23 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 06 49 49 44 41 54 68 81 e5 9b 7b 88 56 45 14 c0 7f fb ed aa 59 a2 45 b9 bd b4 a7 95 8f b4 55 76 15 42 c9 f2 91 d4 1a 3d a8 20 2a 7b a8 f5 a7 19 65 65 a4 a5 92 f9 47 12 25 84 9a 88 a6 48 2f 29 92 55 52 31 5b c9 47 99 94 99 64 c6 1a be 12 5f 6d 19 d5 da d6 1f e7 7e 3a f7 7c f7 31 33 f7 1a 7e f4 83 65 ef 99 3b 73 ee 9c ef de 3b 67 e6 cc b9 15 0b 17 2e 26 67 0a 40 05 f0 77 c4 b9 47 81 e7 81 4b 81 7f 80 ef 80 c9 c0 7b 11 75 2b 81 d6 a0 5e ae 9d cb 93 6b 80 c5 c0 c0 88 73 2b 81 b9 c0 65 c8 0f 52 00 7a 01 ef 02 8b 22 ea 8f 04 16 00 17 e4 d9 c1 bc 0c be 05 d8 04 6c 07 7a 00 9f aa f3 ef 03 43 12 da df 07 bc a9 ca 56 01 23 80 7d c8 8f 35 28 8f 8e 66 35 f8 4e 60 Data Ascii: PNGIHDR<<:rIIDATh{VEYEUvB= *{eeG%H/)UR1[Gd_m~:\|13~e;s;g.&g@wGK{u+^ks+eRz"lzCV#}5(f5N`
2024-11-13 14:17:23 UTC	295	IN	Data Raw: 65 c8 bb 93 94 4c 52 4f 78 cb 66 11 fe 81 05 90 dc 2f 33 f3 6e 10 c9 23 f4 7e e0 5a 2c 26 3e b6 8b 87 46 e4 5b 85 6f 13 ea 3c a4 e4 59 96 ba a3 78 55 c9 a3 13 ea ae 21 bd 6f 27 70 59 2d 1d 42 7e c5 39 31 e7 47 23 33 a1 22 6f 10 5e b8 db b2 81 70 b2 ea 25 c8 37 11 51 4c 41 e6 ee d6 e1 25 9f e5 e1 58 64 4f 59 af 88 3a 13 76 05 2d 44 24 86 59 a0 13 e3 9e a0 74 dd be 17 71 87 2f b8 2a f7 5d 0f 7f 88 84 4c c6 10 0e f5 4c 25 1c 6f 5a 80 7c ba 63 cb 8b 48 0a 70 91 de 84 3f fc d8 03 dc 8b ec 17 af 75 d0 7b 82 ac 01 80 b9 48 6e d7 38 64 0b f3 4c 60 a1 aa 33 06 f8 cc 42 d7 52 4a 13 42 df 0e fe 37 21 af 4c 17 82 65 9e 2f 79 45 3c 5e 43 ee ec 08 a0 1d a5 33 a2 7a 24 4d 3f 8e 46 4a 3f f5 a9 47 fc ea 40 24 9f e3 ad 3c 3a 9a 77 88 67 05 32 88 68 f7 d0 8c 2c 25 a7 23 91 Data Ascii: eLROxf/3n#~Z,&>F[o<YxU!o'pY-B~91G#3"o^p%7QLA%XdOY:v-D$Ytq/*]LL%oZ\|cHp?u{Hn8dL`3BRJB7!Le/yE<^C3z$M?FJ?G@$<:wg2h,%#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49725	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:23 UTC	926	OUT	GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:24 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 14:17:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 030b9743-e294-460f-a45d-643ba174d568 X-Runtime: 0.116983 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:24 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49727	104.18.88.62	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:24 UTC	385	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:24 UTC	1351	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:24 GMT Content-Type: image/png Content-Length: 3014 Connection: close CF-Ray: 8e1f62986bace587-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 488797 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 27fc50e60026c8530ee4d90073929962.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: ASnqDWbdrevKLgnhiOMnaDTkv3gudvqwqpVAkUadUKyNaDG1VOmPTg== X-Amz-Cf-Pop: DFW57-P8 x-amz-id-2: h5g5Dp5hkRRNfU6r2Cdnst8+BtecrNU2ARjJ4QJnqARA2FfTfe8kX57tWiogaXjW11nI97+d3VI= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 0D0GWF3Q1E9HN8Y9 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront
2024-11-13 14:17:24 UTC	510	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 77 6e 71 38 4d 63 76 31 6b 6a 79 65 25 32 46 56 39 79 57 63 75 56 65 4d 4a 6e 49 42 50 4d 72 42 67 4d 53 76 77 78 45 4a 33 6a 65 57 76 74 31 38 30 44 4b 74 30 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wnq8Mcv1kjye%2FV9yWcuVeMJnIBPMrBgMSvwxEJ3jeWvt180DKt0
2024-11-13 14:17:24 UTC	877	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 26 08 06 00 00 00 81 16 d4 6c 00 00 0b 8d 49 44 41 54 78 da ec da 7b 68 97 55 1c c7 71 f7 9b b7 4d 73 22 65 a9 65 6a 2c bb 98 4d cc 2c 5d 28 26 d4 e8 42 17 b0 12 29 47 e2 46 9a b8 84 32 f3 32 32 6f 59 ce d4 c2 14 91 d4 4c 12 25 c3 b4 0b 16 69 46 a6 a5 2e 99 97 92 4c a7 65 da 98 64 73 6e ce 4f 6f f0 40 a7 83 3f f7 9c df cf 07 f6 1b cf 81 d7 1f db 79 be cf d9 73 9e f3 f9 3d 97 fd 9a 44 2d 6a 51 bb 44 d3 c8 26 43 31 dc c8 4d 72 5f 39 18 6e e9 1e cd 70 83 38 c7 57 a1 00 c5 78 17 eb b0 05 a5 38 64 ec c7 4e 6c c2 62 8c c5 3d 68 d6 08 e7 62 3c 16 60 06 ba d7 57 20 cb 47 49 0c 9c 8d 53 90 51 8e f6 d1 f2 6c 10 8b 62 20 94 a0 0a cc 47 e7 46 32 17 2b 20 a3 12 ed 43 0f 08 75 99 f8 09 32 6a d1 3f 5a Data Ascii: PNGIHDR&lIDATx{hUqMs"eej,M,](&B)GF222oYL%iF.LedsnOo@?ys=D-jQD&C1Mr_9np8Wx8dNlb=hb<`W GISQlb GF2+ Cu2j?Z
2024-11-13 14:17:24 UTC	1369	IN	Data Raw: 54 e1 ba d0 02 62 3e e1 fe 71 3e b9 3b 9a ee 64 03 b2 10 1f 3a b7 4f b3 d0 29 4e ed 20 94 fb 5c c9 e8 bf 05 95 10 80 d7 73 a5 f2 52 d5 db aa 2a a5 55 63 44 98 dc 90 64 3b 63 74 87 2c 2b 3c e6 63 3b 04 57 ef 80 f5 83 21 4b cf 24 02 e2 d6 dd 86 ef 20 cb 67 88 05 ac 2f 80 2c 35 98 54 cf f3 67 37 6c 84 2c 07 90 19 70 cc bb 20 cb 94 38 db 5d 83 fe c8 43 5f 34 f7 0e 08 3f 5f 81 03 90 51 87 7b 4d 77 d2 01 71 1e f8 cb d1 33 40 fd ad a8 81 8c 0a b4 8c b3 6d 2b ec 83 00 b0 e0 75 be 4e 12 ed 5c 8d b4 ed 7d 69 c9 30 69 6a 2f e9 d5 db a5 f9 0f 48 1b a6 4b 15 47 64 da 85 2b ca e8 4c 7b 9e 76 a3 a5 33 d6 5e e7 53 2f 16 e0 58 ae 85 2c 76 90 a7 06 9c cf 39 90 f1 6b c0 b7 58 b3 91 03 57 2e 1e c6 64 7c 03 39 d6 7a 2c d4 6e ce 6d 59 35 06 05 ac 8d 61 31 64 99 1e a4 ce 79 4e Data Ascii: Tb>q>;d:O)N \sR*UcDd;ct,+<c;W!K$ g/,5Tg7l,p 8]C_4?_Q{Mwq3@m+uN\}i0ij/HKGd+L{v3^S/X,v9kXW.d\|9z,nmY5a1dyN
2024-11-13 14:17:24 UTC	768	IN	Data Raw: 61 17 0f 58 55 82 05 92 85 81 44 b0 a7 c1 b7 df b1 00 c4 71 17 6c 31 08 8a 4e 13 81 e0 3c b3 07 da be 9c 22 02 c1 11 d8 9e cd 25 24 c5 f9 bb 9a 9b e4 96 1e 0e 7d dc ef 92 b3 35 3d 46 34 9a 14 66 2b f1 a9 6e 86 84 82 04 0b 24 0f 63 63 9a 3a 2d ea ba 81 c9 f0 51 1c 69 90 40 19 24 5d c6 02 01 9f ff 15 98 0b cf 49 21 81 2c 64 c8 0e f1 84 75 b6 93 53 7e fa 8a 0c e2 1c 27 21 e3 18 b3 7e ff 62 42 31 9e f1 18 ba d6 c5 93 44 c2 d9 44 6d b9 1d 22 d6 f3 9d a6 4e 0d d4 99 e6 f3 01 70 1b 99 1a 4b 50 64 3b 35 75 d6 d9 9e 8b b5 1a da f7 32 85 29 22 90 0c e6 17 6b 81 bc 75 df 60 8a 49 f7 ef 4e 2c c4 6b 7e 91 44 ab 49 38 a5 f1 ba 6c f3 f0 8c 6b 21 cd 3e 04 fd 56 27 41 20 75 d0 d7 6b 1e 72 e5 f6 5e 93 f4 12 fc 22 dd ad fd 2e e8 a3 95 19 9b 24 81 60 9d 79 0c 59 b3 63 11 d1 Data Ascii: aXUDql1N<"%$}5=F4f+n$cc:-Qi@$]I!,duS~'!~bB1DDm"NpKPd;5u2)"ku`IN,k~DI8lk!>V'A ukr^".$`yYc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49728	199.232.196.193	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:24 UTC	346	OUT	GET /QRF01zv.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:24 UTC	725	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1666 Content-Type: image/png Last-Modified: Wed, 17 Jul 2019 19:34:43 GMT ETag: "29d583007fcd677aa31ca849478bc17a" X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: _hKeuoxVkYw2QVgTw3r9CekWpMNFy7-2eWH7Tb40OtTj_WUPnqXoZQ== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 13 Nov 2024 14:17:24 GMT Age: 1392637 X-Served-By: cache-iad-kiad7000070-IAD, cache-dfw-kdfw8210145-DFW X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 31794, 3 X-Timer: S1731507445.686236,VS0,VE0 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2024-11-13 14:17:24 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 06 49 49 44 41 54 68 81 e5 9b 7b 88 56 45 14 c0 7f fb ed aa 59 a2 45 b9 bd b4 a7 95 8f b4 55 76 15 42 c9 f2 91 d4 1a 3d a8 20 2a 7b a8 f5 a7 19 65 65 a4 a5 92 f9 47 12 25 84 9a 88 a6 48 2f 29 92 55 52 31 5b c9 47 99 94 99 64 c6 1a be 12 5f 6d 19 d5 da d6 1f e7 7e 3a f7 7c f7 31 33 f7 1a 7e f4 83 65 ef 99 3b 73 ee 9c ef de 3b 67 e6 cc b9 15 0b 17 2e 26 67 0a 40 05 f0 77 c4 b9 47 81 e7 81 4b 81 7f 80 ef 80 c9 c0 7b 11 75 2b 81 d6 a0 5e ae 9d cb 93 6b 80 c5 c0 c0 88 73 2b 81 b9 c0 65 c8 0f 52 00 7a 01 ef 02 8b 22 ea 8f 04 16 00 17 e4 d9 c1 bc 0c be 05 d8 04 6c 07 7a 00 9f aa f3 ef 03 43 12 da df 07 bc a9 ca 56 01 23 80 7d c8 8f 35 28 8f 8e 66 35 f8 4e 60 Data Ascii: PNGIHDR<<:rIIDATh{VEYEUvB= *{eeG%H/)UR1[Gd_m~:\|13~e;s;g.&g@wGK{u+^ks+eRz"lzCV#}5(f5N`
2024-11-13 14:17:24 UTC	295	IN	Data Raw: 65 c8 bb 93 94 4c 52 4f 78 cb 66 11 fe 81 05 90 dc 2f 33 f3 6e 10 c9 23 f4 7e e0 5a 2c 26 3e b6 8b 87 46 e4 5b 85 6f 13 ea 3c a4 e4 59 96 ba a3 78 55 c9 a3 13 ea ae 21 bd 6f 27 70 59 2d 1d 42 7e c5 39 31 e7 47 23 33 a1 22 6f 10 5e b8 db b2 81 70 b2 ea 25 c8 37 11 51 4c 41 e6 ee d6 e1 25 9f e5 e1 58 64 4f 59 af 88 3a 13 76 05 2d 44 24 86 59 a0 13 e3 9e a0 74 dd be 17 71 87 2f b8 2a f7 5d 0f 7f 88 84 4c c6 10 0e f5 4c 25 1c 6f 5a 80 7c ba 63 cb 8b 48 0a 70 91 de 84 3f fc d8 03 dc 8b ec 17 af 75 d0 7b 82 ac 01 80 b9 48 6e d7 38 64 0b f3 4c 60 a1 aa 33 06 f8 cc 42 d7 52 4a 13 42 df 0e fe 37 21 af 4c 17 82 65 9e 2f 79 45 3c 5e 43 ee ec 08 a0 1d a5 33 a2 7a 24 4d 3f 8e 46 4a 3f f5 a9 47 fc ea 40 24 9f e3 ad 3c 3a 9a 77 88 67 05 32 88 68 f7 d0 8c 2c 25 a7 23 91 Data Ascii: eLROxf/3n#~Z,&>F[o<YxU!o'pY-B~91G#3"o^p%7QLA%XdOY:v-D$Ytq/*]LL%oZ\|cHp?u{Hn8dL`3BRJB7!Le/yE<^C3z$M?FJ?G@$<:wg2h,%#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49731	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:24 UTC	949	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:25 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 14:17:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 88f94958-e9f7-49e6-8d29-4bf868df111f X-Runtime: 0.011508 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:25 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49730	44.221.189.90	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:25 UTC	427	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:25 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:25 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Tue, 12 Nov 2024 17:16:11 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-13 14:17:25 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-11-13 14:17:25 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-11-13 14:17:25 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 14:17:27 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=95255 Date: Wed, 13 Nov 2024 14:17:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49739	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H2v4H2zSPDzDOkT&MD=5yr69fTA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 14:17:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1efdebce-e307-430b-a4e3-7ec2d77ccdff MS-RequestId: 7bb7f6f5-d488-4044-9abb-77063607c0cd MS-CV: /ZaFnEHUm0iwIdcm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 14:17:27 GMT Connection: close Content-Length: 24490
2024-11-13 14:17:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-13 14:17:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49741	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 14:17:28 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=95291 Date: Wed, 13 Nov 2024 14:17:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-13 14:17:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49742	54.161.127.194	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:28 UTC	913	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/c3955b1c48a/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:28 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:28 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Tue, 12 Nov 2024 17:16:59 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49743	44.221.189.90	443	7084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:17:29 UTC	352	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 14:17:29 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 14:17:29 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Tue, 12 Nov 2024 17:16:59 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49745	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 14:18:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H2v4H2zSPDzDOkT&MD=5yr69fTA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 14:18:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6cfd1add-5128-4718-be68-0e534a218091 MS-RequestId: 64435696-4a33-44c7-9483-760c325d53c6 MS-CV: TtT1P0zvrEq1BtyK.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 14:18:05 GMT Connection: close Content-Length: 30005
2024-11-13 14:18:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-13 14:18:06 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	09:17:15
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:17:16
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,6779728348533419189,3921659482374428394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:17:17
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://employeeportal.net-login.com/XejZPSm40VzZYQzhLVFQyelZtNXRraW5JL01GWGVMQmM4YndubzZZNlhhUVhCYmFYbU1Oc2NUWXZqYUJRejZvVThUT1ExM0xLdnk0OGFWb0JHN3BZaWkrQmxkN3lTTXE2ZUdJT213NHJzT3FrcUFuTW5yTVFmWHFFNzVhZUJUYVRCVGlnRVhNdEtWU252WHJkVWIxNnY4VS9rbXBIMitSbytpTm1QbWdJQndQNVorKytuZCtyNTJ3PS0tdWkyYjJhRTQwOGpzMkFjMS0tY0ZER1UyOFJzUW9xeXFBMW1INXRGQT09?cid=2276287906"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81