Edit tour

Windows Analysis Report
https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0

Overview

General Information

Sample URL:	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVN
Analysis ID:	1582436
Infos:

Detection

KnowBe4

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected KnowBe4 simulated phishing

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2212,i,7014414118843156653,1828310357329428657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857

Avira URL Cloud: detection malicious, Label: phishing

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match

File source: 1.0.pages.csv, type: HTML

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://chase.com-onlinebanking.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://chase.com-onlinebanking.com

Source: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09

HTTP Parser: No favicon

Source: global traffic	TCP traffic: 192.168.2.4:61803 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:59434 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:63697 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857 HTTP/1.1Host: chase.com-onlinebanking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 HTTP/1.1Host: account.secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: account.secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: account.secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4STOP.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4STOP.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: account.secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjwIf-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2"If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: account.secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: account.secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjwIf-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2"If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chase.com-onlinebanking.com
Source: global traffic	DNS traffic detected: DNS query: account.secured-login.net
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=erIuv3NLfno%2BSFPthwb2df4aQQl9%2Fg4%2BPeO2HwSKrGtUznqpNckv4UdiYbVT5PZALZRaFwBeL8i8lgMvhcXqJ4F7hs7YMDIKOe7yyJd7PFad9o%2F9s4jdYsmZsW%2FZ05mPI6g%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 423Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: sets.json.0.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.0.dr	String found in binary or memory: https://24.hu
Source: sets.json.0.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: chromecache_60.2.dr	String found in binary or memory: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVE
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: chromecache_57.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_57.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4STOP.png
Source: sets.json.0.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://css-load.com
Source: sets.json.0.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.0.dr	String found in binary or memory: https://deere.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://drimer.io
Source: sets.json.0.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.0.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.0.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.0.dr	String found in binary or memory: https://html-load.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://img-load.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.0.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.0.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.dr	String found in binary or memory: https://interia.pl
Source: sets.json.0.dr	String found in binary or memory: https://intoday.in
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livechat.com
Source: sets.json.0.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://naukri.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.0.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://p106.net
Source: sets.json.0.dr	String found in binary or memory: https://p24.hu
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.0.dr	String found in binary or memory: https://text.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://the42.ie
Source: sets.json.0.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.0.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://top.pl
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.0.dr	String found in binary or memory: https://zoom.com
Source: sets.json.0.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 59435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59449
Source: unknown	Network traffic detected: HTTP traffic on port 59445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59450
Source: unknown	Network traffic detected: HTTP traffic on port 59443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61819
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59443
Source: unknown	Network traffic detected: HTTP traffic on port 59444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59440
Source: unknown	Network traffic detected: HTTP traffic on port 59442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59442
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59441
Source: unknown	Network traffic detected: HTTP traffic on port 59439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1136_2027786195

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@18/20@14/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2212,i,7014414118843156653,1828310357329428657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2212,i,7014414118843156653,1828310357329428657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://account.secured-login.net/favicon.ico	0%	Avira URL Cloud	safe
https://nourishingpursuits.com	0%	Avira URL Cloud	safe
https://gliadomain.com	0%	Avira URL Cloud	safe
https://mystudentdashboard.com	0%	Avira URL Cloud	safe
https://songstats.com	0%	Avira URL Cloud	safe
https://songshare.com	0%	Avira URL Cloud	safe
https://p106.net	0%	Avira URL Cloud	safe
https://hazipatika.com	0%	Avira URL Cloud	safe
https://cardsayings.net	0%	Avira URL Cloud	safe
https://cognitiveai.ru	0%	Avira URL Cloud	safe
https://thirdspace.org.au	0%	Avira URL Cloud	safe
https://cognitive-ai.ru	0%	Avira URL Cloud	safe
https://salemovetravel.com	0%	Avira URL Cloud	safe
https://infoedgeindia.com	0%	Avira URL Cloud	safe
https://landyrev.com	0%	Avira URL Cloud	safe
https://account.secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	0%	Avira URL Cloud	safe
https://salemovefinancial.com	0%	Avira URL Cloud	safe
https://smpn106jkt.sch.id	0%	Avira URL Cloud	safe
https://indiatodayne.in	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cdn2.hubspot.net	104.18.87.62	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.google.com	142.250.185.196	true	false	high
landing.training.knowbe4.com	3.88.121.169	true	false	high
chase.com-onlinebanking.com	unknown	unknown	false	high
account.secured-login.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	false		high
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false		high
https://account.secured-login.net/favicon.ico	false	Avira URL Cloud: safe	unknown
https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09	false		unknown
https://account.secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.0.dr	false		high
https://mercadoshops.com.co	sets.json.0.dr	false		high
https://gliadomain.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://poalim.xyz	sets.json.0.dr	false		high
https://mercadolivre.com	sets.json.0.dr	false		high
https://reshim.org	sets.json.0.dr	false		high
https://nourishingpursuits.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://medonet.pl	sets.json.0.dr	false		high
https://unotv.com	sets.json.0.dr	false		high
https://mercadoshops.com.br	sets.json.0.dr	false		high
https://joyreactor.cc	sets.json.0.dr	false		high
https://zdrowietvn.pl	sets.json.0.dr	false		high
https://johndeere.com	sets.json.0.dr	false		high
https://songstats.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://baomoi.com	sets.json.0.dr	false		high
https://supereva.it	sets.json.0.dr	false		high
https://elfinancierocr.com	sets.json.0.dr	false		high
https://bolasport.com	sets.json.0.dr	false		high
https://rws1nvtvt.com	sets.json.0.dr	false		high
https://desimartini.com	sets.json.0.dr	false		high
https://hearty.app	sets.json.0.dr	false		high
https://hearty.gift	sets.json.0.dr	false		high
https://mercadoshops.com	sets.json.0.dr	false		high
https://heartymail.com	sets.json.0.dr	false		high
https://nlc.hu	sets.json.0.dr	false		high
https://p106.net	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://radio2.be	sets.json.0.dr	false		high
https://finn.no	sets.json.0.dr	false		high
https://hc1.com	sets.json.0.dr	false		high
https://kompas.tv	sets.json.0.dr	false		high
https://mystudentdashboard.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://songshare.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://smaker.pl	sets.json.0.dr	false		high
https://mercadopago.com.mx	sets.json.0.dr	false		high
https://p24.hu	sets.json.0.dr	false		high
https://talkdeskqaid.com	sets.json.0.dr	false		high
https://24.hu	sets.json.0.dr	false		high
https://mercadopago.com.pe	sets.json.0.dr	false		high
https://cardsayings.net	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://text.com	sets.json.0.dr	false		high
https://mightytext.net	sets.json.0.dr	false		high
https://pudelek.pl	sets.json.0.dr	false		high
https://hazipatika.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://joyreactor.com	sets.json.0.dr	false		high
https://cookreactor.com	sets.json.0.dr	false		high
https://wildixin.com	sets.json.0.dr	false		high
https://eworkbookcloud.com	sets.json.0.dr	false		high
https://cognitiveai.ru	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://nacion.com	sets.json.0.dr	false		high
https://chennien.com	sets.json.0.dr	false		high
https://drimer.travel	sets.json.0.dr	false		high
https://deccoria.pl	sets.json.0.dr	false		high
https://mercadopago.cl	sets.json.0.dr	false		high
https://talkdeskstgid.com	sets.json.0.dr	false		high
https://naukri.com	sets.json.0.dr	false		high
https://interia.pl	sets.json.0.dr	false		high
https://bonvivir.com	sets.json.0.dr	false		high
https://carcostadvisor.be	sets.json.0.dr	false		high
https://salemovetravel.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://sapo.io	sets.json.0.dr	false		high
https://wpext.pl	sets.json.0.dr	false		high
https://welt.de	sets.json.0.dr	false		high
https://poalim.site	sets.json.0.dr	false		high
https://drimer.io	sets.json.0.dr	false		high
https://infoedgeindia.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://blackrockadvisorelite.it	sets.json.0.dr	false		high
https://cognitive-ai.ru	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://cafemedia.com	sets.json.0.dr	false		high
https://graziadaily.co.uk	sets.json.0.dr	false		high
https://thirdspace.org.au	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com.ar	sets.json.0.dr	false		high
https://smpn106jkt.sch.id	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://elpais.uy	sets.json.0.dr	false		high
https://landyrev.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://the42.ie	sets.json.0.dr	false		high
https://commentcamarche.com	sets.json.0.dr	false		high
https://tucarro.com.ve	sets.json.0.dr	false		high
https://rws3nvtvt.com	sets.json.0.dr	false		high
https://eleconomista.net	sets.json.0.dr	false		high
https://helpdesk.com	sets.json.0.dr	false		high
https://mercadolivre.com.br	sets.json.0.dr	false		high
https://clmbtech.com	sets.json.0.dr	false		high
https://standardsandpraiserepurpose.com	sets.json.0.dr	false		high
https://07c225f3.online	sets.json.0.dr	false		high
https://salemovefinancial.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.br	sets.json.0.dr	false		high
https://zoom.us	sets.json.0.dr	false		high
https://commentcamarche.net	sets.json.0.dr	false		high
https://etfacademy.it	sets.json.0.dr	false		high
https://mighty-app.appspot.com	sets.json.0.dr	false		high
https://hj.rs	sets.json.0.dr	false		high
https://hearty.me	sets.json.0.dr	false		high
https://mercadolibre.com.gt	sets.json.0.dr	false		high
https://timesinternet.in	sets.json.0.dr	false		high
https://indiatodayne.in	sets.json.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.87.62	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
3.88.121.169	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582436
Start date and time:	2024-12-30 16:04:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@18/20@14/6

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.186.142, 64.233.184.84, 172.217.23.110, 142.250.185.174, 142.250.186.46, 142.250.64.110, 74.125.0.137, 2.22.50.131, 192.229.221.95, 142.250.184.195, 34.104.35.123, 184.28.90.27, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, r4.sn-ab5l6nk6.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, r4---sn-ab5l6nk6.gvt1.com, update.googleapis.com, clients.l.google.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857

Input	Output
URL: https://chase.com-onlinebanking.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://chase.com-onlinebanking.com
URL: https://account.secured-login.net/assets/applicati... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is well-structured and does not exhibit any aggressive or obfuscated behavior. Overall, this script is likely benign and used for legitimate web development purposes." }
/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){va
URL: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrM Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Oops! You clicked on a simulated phishing test.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrM Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Reputation:	low
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2368
Entropy (8bit):	7.857782123483033
Encrypted:	false
SSDEEP:	48:eN+jd/MwX0F4lR7ZlqMmlNl08Q0+mNUjxulVE2Uh9wg0n:Njd/M62KJZVmlDJQ0+mGxykh9wg0
MD5:	402214A564EAB22101571DF8C6E30B79
SHA1:	D5E452981A5C325383F92BFB964BA28ECEA6FFA6
SHA-256:	8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
SHA-512:	D7FD2C24B182ACEA57713FB9EFD19371802B1AE748F7B01FA82D822A86F70267D94C5105FB6BD1967BCDBC1FC43DE484F2B647DFD1EC729531BD4E89814CA42C
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Preview:	RIFF8...WEBPVP8L,.../.@...0..M._.w..1..WVaU.W,K..m..}.J.]...=..:].Dz.=....~......M.O.PneX(.......3.4..........;.f;..I2..L.....$[J....wA.a....,....@.$.].m.m.m..l.N.mcO..l.-....[t...5....-.%.....A.f ..D.`._@+.q.?.....8...(..-.^.i.,...]f..a...i....Tw.p..B....."...J'......O..J9..L.%P...{..H..JP.jP-.Cu...P{jFU..%.P[.%B....3....X.'PO.Y.....bE....P........?J.U...P!......O5.M..rT./LQ"JI..uCR...BR...S...-U.].YR...(..R..t4.....J...c..J1)\|....) ^.C....=`.bR..~+.h.5.T......".....GS.u..\|.._Dj..".D....,.7....<1.PU.t...X}.[8H1;T!+....H...R..I.\..f..V..P.S..+...m..s.659FlS.I....Ph.).....GhV.v+...&......l...K.^Q.)...7....5.<....a..%.t....<.(.....;2.n....K...9.J.B....Lf...T..!a..(....0H....E1......Qn.+.j.....v.R6.1G..?B......~.....&R....F...2.....}.(m.....).....]..I.....~.e.Z.T..U..C.OE.[......Zq..F.hc.W..,E.\|.Bu..SQ;..`.a.......\|..?..}..COX4.....!{'P..J.8:..U...\..S.{8U1......J.P.N*._...9L......#<...v..n...M...8..##.r..]\..e\|.....D.t.@...

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24928
Entropy (8bit):	7.97874114626333
Encrypted:	false
SSDEEP:	768:/5pfr6csml/HNeqHSTG4vbMkILdCSaPxATa6ErALuK:/5pfGcBl/teqyTbDMLUA2/q3
MD5:	E82AA862CE3DF8A64582356BB8DFDC62
SHA1:	7F3B4D50734E19F79FE6B2A3E6AFF2BD051B4C26
SHA-256:	F39A380210C979A03E6FD9A1F848782D0FAA8D78A4910A2A67C394EBB89B9B87
SHA-512:	AAB03057855D200F438E42AF3D123CCD5DB3AEF93307CABDBEA6C96FF32CB41A8B6C506EB68A05CBDC9218398653568972FD78514CBFA144F77E22C83F43537A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............6...a'IDATx....o.W...CJ..R.7\.dmeU.b9..k.../.6.~_'v\.......'Mq....7.J_@.[*.).6..8._b;^....V../....Y....3..sf....Y...>.=.............(.A.5v".<&u*..i..9.niS..h.f?.<8y&~`.\|...]...^..<..v9\...n'.O...x.=V....P..M...%d....U..=YW:..P.@S....+}YF..mrI..R..'....TsN.4L.....J.......,U.........t..;b.?>.xQ....J...y......MS..@..Zg..x.9....y).P0...].... <tJ.Y....B... <...0....F..S...+)..~......'D..Xr%.\.Z...0......w.....je...z.o.`ac... ....\|e...'...%.C.._:..^.......+...\Vc..h..."?.\|.........X.KW.n98..!..KY.`.;.e.<P.P.......D>.E......X...O....o..m..]K..w.]._..n...?i.~.c....qwI.............DCA.......Aq....."._...J..^W.i..{.....D$.Y...m...9.&.A..`...z...t......b.iJ...............].'...d. ...e%..A..\h73.t.K...(...%H...._!...r;r{r.r..Jok&... .@..r.q9...)...}...4..6i...nb.g%D.......G.`....&.e..S.'_..454l.#Y?... @.D..Lk.L.1.vG]I>.$J.^...:.~.G....../.......d.<... @....<..X...d.... .i.... ..&..... ..2.....d...MS.}..0.^....;..-=..,.s..

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (402)
Category:	downloaded
Size (bytes):	3390
Entropy (8bit):	5.3927765046357194
Encrypted:	false
SSDEEP:	96:O4/OnRx/OMqJ36gFXBTPBQYByJ4tS815dvzCzwDX:ObRx03zFXN9DSU5d6wz
MD5:	5E5F6A82F37238FE32D0B518F3888FA4
SHA1:	A5A3291B74B2C45B6B343D759E10BBEAF8F6E53B
SHA-256:	A13602D9F5E348ADBA8B7AFAA4B8525F7AEEC0F17B084D5F6F78988E2D38C0EA
SHA-512:	F59CF7BA5FA76DF78D94737A0B599D5AFBC5035A8DAD6E40CF333D09D2EF4EE72A324291B3AE77400D24F51E92CDA99D730194EF310D5BB268BF7A729048533A
Malicious:	false
Reputation:	low
URL:	https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />.. </head>. .<title></title>.<style type="text/css">*, html {box-sizing:border-box;}..body {font-family:Helvetica,Arial,sans-serif;}..img.check {width:50px;height:auto;}..ul {margin:5px 0;font-size:20p

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
Reputation:	low
URL:	https://account.secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
URL:	https://account.secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (423)
Category:	downloaded
Size (bytes):	477
Entropy (8bit):	5.857990124394054
Encrypted:	false
SSDEEP:	12:3R+xSk/Pki9gX4R1oszvf1/38Vl30tpQ7Xlt4AEdeIQL:330PBgIESn1w30jQ7XltNEkj
MD5:	B53B3C38FC9A00F5A0097FDB8DA2DA26
SHA1:	3E12A03A08B0AC0EE81CBBDB79F0B1ECD5290872
SHA-256:	9073C3D1148CBD25E77F913BFE6C31286C46E5BF0F38357A8FD1915A728D37F8
SHA-512:	AAB3A0002811C721A30E0E490CC0204D5EE2A7DF825492798AE12F6C78A94CFB1C711B09135C2EE38EF0E00A0C8DD632509F2DAF920B2BE0DF1EEADE64974B79
Malicious:	false
Reputation:	low
URL:	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857
Preview:	<html>. <head>. <script>window.location.href = 'https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	21550
Entropy (8bit):	7.981228823349243
Encrypted:	false
SSDEEP:	384:5kHixOjr944J75e9zgynKCLNXiBmVEyURep7YSFnv8Krht7TD2B:5kCyC4JMxgyKX8EPRs7YSB0W/XDy
MD5:	DE4FE71574242F6567BE09E099185FDF
SHA1:	699EABCC3A8A6CC474D01E737A5AA587D8FC7C12
SHA-256:	4BA1B4B0EAB745F192FB7B7B00558C41FF210F178F0A30A7C4450BBD0D23BD27
SHA-512:	87B6BD8180B9350EF258E6671FB2518FAD9866C66D240D097CE96D8C6089993D2B21AEB42D6625C6410895ED7BF4431A12256FD184C9D23A48166F560D9DCA60
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4STOP.png
Preview:	RIFF&T..WEBPVP8L.T../..c..Hn.I....gq....Y.5.....`{q....}@........".@S..O%..\|B.B.sR.d......=.$..l...!.\;P..@..eFb..C.Qt.....#...(.eS.....{.j.eW..3..^}.8..j..f.:...9...0..I.h.. .....p...4./`P........0&]R.Z. &...h..N...J4..w.h...kB.K.l.!..8[.................k..Z~...~..$.F.v-2\.>.W1].p.B.m.i#.S'.R..5Ts.z.._.3.Y. tV 7.m.n..`...m..8l6....mw.jQ.......#L./F..`...<..t..B.......O..._b.........3.H.;... 9.O...I....C..!r.....rx...Y...;O..M..%em.#.n.;......q..VR9..9r..bg'....!_b....o.<....Wv.<Z.<..<.....`....M.g..\|e...@@......'......8..sx..O...........B~.p....B....T.9..B.A.....Z9.......Z..._...T.cYs........Q............`. ....".....+....8.P-...-F...x....5q\|_..........`...l......5..6.........O.......8.(EPq....m^...$.'.A..9><.p&......`.....v.l..L.....B.YQ.."..'..5.f2.....F..)V..l..)j.0I..+a......R.hr&..\.;3.!.MV.6.<q.3FY.."-6.,l.q.....9....!.tVz.~m....44.,.8.B5..:........A(....r.....Rt....WXH.....gnt:....=f.k_.V..dA."....T..a...Ngi...V4..*mK.E.Xh,tff....B.(.b

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	7.902919939139106
Encrypted:	false
SSDEEP:	48:vnJJCJaqcfDoxU8qAg6opvwr+FYc1lWO1pPGDfMexqwFYRFlIe9BhGtAHIWVRs:vnJJ8CESXp66vwPuGDfMexqwALvhTFTs
MD5:	E154B58FD2CD3F1F2E2C6C810BB1E65B
SHA1:	CAEF301E8550A910909ECE9471669DA0C32EA6F0
SHA-256:	E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
SHA-512:	464EC940E824EAB8B7F83EB40852DD3019E84BE7B1A0F75AF288656605426B2EE386FA7FF102E0144AA065F053E88E8356E7C185B4DC393CC4D8EB0ADC877312
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......&........l....IDATx...{h.U..q...Ms"e.ej,..M.,](&..B...)G.F...2.22oY......L.%...iF......L.e.dsn.Oo.@..?...........y...s...=...D-jQ.D..&C1..Mr_9.n...p.8.W...x....8d..Nl.b..=h...b<.`...W .GI...S.Q....l..b ....G.F2.+ ...C..u...2j.?Z.).....!-...d)2]..d.;p.,.t@>F>.3}9....... ......v@.>4.= ..B.5H..e.....5i.?NP....<.Y.LWx.a.>8..?.M.$S> .C...r...:.,...OLWx.a.v8.....c.....Z../...M........m.,..Rl..1.X.Y........j@.@.%.2l....YJR..?.....5 ..G.d.BF./.L\........,J..~...0]...,...q.7x....h}.m..#...."<...0q....8.9.`...e...EV...m..p.M}H.y...H..l.~...x..0...<.....d..Xh.1.~.Y.M`.].Q....:...8.....M1.'..~.h...g{..OD..f.Hc.g.(..)....,.y.w.\.....HO" /A.\..Z@...$...].,.<.G..WavB...q....\...H..<.t=d...-VWTC.I........jv...!....N@..0..M...."._B....%X.R.q.....W.'WAL..'m].+.j.pF.8,...V.Jc..@....E...\|L...=.[..2&^......y....X..1..(.F..,..f.5..dT...b>..q>.;..d....:.O..)N. ..\.......s..R...UcD..d;ct.,+<.c;.W...!K.$..... .g.../.,5.T..g7l.,...p. .8.]...C_4...?

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 16:05:26.520211935 CET	49675	443	192.168.2.4	173.222.162.32
Dec 30, 2024 16:05:36.126127005 CET	49675	443	192.168.2.4	173.222.162.32
Dec 30, 2024 16:05:38.688667059 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:38.688733101 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:38.688813925 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:38.689021111 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:38.689038992 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.321360111 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.321639061 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:39.321655989 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.322699070 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.322767973 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:39.323826075 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:39.323884964 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.378032923 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:39.378055096 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:39.424885035 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:40.613251925 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.613296986 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:40.613351107 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.614120007 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.614166021 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:40.614216089 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.615010023 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.615025997 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:40.615309000 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:40.615330935 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.233053923 CET	59434	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.237865925 CET	53	59434	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.238054991 CET	59434	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.238126040 CET	59434	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.242831945 CET	53	59434	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.294796944 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.295037031 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.295054913 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.295943022 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.296056032 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.298206091 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.298537970 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.298551083 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.299432993 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.299530983 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.300543070 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.300606012 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.300981045 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.300981998 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.300991058 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.301042080 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.349648952 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.349666119 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.349700928 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.396184921 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.591016054 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.591103077 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.591198921 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.595351934 CET	49740	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.595365047 CET	443	49740	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.674688101 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.674727917 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.674803019 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.676634073 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.676635981 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.676646948 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.676654100 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.676740885 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.677453995 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:41.677472115 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:41.683197975 CET	53	59434	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.684006929 CET	59434	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.689729929 CET	53	59434	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.689897060 CET	59434	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:42.324635029 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.327158928 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.327172041 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.328099966 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.328166962 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.329190969 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.329242945 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.329381943 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.329387903 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.354903936 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.355501890 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.355525017 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.356446028 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.356507063 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.356770992 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.356822968 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.379717112 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.411065102 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:42.411078930 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:42.460325956 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.352221012 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.352245092 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.352314949 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.352315903 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.352370977 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.353741884 CET	59436	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.353751898 CET	443	59436	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.370968103 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.372164965 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.372188091 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.372358084 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.373049021 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.373058081 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.380495071 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.380527020 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.380584002 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.380685091 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.380723000 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.380779028 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.380896091 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.380909920 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.381030083 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.381045103 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.411334991 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.522128105 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.522145987 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.522202015 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.522303104 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.522303104 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.525315046 CET	59435	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.525327921 CET	443	59435	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.836101055 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.836560965 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.836575031 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.836860895 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.837393045 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.837447882 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.837656021 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:44.838463068 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.838676929 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.838707924 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.839592934 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.839790106 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.839798927 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.839857101 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.841279030 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.841336966 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.841595888 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.841604948 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.855245113 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.855484962 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.855505943 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.856580973 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.856646061 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.856654882 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.856703043 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.857316017 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.857383013 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.857505083 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.857512951 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:44.879328012 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:44.895029068 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:44.910198927 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.015304089 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.015377998 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.015413046 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.015453100 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.015480995 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.015492916 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.015541077 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.036027908 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.036046028 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.036062002 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.036113977 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.036123037 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.036175966 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.037101984 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.037117004 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.037178040 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.037184000 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.044687986 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.044785976 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.044819117 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.044836044 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.044846058 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.044892073 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.044899940 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.044991970 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.045021057 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.045034885 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.045043945 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.045082092 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.045506001 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.049444914 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.049475908 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.049504042 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.049506903 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.049518108 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.049554110 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.091054916 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.091056108 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.123631001 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.123647928 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.123727083 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.123733997 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.123785019 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.124190092 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.124202967 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.124269009 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.124274969 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.124317884 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.125617027 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.125632048 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.125690937 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.125695944 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.125754118 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.125765085 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.127561092 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.127576113 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.127652884 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.127657890 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.127693892 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.135508060 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135569096 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135598898 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135618925 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.135627985 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135672092 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.135727882 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135797977 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.135849953 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.211236954 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.211261034 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.211435080 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.211440086 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.211489916 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.211918116 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.211930990 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.212008953 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.212013960 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.212049961 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.212860107 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.212888002 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.212937117 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.212943077 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.212992907 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.213005066 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.213926077 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.213938951 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.214000940 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.214004993 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.214045048 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.214770079 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.214783907 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.214838028 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.214842081 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.214888096 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.214903116 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.215693951 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.215707064 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.215775013 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.215780020 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.215810061 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.215827942 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.230969906 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.231038094 CET	59440	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.231091976 CET	443	59440	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.241708994 CET	59439	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.241720915 CET	443	59439	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.282764912 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.282783031 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.282841921 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.282983065 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.283065081 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.283127069 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.283169985 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.283180952 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.283284903 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.283322096 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.298815012 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.298830986 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.298907995 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.298914909 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.298953056 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.299434900 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.299448013 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.299490929 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.299495935 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.299526930 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.299541950 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.299993992 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.300007105 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.300050974 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.300055027 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.300084114 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.300098896 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.303417921 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.303431034 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.303479910 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.303508997 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.303514957 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.303581953 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.304299116 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304311991 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304374933 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.304378986 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304409981 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.304802895 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304819107 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304862022 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.304867029 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.304936886 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.352229118 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386296988 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386311054 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386377096 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386382103 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386428118 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386606932 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386621952 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386668921 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386673927 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386712074 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386919975 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386938095 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.386970043 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.386977911 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387022972 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.387202978 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387217045 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387245893 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387253046 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.387257099 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387284994 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.387299061 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.387307882 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.387343884 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.389210939 CET	59438	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.389225960 CET	443	59438	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.444066048 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.444116116 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.444175005 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.444344997 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.444359064 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.470247984 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.470297098 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.470367908 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.470715046 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.470732927 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.471316099 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.471349955 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.471415997 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.471693993 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.471710920 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.737977028 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.738244057 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.738257885 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.739111900 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.739176989 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.739182949 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.739224911 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.739692926 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.739742994 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.739869118 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.739873886 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.742965937 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.743139982 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.743170023 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.744230032 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.744290113 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.744298935 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.744348049 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.744656086 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.744729996 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.744787931 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.744793892 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.800004959 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.800009012 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.897970915 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.898061037 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.898089886 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.898155928 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.898191929 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.898893118 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.898893118 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.907566071 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:45.907584906 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:45.907641888 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:45.907982111 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:45.907991886 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:45.922724962 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.923022985 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.923039913 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.923940897 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.924083948 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.924315929 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.924372911 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.924490929 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.924499989 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.926352024 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.927747011 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.929614067 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.929646015 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.929822922 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.929852009 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.929976940 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.930151939 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.930282116 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.930341959 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.930531025 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.930588961 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.930671930 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.930737972 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.934170008 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934242010 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934279919 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934293985 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.934313059 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934349060 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934355974 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.934362888 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934398890 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.934405088 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934808016 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934835911 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934859991 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.934866905 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.934909105 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.938807964 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.938858986 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.938921928 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:45.938926935 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.971332073 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:45.971338987 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:45.971909046 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:45.981038094 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.021713018 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.021759987 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.021802902 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.021814108 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.021965027 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.021996021 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.022010088 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.022016048 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.022042036 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.022057056 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.022061110 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.022094011 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.022110939 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.022155046 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.022403955 CET	59442	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.022418976 CET	443	59442	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.039767027 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.039809942 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.039864063 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.040332079 CET	59444	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.040349960 CET	443	59444	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.084110022 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.084131002 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.084194899 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.084394932 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.084405899 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.093398094 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.093497992 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.093542099 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.102204084 CET	59445	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.102216959 CET	443	59445	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.127074003 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127093077 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127099991 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127110004 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127134085 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127162933 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.127192020 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.127203941 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.127244949 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.128968954 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.128983974 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.129040956 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.129050970 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.144238949 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.144262075 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.144325018 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.144714117 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.144726038 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.175728083 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.207004070 CET	59441	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.207014084 CET	443	59441	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.217464924 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.217473984 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.217504978 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.217693090 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.217693090 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.217714071 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.217761993 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.218435049 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.218450069 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.218512058 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.218523979 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.218569040 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.219238997 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.219252110 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.219340086 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.219347954 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.219393015 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.307914019 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.307930946 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.307981968 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.307998896 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.308016062 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.308039904 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.308479071 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.308492899 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.308538914 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.308546066 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.308573008 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.308600903 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.309431076 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309446096 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309506893 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.309509993 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309520960 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309539080 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309547901 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.309575081 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.309581995 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.309592962 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.309624910 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.310375929 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.310389042 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.310451984 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.310460091 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.310502052 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.311404943 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.311419964 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.311480999 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.311492920 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.311537981 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.375389099 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.375673056 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.375679970 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.376518965 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.376657009 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.377720118 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.377770901 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.377876997 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.377882957 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.398511887 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.398529053 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.398586035 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.398598909 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.398628950 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.398650885 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.398960114 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.398976088 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399018049 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399025917 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399060011 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399075031 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399377108 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399391890 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399437904 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399446964 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399467945 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399477959 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.399969101 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.399982929 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.400034904 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.400043011 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.400088072 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.400173903 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.400187969 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.400238991 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.400245905 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.400288105 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.403630018 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.403645039 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.403713942 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.403723955 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.403779984 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.404372931 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404390097 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404443026 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.404450893 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404493093 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.404721022 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404735088 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404794931 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.404803038 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.404850960 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.425774097 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.489387989 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489408970 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489584923 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.489604950 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489659071 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.489727020 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489741087 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489785910 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.489793062 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.489831924 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490045071 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490060091 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490106106 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490113020 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490153074 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490216017 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490230083 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490272999 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490281105 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490294933 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490324020 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490329027 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490341902 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490350008 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.490430117 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490905046 CET	59443	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.490921021 CET	443	59443	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.501466990 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.501532078 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.501581907 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.501836061 CET	59446	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.501842976 CET	443	59446	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.502377033 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.502443075 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.502521038 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.502727032 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.502748013 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.554546118 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.554780960 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.554801941 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.555121899 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.555417061 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.555480957 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.555552959 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.599329948 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.616266966 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.616652966 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.616667032 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.616949081 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.620578051 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.620630980 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.620765924 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.665848970 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.665914059 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.665963888 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.666939020 CET	59448	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:05:46.666949034 CET	443	59448	3.88.121.169	192.168.2.4
Dec 30, 2024 16:05:46.667339087 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.818929911 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.819022894 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.819168091 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.820045948 CET	59449	443	192.168.2.4	104.18.87.62
Dec 30, 2024 16:05:46.820055962 CET	443	59449	104.18.87.62	192.168.2.4
Dec 30, 2024 16:05:46.963891029 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.964322090 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.964360952 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.964644909 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.964972973 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:46.965023041 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:46.965173006 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:47.011343002 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:47.093096018 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:47.093142986 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:47.093219995 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:47.093511105 CET	59450	443	192.168.2.4	35.190.80.1
Dec 30, 2024 16:05:47.093532085 CET	443	59450	35.190.80.1	192.168.2.4
Dec 30, 2024 16:05:49.234750986 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:49.234833956 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:05:49.235133886 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:49.271044016 CET	49737	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:05:49.271069050 CET	443	49737	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:23.433331013 CET	63697	53	192.168.2.4	162.159.36.2
Dec 30, 2024 16:06:23.438168049 CET	53	63697	162.159.36.2	192.168.2.4
Dec 30, 2024 16:06:23.438277960 CET	63697	53	192.168.2.4	162.159.36.2
Dec 30, 2024 16:06:23.443247080 CET	53	63697	162.159.36.2	192.168.2.4
Dec 30, 2024 16:06:23.883183956 CET	63697	53	192.168.2.4	162.159.36.2
Dec 30, 2024 16:06:23.888199091 CET	53	63697	162.159.36.2	192.168.2.4
Dec 30, 2024 16:06:23.888263941 CET	63697	53	192.168.2.4	162.159.36.2
Dec 30, 2024 16:06:26.363241911 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:06:26.363269091 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:06:36.030422926 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:06:36.030531883 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:06:36.030600071 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:06:36.668505907 CET	61803	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:06:36.673356056 CET	53	61803	1.1.1.1	192.168.2.4
Dec 30, 2024 16:06:36.673445940 CET	61803	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:06:36.678323984 CET	53	61803	1.1.1.1	192.168.2.4
Dec 30, 2024 16:06:37.117461920 CET	61803	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:06:37.122734070 CET	53	61803	1.1.1.1	192.168.2.4
Dec 30, 2024 16:06:37.122817039 CET	61803	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:06:37.271866083 CET	49739	443	192.168.2.4	3.88.121.169
Dec 30, 2024 16:06:37.271898985 CET	443	49739	3.88.121.169	192.168.2.4
Dec 30, 2024 16:06:38.739727974 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:38.739768028 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:38.739892960 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:38.740123987 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:38.740138054 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:39.380327940 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:39.380650043 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:39.380681038 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:39.381020069 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:39.381508112 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:39.381570101 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:39.425631046 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:43.676311016 CET	49723	80	192.168.2.4	199.232.210.172
Dec 30, 2024 16:06:43.676378965 CET	49724	80	192.168.2.4	199.232.210.172
Dec 30, 2024 16:06:43.681395054 CET	80	49723	199.232.210.172	192.168.2.4
Dec 30, 2024 16:06:43.681659937 CET	80	49724	199.232.210.172	192.168.2.4
Dec 30, 2024 16:06:43.681677103 CET	49723	80	192.168.2.4	199.232.210.172
Dec 30, 2024 16:06:43.681735992 CET	49724	80	192.168.2.4	199.232.210.172
Dec 30, 2024 16:06:49.289710045 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:49.289783955 CET	443	61819	142.250.185.196	192.168.2.4
Dec 30, 2024 16:06:49.289921999 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:51.272490978 CET	61819	443	192.168.2.4	142.250.185.196
Dec 30, 2024 16:06:51.272500038 CET	443	61819	142.250.185.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 16:05:34.861897945 CET	53	53402	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:34.897674084 CET	53	61325	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:36.172740936 CET	53	52047	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:38.680465937 CET	53310	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:38.680656910 CET	63280	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:38.687419891 CET	53	63280	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:38.687908888 CET	53	53310	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:40.540139914 CET	62639	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:40.540412903 CET	56078	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:40.593076944 CET	53	56078	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:40.611531973 CET	53	62639	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.232481003 CET	53	58360	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.633128881 CET	58731	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.635045052 CET	49192	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:41.672319889 CET	53	58731	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:41.673489094 CET	53	49192	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:44.372680902 CET	53408	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:44.372823954 CET	58386	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:44.379990101 CET	53	58386	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:44.380053043 CET	53	53408	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.274909019 CET	51380	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.275068998 CET	51104	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.282049894 CET	53	51380	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.282437086 CET	53	51104	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.401926041 CET	62160	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.402070999 CET	62795	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.420305967 CET	53	62795	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.443402052 CET	53	62160	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.900108099 CET	63077	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.900394917 CET	53150	53	192.168.2.4	1.1.1.1
Dec 30, 2024 16:05:45.907010078 CET	53	53150	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:45.907021046 CET	53	63077	1.1.1.1	192.168.2.4
Dec 30, 2024 16:05:55.260162115 CET	138	138	192.168.2.4	192.168.2.255
Dec 30, 2024 16:06:23.432790995 CET	53	49758	162.159.36.2	192.168.2.4
Dec 30, 2024 16:06:23.907018900 CET	53	53625	1.1.1.1	192.168.2.4
Dec 30, 2024 16:06:34.591342926 CET	53	59282	1.1.1.1	192.168.2.4
Dec 30, 2024 16:06:36.668025017 CET	53	65197	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 16:05:38.680465937 CET	192.168.2.4	1.1.1.1	0x6ca3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:38.680656910 CET	192.168.2.4	1.1.1.1	0x13dc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 30, 2024 16:05:40.540139914 CET	192.168.2.4	1.1.1.1	0xef17	Standard query (0)	chase.com-onlinebanking.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.540412903 CET	192.168.2.4	1.1.1.1	0xe459	Standard query (0)	chase.com-onlinebanking.com	65	IN (0x0001)	false
Dec 30, 2024 16:05:41.633128881 CET	192.168.2.4	1.1.1.1	0x47b7	Standard query (0)	account.secured-login.net	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.635045052 CET	192.168.2.4	1.1.1.1	0x306	Standard query (0)	account.secured-login.net	65	IN (0x0001)	false
Dec 30, 2024 16:05:44.372680902 CET	192.168.2.4	1.1.1.1	0x3c62	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:44.372823954 CET	192.168.2.4	1.1.1.1	0xcea8	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Dec 30, 2024 16:05:45.274909019 CET	192.168.2.4	1.1.1.1	0x3cc3	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.275068998 CET	192.168.2.4	1.1.1.1	0xb92c	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Dec 30, 2024 16:05:45.401926041 CET	192.168.2.4	1.1.1.1	0xf64a	Standard query (0)	account.secured-login.net	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.402070999 CET	192.168.2.4	1.1.1.1	0xc1bf	Standard query (0)	account.secured-login.net	65	IN (0x0001)	false
Dec 30, 2024 16:05:45.900108099 CET	192.168.2.4	1.1.1.1	0xfda7	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.900394917 CET	192.168.2.4	1.1.1.1	0x5ad2	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 16:05:38.687419891 CET	1.1.1.1	192.168.2.4	0x13dc	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 30, 2024 16:05:38.687908888 CET	1.1.1.1	192.168.2.4	0x6ca3	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.593076944 CET	1.1.1.1	192.168.2.4	0xe459	No error (0)	chase.com-onlinebanking.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	chase.com-onlinebanking.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		3.88.121.169	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		3.225.206.138	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		3.232.126.5	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		34.195.197.181	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		35.173.169.36	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:40.611531973 CET	1.1.1.1	192.168.2.4	0xef17	No error (0)	landing.training.knowbe4.com		98.80.95.44	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	account.secured-login.net	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		3.88.121.169	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		3.225.206.138	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		3.232.126.5	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		34.195.197.181	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		35.173.169.36	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.672319889 CET	1.1.1.1	192.168.2.4	0x47b7	No error (0)	landing.training.knowbe4.com		98.80.95.44	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:41.673489094 CET	1.1.1.1	192.168.2.4	0x306	No error (0)	account.secured-login.net	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:44.379990101 CET	1.1.1.1	192.168.2.4	0xcea8	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Dec 30, 2024 16:05:44.380053043 CET	1.1.1.1	192.168.2.4	0x3c62	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:44.380053043 CET	1.1.1.1	192.168.2.4	0x3c62	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:44.380053043 CET	1.1.1.1	192.168.2.4	0x3c62	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:44.380053043 CET	1.1.1.1	192.168.2.4	0x3c62	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:44.380053043 CET	1.1.1.1	192.168.2.4	0x3c62	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282049894 CET	1.1.1.1	192.168.2.4	0x3cc3	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282049894 CET	1.1.1.1	192.168.2.4	0x3cc3	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282049894 CET	1.1.1.1	192.168.2.4	0x3cc3	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282049894 CET	1.1.1.1	192.168.2.4	0x3cc3	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282049894 CET	1.1.1.1	192.168.2.4	0x3cc3	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.282437086 CET	1.1.1.1	192.168.2.4	0xb92c	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Dec 30, 2024 16:05:45.420305967 CET	1.1.1.1	192.168.2.4	0xc1bf	No error (0)	account.secured-login.net	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	account.secured-login.net	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		3.88.121.169	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		3.225.206.138	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		3.232.126.5	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		34.195.197.181	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		35.173.169.36	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.443402052 CET	1.1.1.1	192.168.2.4	0xf64a	No error (0)	landing.training.knowbe4.com		98.80.95.44	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:05:45.907021046 CET	1.1.1.1	192.168.2.4	0xfda7	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

chase.com-onlinebanking.com

https:

account.secured-login.net

cdn2.hubspot.net

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:41 UTC	1006	OUT	GET /XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857 HTTP/1.1 Host: chase.com-onlinebanking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:41 UTC	574	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 477 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"9073c3d1148cbd25e77f913bfe6c3128" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: a1e00d1a-651a-4f22-9e6d-4647981a6496 X-Runtime: 0.127982 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-30 15:05:41 UTC	477	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 73 65 63 75 72 65 64 2d 6c 6f 67 69 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 38 62 66 37 32 30 37 32 38 62 35 36 2f 58 57 6d 4a 6b 4d 47 73 78 61 6b 35 6c 5a 7a 64 56 5a 55 63 7a 52 33 52 78 54 47 46 57 4e 31 67 30 51 32 4e 4b 4c 79 39 36 52 55 52 50 56 45 70 5a 62 45 64 6b 4f 43 39 6e 51 7a 59 31 54 53 74 5a 53 6a 55 30 54 30 78 34 51 30 35 71 4f 58 5a 42 52 48 5a 6e 5a 54 5a 70 4d 6d 68 32 65 47 46 6d 53 6d 39 72 63 56 52 6d 56 32 78 42 65 45 4e 69 4d 45 46 31 56 33 56 54 4f 56 41 76 4c 32 64 4b 65 6d 56 51 5a 6b 5a 47 4e 48 41 78 51 31 68 71 54 55 39 Data Ascii: <html> <head> <script>window.location.href = 'https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	59436	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:42 UTC	1377	OUT	GET /pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 HTTP/1.1 Host: account.secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:44 UTC	832	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3390 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"a13602d9f5e348adba8b7afaa4b8525f" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 7381bb38-f445-4310-bdd7-1b7101d5c8d5 X-Runtime: 1.871178 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-30 15:05:44 UTC	3390	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	59435	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:44 UTC	982	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: account.secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:44 UTC	263	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:44 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Thu, 19 Dec 2024 18:38:00 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-30 15:05:44 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	59438	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:44 UTC	961	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: account.secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:45 UTC	279	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:44 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Thu, 19 Dec 2024 18:38:00 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-30 15:05:45 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-30 15:05:45 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-30 15:05:45 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	59440	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:44 UTC	970	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:45 UTC	1332	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:44 GMT Content-Type: image/webp Content-Length: 2368 Connection: close CF-Ray: 8fa2ee07a8a28c99-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 1394013 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING
2024-12-30 15:05:45 UTC	867	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 47 4f 75 41 4a 7a 41 31 2e 62 6f 31 76 6a 6f 74 5f 48 73 71 30 6f 77 45 59 39 38 58 6a 59 48 39 0d 0a 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 4f 53 33 4e 65 67 70 48 57 33 6d 47 35 79 66 36 34 36 4f 47 59 6d Data Ascii: x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9X-Cache: RefreshHit from cloudfrontX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneSet-Cookie: __cf_bm=OS3NegpHW3mG5yf646OGYm
2024-12-30 15:05:45 UTC	539	IN	Data Raw: 52 49 46 46 38 09 00 00 57 45 42 50 56 50 38 4c 2c 09 00 00 2f c7 40 09 10 e2 30 90 b6 4d e3 5f f8 77 07 11 31 01 e9 57 56 61 55 0f 57 2c 4b db b6 fe 6d 93 a3 7d bc 4a da 5d 8f 80 97 3d 83 ee 3a 5d f7 44 7a 0e 3d 80 9e 01 fd 7e bf ef f7 fd ff 1e 4d b7 4f c9 50 6e 65 58 28 0c e6 e0 bf 0c f2 84 99 93 7f 33 d6 34 cc cc cc cc 8c 8a 03 0a 93 1c 86 3b 8c 66 3b 9c 98 49 32 d3 df 4c 1a cf fc b3 89 24 5b 4a ff 1f df f9 77 41 91 61 00 1d e4 97 05 2c e1 04 11 d8 40 02 24 db a6 5d d9 b6 6d db b6 6d db b6 6d db b6 ed a4 6c db 4e be 6d 63 4f 00 d4 6c db 96 2d db fe b8 bb 5b 74 a9 ae dd 35 b9 bb d3 dc 2d b9 25 97 01 fe 01 d8 82 41 1c 66 20 f9 0a 44 16 60 02 5f 40 2b c7 71 b5 3f fd 03 e0 f5 e9 38 0c d0 7f 28 b6 b5 2d ab 5e dc 69 96 2c b9 0e c0 5d 66 a0 c9 61 0c d0 a0 d1 Data Ascii: RIFF8WEBPVP8L,/@0M_w1WVaUW,Km}J]=:]Dz=~MOPneX(34;f;I2L$[JwAa,@$]mmmlNmcOl-[t5-%Af D`_@+q?8(-^i,]fa
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 3c 31 0d 50 55 c5 a3 74 01 e5 e2 58 7d d5 5b 38 48 31 3b 54 21 2b 02 85 93 a6 48 94 81 8a 52 d9 2a b5 49 e9 5c 91 af 66 9a ea 56 c0 07 50 c0 53 c0 fe 2b 8c ac 9a 6d ae c8 73 c5 36 35 39 46 6c 53 13 49 f9 02 eb e4 50 68 db 29 ef 8e aa f4 e5 87 cb 17 47 68 56 d7 a0 76 2b b1 9a d5 26 a0 0c 1d dc 06 9a 6c df b6 9e fa 4b ea 8e aa 5e 51 86 29 94 ff ab 37 04 aa 17 9b 35 a6 3c a7 fe c3 d5 61 93 00 25 1f 74 0a a0 a8 e3 3c 0f 28 a3 a0 99 fd d5 3b 32 cf af 6e cc a3 c2 81 b7 1d 4b 95 01 1f 39 97 4a b1 42 7f 99 d0 b3 a6 4c 66 c0 f6 e4 54 1b 8a 21 61 b5 02 28 f2 90 f9 00 aa 30 48 8d c0 9f 1d 45 31 aa 9f f0 8c c2 0e 51 6e ea 2b c1 6a eb e3 b0 99 ea 0b a8 76 c7 52 36 c0 31 47 e6 eb 3f 42 cd 02 a8 1d d5 dc 7e f2 f9 00 97 a9 26 52 e2 c7 01 ad 46 f8 e6 15 32 d2 9a 17 86 de Data Ascii: <1PUtX}[8H1;T!+HR*I\fVPS+ms659FlSIPh)GhVv+&lK^Q)75<a%t<(;2nK9JBLfT!a(0HE1Qn+jvR61G?B~&RF2
2024-12-30 15:05:45 UTC	460	IN	Data Raw: 0b f2 29 f0 54 a2 3f 70 52 8c 8a 4a ec 9f 7b 4d 40 d5 f5 ef df bf bf 8a ce 63 15 0c ac 7d 7a 11 1c a9 6e f3 79 e8 8c 7c eb b9 31 65 82 c3 ef b4 e3 e1 7c df 0c fd 9c 39 04 16 35 1e 0f fb 14 66 02 30 23 b1 0c f8 77 8c 98 8b 81 4e 4e e6 b2 6a 00 36 50 84 85 f3 96 f9 f0 73 70 92 00 14 d0 ca f4 35 80 43 1e 80 89 59 af 00 cb fe 0c db 15 64 1a 70 a1 62 49 94 4e 86 96 65 ad 59 f3 54 60 97 c6 c2 f9 d6 7c 49 55 ee cc 92 7a 02 97 b7 d0 ab 6b 96 1f 07 d5 da c2 59 95 02 94 6a db 01 2f 3b 75 57 60 91 e2 6f bd 7c c2 4d 40 c7 22 d8 77 41 8c 81 cd 59 56 a5 50 0f fb 39 50 65 92 54 35 8e d6 f5 b5 a9 00 0f d4 a4 b9 1b 50 df a5 26 e4 c8 95 45 e7 ee f5 80 b2 2e 9c 47 7c 92 6f e3 1a 07 2a 55 92 75 21 4a 32 e5 c6 3c 9d 57 28 d3 4b eb 6e 54 26 2f ed b3 4b 3d c9 81 57 38 b3 f9 50 Data Ascii: )T?pRJ{M@c}zny\|1e\|95f0#wNNj6Psp5CYdpbINeYT`\|IUzkYj/;uW`o\|M@"wAYVP9PeT5P&E.G\|o*Uu!J2<W(KnT&/K=W8P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	59439	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:44 UTC	969	OUT	GET /hubfs/241394/html_file/files/img/KB4STOP.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:45 UTC	1234	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:44 GMT Content-Type: image/webp Content-Length: 21550 Connection: close CF-Ray: 8fa2ee07ed9542d7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 77819 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4STOP.webp" ETag: "d64f6fc019fff417e7a2d9353619514d" Last-Modified: Fri, 06 Oct 2017 17:40:42 GMT Vary: Accept Via: 1.1 368d984ddaa7c541b8ba1a87edd0e52e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3778383580,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=30418 Edge-Cache-Tag: F-3778383580,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: h36jMj_jibTkW51YTmlZK1Y-gG7e-L5utS6x-xjCIUJw-9v-CunkCw== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: TOCbmAQfznrY5IQRQfa0sfGcRssQ0O0e7BSc/4p+AM5UeyiLqzLjHHrnhTMb0mMghiRtLMXuCT8= x-amz-meta-cache-tag: F-3778383580,P-241394,FLS-ALL x-amz-request-id: VRT6CNPGPYPRTYZ3 x-amz-version-id: 3Y8RPNjyGexYgnOWxeEfaABI6aWjNxJT X-Cache: Miss from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-12-30 15:05:45 UTC	656	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 4a 2e 62 78 65 71 4f 52 65 62 6c 33 4e 66 47 4c 33 49 54 73 73 50 7a 56 6a 4b 41 6e 42 43 63 2e 31 53 78 6d 71 4d 52 78 55 61 6f 2d 31 37 33 35 35 37 31 31 34 34 2d 31 2e 30 2e 31 2e 31 2d 51 79 4c 2e 59 78 32 36 62 79 64 34 39 76 33 4b 71 31 66 53 4b 4a 78 39 63 56 45 38 59 44 42 41 47 68 77 72 6e 68 45 63 6e 35 7a 2e 6a 74 4d 53 77 62 5a 4e 33 71 74 68 5a 54 31 49 48 71 49 5a 46 73 41 31 4b 6d 4e 30 48 58 43 32 72 33 46 43 4b 55 50 70 6a 77 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 33 30 2d 44 65 63 2d 32 34 20 31 35 3a 33 35 3a 34 34 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 68 75 62 73 70 6f 74 2e 6e 65 74 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 Data Ascii: Set-Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw; path=/; expires=Mon, 30-Dec-24 15:35:44 GMT; domain=.hubspot.net; HttpOnly; Secure;
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 52 49 46 46 26 54 00 00 57 45 42 50 56 50 38 4c 19 54 00 00 2f 8f c1 63 10 09 48 6e 1b 49 92 a0 b4 bb 67 71 cc ff 1f 9c 59 b9 35 e6 1e d1 ff 09 60 7b 71 bd 18 fb 1e 7d 40 92 06 bc 9b db 0d ea 80 00 22 b9 40 53 09 bd 4f 25 e9 92 19 7c 42 c0 42 00 73 52 1d 64 85 e4 04 82 d6 d5 3d 09 24 81 dc a2 6c aa 13 e9 b2 21 ff 5c 3b 50 1f 10 40 83 ef 85 ac 65 46 62 e8 9b e8 43 ee 51 74 ac 12 98 91 92 23 15 16 93 28 1a 65 53 16 8a 04 92 2e 7b c4 6a d2 65 57 eb b2 04 33 d9 c4 5e 7d c0 38 fb e2 ab 6a 80 f1 93 66 92 3a 80 ed 91 10 39 93 84 04 30 b3 0f 49 ed 68 13 d8 20 e9 18 e9 aa 93 b0 c4 70 94 d4 be 04 34 b2 2f 60 50 a2 17 e0 a7 a4 f6 b4 91 a4 0e 30 26 5d 52 bb 5a 0b 20 26 8d 0f d1 68 ac 9a 4e a9 8b 86 4a 34 b9 e2 86 77 88 68 1f ad d9 6b 42 f3 4b d8 6c d4 21 f0 8a 38 5b Data Ascii: RIFF&TWEBPVP8LT/cHnIgqY5`{q}@"@SO%\|BBsRd=$l!\;P@eFbCQt#(eS.{jeW3^}8jf:90Ih p4/`P0&]RZ &hNJ4whkBKl!8[
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 49 3e c7 ec d7 f8 19 4e 98 66 d0 7c ce 4f 31 e5 24 80 c7 53 4a d2 49 80 0a 14 93 eb b7 4a 5b 55 eb f1 6c 75 ab 4a eb 79 b5 73 db aa 5a 55 eb 7c 24 cd e1 0d 80 ed 05 30 01 60 9a ee 82 22 aa ed fd bf e7 6e 1b e9 22 c5 22 52 dd ca b4 17 31 cf 66 de c6 f6 fe fe 1f 4c 71 91 44 51 ec 3c 0f 78 ce ff 7f 5d ff fb 26 39 7d 7e 8e d6 b7 f5 e0 96 0c 83 09 4c 06 92 65 6d b4 cd 69 dc 72 c5 f0 e0 de 72 70 6c 80 11 60 79 8b a0 c0 26 02 97 5d 8e 03 1c 6d ca 2d 39 14 15 ac a3 28 38 e4 20 5a 43 b1 b0 5e d8 b8 53 4e 1a b8 f6 98 c7 32 20 d3 65 c2 29 02 0d 43 69 30 53 4e 02 c1 57 2a e1 b5 e5 58 16 16 a9 4a 1e d0 b5 6d 3b 91 24 9d fb 24 45 66 a3 d5 c3 0c de 98 fc 89 63 31 7d c9 d8 4c 2e 93 c7 cc 53 51 11 99 92 de 75 1c 49 92 a3 e4 cc 0a f4 8b 27 98 a0 1d c2 7f 13 34 23 49 1b 00 Data Ascii: I>Nf\|O1$SJIJ[UluJysZU\|$0`"n""R1fLqDQ<x]&9}~Lemirrpl`y&]m-9(8 ZC^SN2 e)Ci0SNW*XJm;$$Efc1}L.SQuI'4#I
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 5c 96 74 c8 71 11 c5 d9 ce 10 21 74 98 16 08 80 7a 58 20 e4 b4 14 fe 79 35 d0 ae 19 4b 2e fc ec 83 af 28 ff 2d 1f aa 72 9e c6 e5 ec 0a d0 aa 41 d3 06 ba d6 5f 43 48 4b a5 01 56 4d 2e 3c 73 6c f5 19 da 38 7a e1 27 ef 70 51 6c 5c ec 2b c8 e5 95 29 bf 19 16 82 80 4e 58 77 a6 f9 04 7e 2b f6 a2 4f 1f f0 50 3e 0e 2c 1e 96 a5 62 12 57 b1 e1 c4 cf 1f 31 55 01 d6 be b2 42 38 e7 58 bd 1d 1b 3d 2e fa f4 77 7c ef db fd 9a ab b9 39 18 32 f4 5b b5 2a a4 e6 fd f1 66 55 24 57 b6 3d 80 e1 4a b8 ef b7 64 b2 e6 bd ac 16 c9 a3 bb ae 81 df 82 fd 49 ae 4c 5f ae 74 68 6a bd ae bf ce 5f 0c f6 e8 dc b8 64 9e 0b f7 58 52 f7 3a 3e a6 64 0c c0 ad 91 41 f3 d2 b9 e2 79 43 6d 67 a0 fb d7 dc 33 57 c8 bc f5 2e 88 77 ae b3 1d ed 8b 93 11 41 2e dd 29 b2 d8 55 33 7d ad b6 fa 8e 12 fd 74 7f Data Ascii: \tq!tzX y5K.(-rA_CHKVM.<sl8z'pQl\+)NXw~+OP>,bW1UB8X=.w\|92[*fU$W=JdIL_thj_dXR:>dAyCmg3W.wA.)U3}t
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 0d 98 fa 26 23 2b 24 a2 49 b8 f5 91 98 76 ac 4c c9 0f da 33 43 ad a9 05 7d 71 85 a0 59 6b ca 16 68 76 87 21 eb 68 76 87 8c 7d 8e 24 97 9a 22 01 50 d3 06 a7 bd 0e a0 7f 0e f4 fb 60 ba 65 02 d1 1b f0 5b 89 b3 ae c9 b4 0f d5 75 0c 70 cf 1a e3 66 4d 75 1a 46 56 c8 7e 9a 50 a7 22 31 33 99 15 53 30 b8 8f d1 03 0c 68 72 d9 83 48 dc a1 62 51 c7 c4 e7 19 45 53 23 8c 3e 53 89 37 7a ad 7f e3 d9 fb 2a da c3 69 13 5c 63 dc 61 53 31 63 bd 90 84 71 1c 88 bf f6 ea e9 64 c5 22 03 93 cf 31 8c 47 0c e1 79 21 23 8c 40 7e a7 bb 38 f1 02 ad 6e 62 4d fc 67 47 ab 19 58 43 bb 9d ad aa 60 0d 45 8e e6 ac 0c 38 d2 fb 02 b1 63 d4 8f f4 9f 39 c8 75 10 7d 16 86 03 d0 bf 00 99 8f 82 9c 1c 8d 71 98 76 ee f8 ae 62 17 4c 26 1c e3 01 43 78 9f 90 de ea b6 ef a2 15 35 c6 48 cc 18 15 56 34 b5 Data Ascii: &#+$IvL3C}qYkhv!hv}$"P`e[upfMuFV~P"13S0hrHbQES#>S7z*i\caS1cqd"1Gy!#@~8nbMgGXC`E8c9u}qvbL&Cx5HV4
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 13 0a 9b 58 e1 cc 6d 64 e4 8d b5 01 43 f8 8b 42 3a 12 5a c5 de 02 86 f0 da 62 ad e8 d6 79 8f 6c 48 4f b3 27 0c 50 da 24 90 75 db 46 21 3d 34 36 c1 78 d8 d4 61 86 ff 62 cf 58 95 c4 d0 83 b2 78 5c d9 24 10 a9 6b 53 65 60 cd 0d 58 9a 12 d6 d4 a4 a5 59 6b a8 64 69 4f 5a 19 89 25 55 ac f3 94 11 e4 42 d0 c5 ae d7 f2 7e 9a 82 8b 00 2c 68 11 64 71 34 87 30 3f 07 7a a5 80 e9 04 1e 0e 21 73 02 52 b1 67 28 0f fa ec c2 c6 3d c5 b0 4b d0 16 8c 34 4f 02 16 99 cc d7 2b 5b a4 25 af d8 ac 00 6e 68 2c 66 3c 2c cb 93 6a ea 36 80 62 f1 ff 3d 98 42 7d a3 4e 84 20 9f 6e 0c de 1e 73 52 e7 39 05 7c d8 20 ad 88 b4 8d 09 88 18 3e 3b c8 b0 32 36 32 14 0e 1b 38 58 b7 0c 16 42 01 ec b8 a1 d2 38 61 80 9d 00 d0 ab 3d 57 e6 36 97 76 2b 60 03 63 81 31 d5 1a 30 0a c6 b8 63 32 bc ec 16 8b Data Ascii: XmdCB:ZbylHO'P$uF!=46xabXx\$kSe`XYkdiOZ%UB~,hdq40?z!sRg(=K4O+[%nh,f<,j6b=B}N nsR9\| >;2628XB8a=W6v+`c10c2
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: e4 a1 3d 09 57 d9 b4 82 4a 73 05 12 56 f8 a6 3d a9 43 d5 83 ec 20 f0 51 f0 9b c5 c8 5f 76 00 7c fa 9e 25 e6 ad c6 34 ea fa 5a cb da 4f 40 7c a3 00 1d a3 fd 83 de 1e fd c4 65 7f 19 c3 cf ef 59 22 6a c0 50 40 53 bf 9a 06 2a 8f b1 96 b5 c5 58 de db 19 f0 b6 a8 41 7f 44 1b 95 77 06 fe ff a9 a5 50 94 53 d1 cd 62 4f ea f1 be af 6a 85 81 f8 b7 04 34 ac f0 4d 83 2a 0e 91 42 13 39 c8 68 a2 5d 0c 8b 3b 26 3a 81 86 5e 0e 20 05 89 8b 78 d9 b0 9a 27 c6 3c 00 ba 0c 3a ca d6 5b 09 dd 72 b8 2c 19 d3 97 d0 70 1c 41 dc 29 7c 64 0d 2b c3 73 10 1f cf 32 e0 b7 bd 45 ea 7e d9 3f 25 dd 62 05 28 63 bb 21 e0 e5 45 1d 6d ce 92 60 14 c2 53 86 82 90 2a dc 77 ad bc 57 59 da f7 00 b7 5a 24 3f 41 f7 fc f2 22 d0 95 c0 e8 17 a7 21 bf 31 01 1d 8b 0e b0 f9 9b 24 74 d7 6e 49 43 d7 84 91 a9 Data Ascii: =WJsV=C Q_v\|%4ZO@\|eY"jP@SXADwPSbOj4MB9h];&:^ x'<:[r,pA)\|d+s2E~?%b(c!Em`S*wWYZ$?A"!1$tnIC
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 6a d7 09 3f 2b 35 26 8e a6 8b f8 d6 03 cc 5b 20 77 75 30 31 01 66 72 be f0 29 00 85 da 60 d7 94 f5 ab 33 13 a0 17 73 d6 d1 ef 8d 8d 04 40 a1 4c c2 67 6e f0 ad ae d5 c1 a7 16 19 eb 47 a5 0f 82 ae a3 18 e0 43 bf a5 c4 19 e8 fc cc 0d 7e 86 ba c2 32 f0 a5 33 60 96 ee 6c a5 df 7f 3c 91 ae 5c 26 61 6d a5 c1 f8 57 61 59 50 67 e0 c7 1b 3f c8 b8 df b1 df 06 5e 0b cd ab 2a 4d c6 af 86 f7 85 f0 e5 f5 60 3e 94 3e 74 34 2b e5 04 0a 40 21 ed 3f cb 93 f0 bd 59 7f fa d9 cd 16 be bc f1 58 81 56 da e8 b1 13 bc 79 04 d4 33 45 88 86 f3 57 da 06 7e b4 b4 b1 13 3e bd 6a 00 66 19 a6 d1 ef cd 85 12 89 95 40 8b 2f 58 79 c2 77 86 56 54 42 f8 f4 6c c0 28 16 0a b0 1d d7 2c c0 ac 9e 90 10 ff e6 ff f8 cd d9 72 05 80 7e 1a a1 5f c4 0d 13 d0 95 0f e8 b2 49 74 fc 39 0e b7 2d 99 f7 97 5a Data Ascii: j?+5&[ wu01fr)`3s@LgnGC~23`l<\&amWaYPg?^*M`>>t4+@!?YXVy3EW~>jf@/XywVTBl(,r~_It9-Z
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 14 c1 bc 10 f0 f3 e0 08 71 02 60 13 34 7f e2 0a 31 a1 b8 23 d7 33 34 01 ba 31 97 ce d5 14 a7 39 f0 5e 5f 19 f4 fd 88 50 1b fc 0f 02 72 11 0c 46 62 c4 c7 67 c0 1c 6e 16 a4 77 4b 28 6c 2b 79 6e 08 dc 08 00 3e f2 32 01 51 99 16 7f bb 0d 28 48 a4 d4 18 69 1b 22 46 19 0c 03 ac 70 0f b6 3d 13 0c 32 cd 59 53 ce 80 4b 1b 5a 7a a7 70 ce 01 c0 8a 60 a1 01 ac d6 dd a5 87 2e 10 d5 c2 12 b1 df 39 27 21 6f 65 6d 9c 75 8c 85 29 40 f7 6a 12 a1 b9 13 06 ac a1 7c a4 af 6b 68 41 0f 90 b1 ef bc 20 84 de 14 e0 d8 af 99 21 0b 62 14 40 e4 18 64 6f 00 73 b8 5d e8 5f fe 01 65 d8 90 dc 63 e8 f8 a0 91 10 f4 01 50 ab 83 95 60 75 94 00 a0 39 c1 28 05 a5 48 42 1e b2 8f 24 0c 8d 83 3c 4a a5 7f 01 b7 2a f6 c3 bb 7d 0e cc 84 84 fa 60 bb 86 81 a8 0b 80 32 05 bb 25 84 b2 82 f3 27 60 2e 6e Data Ascii: q`41#3419^_PrFbgnwK(l+yn>2Q(Hi"Fp=2YSKZzp`.9'!oemu)@j\|khA !b@dos]_ecP`u9(HB$<J*}`2%'`.n
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: f6 0a 30 7b c3 29 ff eb 5a 04 f5 c3 30 ff 02 b8 bb f7 05 e9 fd bc 6a 6f c5 3f de 6d 06 37 9c ea 16 10 52 04 66 c1 5d 8c 31 c0 0a f7 9d 2c 46 31 1b 1a ae 61 08 f7 5e db 2d a0 28 a8 5a 38 ce b7 72 df 6c fa 7f 18 ab ac 38 15 18 c2 e0 ea 24 e8 0e ec ca 7f 39 2e 25 7f a1 88 39 a9 6e 39 03 b8 2d 2e 61 c3 bd a6 d0 29 6e 7a 47 ec 7f b0 3f 2f f2 42 ca 09 98 8b 0e c6 10 ce 7b 4e 54 9c 0a 4c 01 c1 99 53 fe 87 e1 f3 44 5e 44 16 dc 12 07 8b fb 66 c5 a0 cc 7b bf b0 c0 86 1b cc 01 c1 99 53 be 87 85 c1 0a 90 30 04 f6 fc 86 6a 80 1d 83 69 b0 d4 48 6e d0 9d 32 15 0a 85 5c 6b 60 ad 35 05 cc 5f dc 04 81 cf a1 3e f8 23 33 d6 5a 3b f4 64 a1 c0 58 18 1c 80 ca 20 0e 73 4b 58 79 06 42 9b 61 cf 65 fe 86 57 88 d0 08 80 22 d8 25 02 f3 33 6e 46 71 33 37 96 56 24 8d 81 10 a0 74 6e 36 Data Ascii: 0{)Z0jo?m7Rf]1,F1a^-(Z8rl8$9.%9n9-.a)nzG?/B{NTLSD^Df{S0jiHn2\k`5_>#3Z;dX sKXyBaeW"%3nFq37V$tn6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	59441	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:45 UTC	552	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw
2024-12-30 15:05:45 UTC	1352	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:45 GMT Content-Type: image/png Content-Length: 3014 Connection: close CF-Ray: 8fa2ee0d6e864378-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 1219486 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront
2024-12-30 15:05:45 UTC	508	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 65 72 49 75 76 33 4e 4c 66 6e 6f 25 32 42 53 46 50 74 68 77 62 32 64 66 34 61 51 51 6c 39 25 32 46 67 34 25 32 42 50 65 4f 32 48 77 53 4b 72 47 74 55 7a 6e 71 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=erIuv3NLfno%2BSFPthwb2df4aQQl9%2Fg4%2BPeO2HwSKrGtUznq
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 26 08 06 00 00 00 81 16 d4 6c 00 00 0b 8d 49 44 41 54 78 da ec da 7b 68 97 55 1c c7 71 f7 9b b7 4d 73 22 65 a9 65 6a 2c bb 98 4d cc 2c 5d 28 26 d4 e8 42 17 b0 12 29 47 e2 46 9a b8 84 32 f3 32 32 6f 59 ce d4 c2 14 91 d4 4c 12 25 c3 b4 0b 16 69 46 a6 a5 2e 99 97 92 4c a7 65 da 98 64 73 6e ce 4f 6f f0 40 a7 83 3f f7 9c df cf 07 f6 1b cf 81 d7 1f db 79 be cf d9 73 9e f3 f9 3d 97 fd 9a 44 2d 6a 51 bb 44 d3 c8 26 43 31 dc c8 4d 72 5f 39 18 6e e9 1e cd 70 83 38 c7 57 a1 00 c5 78 17 eb b0 05 a5 38 64 ec c7 4e 6c c2 62 8c c5 3d 68 d6 08 e7 62 3c 16 60 06 ba d7 57 20 cb 47 49 0c 9c 8d 53 90 51 8e f6 d1 f2 6c 10 8b 62 20 94 a0 0a cc 47 e7 46 32 17 2b 20 a3 12 ed 43 0f 08 75 99 f8 09 32 6a d1 3f 5a Data Ascii: PNGIHDR&lIDATx{hUqMs"eej,M,](&B)GF222oYL%iF.LedsnOo@?ys=D-jQD&C1Mr_9np8Wx8dNlb=hb<`W GISQlb GF2+ Cu2j?Z
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 64 9b 49 10 80 bd 9b 24 d1 f6 7f 25 15 a6 fb 2d 92 65 23 fe bb 25 9b d0 d5 ee 1b 67 5f de 3d 4f 50 16 6a 21 a3 37 62 38 f6 6f 79 e7 1a 1b 55 11 c5 71 db 6d 61 89 b4 94 a8 e9 36 4a 24 8d 91 5a d3 50 04 8d 31 69 10 d1 40 95 47 41 8c 02 09 36 1a 10 35 60 91 6a 41 c4 00 3e 3e 14 31 4d 7c 00 4a 10 c4 17 28 a1 96 d2 a0 7c b0 35 a6 08 91 46 30 90 40 13 69 d5 a0 55 da da 0a a9 1f 4a 8f 27 b7 27 9b c9 3f 73 bb 77 76 ee dd dd 86 49 7e 01 7a 66 e6 de bb dc ff ec cc 39 67 a6 0c 09 2f 1a cc f1 bb 98 90 cf 02 41 2e 89 90 b3 0d a3 ee cb 2d 62 19 bd 5e bc 51 6c ab 56 ea 0d 30 c5 41 0b 24 24 8b 25 f4 1a e5 d9 0b c4 fe c3 83 17 a9 0e ed ca 06 2e 67 6d e1 94 81 01 a2 f5 13 a4 8d 21 6d 3f 92 53 8e 6c 51 7f 7e 5c bd 26 cc 9b fb 99 6c 8f 91 e9 5f 99 34 cd f4 b1 39 c6 67 70 40 Data Ascii: dI$%-e#%g_=OPj!7b8oyUqma6J$ZP1i@GA65`jA>>1M\|J(\|5F0@iUJ''?swvI~zf9g/A.-b^QlV0A$$%.gm!m?SlQ~\&l_49gp@
2024-12-30 15:05:45 UTC	276	IN	Data Raw: 23 6d bb 65 6d 9b 31 7c 05 e2 3e e7 ef 63 a6 24 51 20 e8 fd 58 23 f7 44 86 5c c6 df 8d 61 30 02 f7 30 18 3b 19 69 e8 b5 f9 43 73 3f a3 8c 05 62 4f 37 f3 1c 93 6e 78 0e da 06 98 9e c5 43 d1 70 15 08 f6 b7 4e 73 08 5b 24 59 02 c1 22 a3 d4 56 8f c7 d0 f4 ca 34 69 9c c5 7d 7e 86 9b bb 6c 52 be 85 03 09 fe 05 3a 27 98 55 36 27 f7 8b 8b 7b 17 04 11 bd d2 c2 dc 9e 2c 81 2c 66 9e 95 af bb 12 9f 02 39 73 99 72 49 89 78 5c 9d 43 8a ad 42 98 61 71 9d 52 59 38 3e 05 01 37 93 5d 89 65 cc 66 71 5d 36 09 b5 32 ef 9f 6d 71 0c 29 6e 17 58 ca 3c 2f 7f c6 73 ce 53 be 3c 67 95 3c 73 a1 61 fb eb 99 27 c4 45 fc 81 4c 37 bf 97 41 e6 3c d3 c6 9c 93 7f 37 32 1f 33 eb 99 f9 4c c4 e7 17 33 9b 59 20 9f fb 41 f1 ca 9d 61 5a e5 fa 3f 30 fb c4 be d0 e8 f3 32 1f 34 6a 84 6a 26 47 57 ef Data Ascii: #mem1\|>c$Q X#D\a00;iCs?bO7nxCpNs[$Y"V4i}~lR:'U6'{,,f9srIx\CBaqRY8>7]efq]62mq)nX</sS<g<sa'EL7A<723L3Y AaZ?024jj&GW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	59442	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:45 UTC	551	OUT	GET /hubfs/241394/html_file/files/img/KB4STOP.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw
2024-12-30 15:05:45 UTC	1166	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:45 GMT Content-Type: image/png Content-Length: 24928 Connection: close CF-Ray: 8fa2ee0d78b35e62-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 77820 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "d64f6fc019fff417e7a2d9353619514d" Last-Modified: Fri, 06 Oct 2017 17:40:42 GMT Vary: Accept Via: 1.1 368d984ddaa7c541b8ba1a87edd0e52e.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3778383580,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=30418 Edge-Cache-Tag: F-3778383580,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: h36jMj_jibTkW51YTmlZK1Y-gG7e-L5utS6x-xjCIUJw-9v-CunkCw== X-Amz-Cf-Pop: BOS50-C3 x-amz-id-2: TOCbmAQfznrY5IQRQfa0sfGcRssQ0O0e7BSc/4p+AM5UeyiLqzLjHHrnhTMb0mMghiRtLMXuCT8= x-amz-meta-cache-tag: F-3778383580,P-241394,FLS-ALL x-amz-request-id: VRT6CNPGPYPRTYZ3 x-amz-version-id: 3Y8RPNjyGexYgnOWxeEfaABI6aWjNxJT X-Cache: Miss from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-12-30 15:05:45 UTC	380	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 57 74 54 53 6a 36 79 30 32 72 52 55 48 4e 6f 46 54 69 44 58 48 6f 4b 4b 6a 55 47 6a 69 4d 46 4e 6a 35 45 4b 42 7a 58 69 61 25 32 42 4e 68 51 44 65 48 75 54 39 62 6e 55 64 61 4f 6d 73 64 55 6f 76 4d 34 76 6e 4b 34 68 72 69 74 34 63 61 39 6b 54 69 31 35 30 58 41 6d 4d 42 33 6c 58 46 36 6a 68 4d 63 69 4b 62 69 45 73 25 32 46 43 66 54 53 76 67 37 79 41 70 56 25 32 46 74 65 72 72 57 4e 46 50 4c 4b 6d 34 50 62 30 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WtTSj6y02rRUHNoFTiDXHoKKjUGjiMFNj5EKBzXia%2BNhQDeHuT9bnUdaOmsdUovM4vnK4hrit4ca9kTi150XAmMB3lXF6jhMciKbiEs%2FCfTSvg7yApV%2FterrWNFPLKm4Pb0%3D"}],"group":"cf-nel","max_age":604800
2024-12-30 15:05:45 UTC	1192	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 06 00 00 00 80 bf 36 cc 00 00 61 27 49 44 41 54 78 da ec dd dd 6f 1c 57 19 c7 f1 43 4a 1a a4 52 04 37 5c 8c 64 6d 65 55 b1 62 39 95 ed 6b 0b 89 d6 2f fb 36 bb 7e 5f 27 76 5c fa 1f f8 1f e0 02 12 27 4d 71 db 90 a0 d0 06 37 02 4a 5f 40 80 5b 2a 2a 02 29 d9 36 ad e3 38 d8 8d 5f 62 3b 5e 87 97 9b dc 56 a2 92 2f ba b0 83 1e 59 8b 9b e6 a5 de 33 b3 9e 73 66 bf 1f e9 b9 a8 eb 59 9f d9 cd 3e bf 3d e7 cc ee 2a 00 00 00 00 00 00 00 00 00 00 28 fb 41 ba 35 76 22 d5 3c 26 75 2a de 98 df 69 95 8f 39 9a 6e 69 53 00 80 68 93 66 3f 91 3c 38 79 26 7e 60 fe 7c c7 e3 9f bc f3 5d c7 0b aa 5e ed a8 df 3c d7 b5 ff 76 39 5c 14 00 c0 6e 27 93 4f 9c 90 c0 78 b3 3d 56 d4 0f 08 fd 50 91 bf 4d a0 00 80 25 64 Data Ascii: PNGIHDR6a'IDATxoWCJR7\dmeUb9k/6~_'v\'Mq7J_@[*)68_b;^V/Y3sfY>=(A5v"<&u*i9niShf?<8y&~`\|]^<v9\n'Ox=VPM%d
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 0c 88 9d d6 f9 e4 fe db c7 98 8d 00 b5 e7 67 c9 86 42 90 af e2 a5 f1 af 0f 07 df 64 25 54 24 50 2e c5 09 10 13 eb 8d 78 fd e6 b3 19 ae d8 02 6a 86 cc 3e 82 68 1e b3 19 f9 58 f4 dd 6b b8 f2 b7 e4 6f 5e ec 0c ae 01 2e f6 85 15 20 72 1e 66 86 82 ce 92 16 21 02 d4 08 99 7d f8 5d a6 5a cd 85 d7 78 0b 23 32 73 08 a2 01 87 79 1e 66 86 81 9f 7a 21 7d 70 52 01 88 2e 59 b3 f6 37 eb 28 ef 6b 84 5f b2 64 36 e3 12 20 26 15 9b eb 40 84 c9 ab 44 fd f0 90 c6 67 5e 2d f5 eb 36 3c fd 25 38 ff cb 71 66 06 00 cb 59 00 ee 4b ae 9c b1 ed 72 d7 ea bd 9a 0f 6f bc ab 39 33 03 20 a8 10 e1 ea 2c 20 82 74 2e dd 95 bd 86 f5 61 33 83 43 aa 30 42 80 7c 31 ec e7 b2 72 81 80 fc 9d 7b d7 62 5f 75 2f 97 7e 35 c1 27 01 03 91 22 4b 0b 7f ee 74 bc 4a 6b be db f1 fe fe b4 b9 b5 36 24 e3 ac bc Data Ascii: gBd%T$P.xj>hXko^. rf!}]Zx#2syfz!}pR.Y7(k_d6 &@Dg^-6<%8qfYKro93 , t.a3C0B\|1r{b_u/~5'"KtJk6$
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 90 8a 18 33 75 17 13 88 7f bb 93 e7 e5 c3 57 1c df 3e 82 35 48 c4 2b 6d c5 49 bf 2f 7b 60 cc 2e b4 cb 10 96 4a ee 0a 41 00 1c ed 6d 9f 59 9d 5f 73 99 6c 1e a5 22 69 2a 13 67 ad db 64 b8 aa f6 51 e2 8d 52 78 71 23 c6 bc 9f 4c d7 ff 3d 46 a9 bf 85 20 f0 0d 24 00 cf e9 ad 33 e2 60 66 28 8d 28 4b 71 d2 8f c5 ab ad 4c e0 64 1c c2 22 20 4c 20 9e 5d 5e 39 79 ea 98 d9 19 4a 4d 49 2c 32 1c 4a d0 92 58 20 79 1d c2 32 78 31 1f f6 24 fa b6 ea fd 20 04 81 09 c4 b3 23 a6 f8 d8 69 bf 81 34 a6 d0 42 d4 d8 b9 63 54 f4 87 10 04 26 90 03 84 3a 7c 35 3d 25 8d c9 b5 38 89 63 f1 26 cf f1 2a c7 0a 0e 5f 11 18 26 90 b1 c2 1d be 1a 24 22 31 c0 f0 10 42 8c 21 b5 6d b1 16 b3 da 6d 02 09 f1 9a 10 04 56 61 8d 17 ec f0 d5 dc 94 fc 0f 5b 82 3c cd 74 68 45 89 50 7b 77 d9 8e 7d 80 da 45 Data Ascii: 3uW>5H+mI/{`.JAmY_sl"igdQRxq#L=F $3`f((KqLd" L ]^9yJMI,2JX y2x1$ #i4BcT&:\|5=%8c&_&$"1B!mmVa[<thEP{w}E
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: e8 34 74 12 5c 05 56 da 93 83 f0 a9 78 8c 0c b0 72 0c 35 59 8f b3 9d 4b 6d 0f 55 3b db 98 5c 3b bb 74 e9 bf 5b 35 2f 2a 2d c2 2a ac 09 7a d6 66 b3 91 aa 3f 87 a0 94 78 a5 94 db bc 40 6f 7c ec 41 c7 ed 73 05 45 63 dc 62 1e 24 61 0e 75 ee fe 1f e0 cc 41 1d 86 eb eb 4b 97 8e d8 7c a5 6a 9a 3a 65 cb b9 79 bb 33 94 8a fe 53 f6 f0 c5 8d 95 05 79 a0 92 f2 b1 4a 1e dd 57 fd 9b 0f 55 ff bb 2a df 08 d1 93 6e ac 2c d8 ba db bd f7 17 ec e6 45 bf db af ef 2e 58 97 d8 6f 6d f8 8d fb e6 b9 05 8b 76 cc ef 5c 70 89 b9 da af da 3f bc ed c7 b3 f5 7f cb 97 eb af 7f 25 40 ae 9c 5b 5e ac 62 fe 66 ed f8 66 15 ff 61 6d d5 df 57 fd bd 57 ce b5 eb 2d 85 1c 9f 4a 5c 4e a2 df 3e f8 f7 62 c4 bb a9 dd 7e c7 6f dc 55 0c 68 c7 fc e7 b7 db 95 40 5c 7e 4b 75 ad 08 80 2a ce af d7 5e fd a5 Data Ascii: 4t\Vxr5YKmU;\;t[5/-zf?x@o\|AsEcb$auAK\|j:ey3SyJWUn,E.Xomv\p?%@[^bffamWW-J\N>b~oUh@\~Ku^
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 14 7c 85 0a df c1 ab 5d ed 4d db ec e9 37 bd 30 8f aa 08 50 53 e7 c5 c0 88 df a6 14 6d 20 8f 45 3f 03 e2 f5 b3 14 15 65 28 2a 29 86 3b c7 64 89 28 fa dc 8a 4c dd c9 20 30 09 0f 69 b1 a7 ae ae 13 c9 08 5c 42 db 73 ab 6a b1 0c 7a a7 9d 36 90 02 3d 03 52 6a 31 6d ae db 61 39 1a 88 aa c8 6c ff 9e 43 e8 9f f0 88 77 3a 9e 1a f0 ca 3c 2a 22 58 16 1d 12 d6 bb b0 3c a7 a7 6b d7 9e 80 7d 5b e2 18 10 35 2a 8c 9d 91 33 03 c3 28 6e fa 2d 9b 5f ba b9 96 75 6e a4 f3 e2 09 bf ef 6a ee db 66 4f 6d 81 01 57 d4 af dc 3c 94 2d d3 47 d0 33 10 3e 94 43 3c cd 79 57 8d 10 90 22 5c 81 a2 92 b1 f8 3d bb c2 b5 ac 73 61 5b 90 22 69 04 7a e1 92 5f 75 b5 9e d9 69 4f 3d 03 f8 cb 3c b8 a0 0d c4 43 02 b0 1b a1 61 83 0e 61 79 83 65 41 96 1b 70 c1 2f ba da e2 ed f6 e4 4f fd 68 1e 5c 36 b4 Data Ascii: \|]M70PSm E?e();d(L 0i\Bsjz6=Rj1ma9lCw:<"X<k}[5*3(n-_unjfOmW<-G3>C<yW"\=sa["iz_uiO=<CaayeAp/Oh\6
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 0a 0e 44 6d 46 2a ef bf 33 75 f8 ca 17 94 aa 81 d0 eb c8 34 a8 11 5f 4d a8 d9 d9 fa 59 c5 36 92 91 97 dd 8d 9a cf 27 da e2 6e f2 4f 03 95 3b dd 6a 9a 82 03 49 0e b8 74 f8 ca 37 fc d9 dc 3a e2 bc f3 e5 6f 20 5a 6a e8 fa 0b 14 06 e1 51 6f 28 5c 05 00 3d 89 f6 a6 7f 99 4d 69 f9 7c 53 38 4f 4d 43 70 a2 d1 13 3a 7c 55 f2 50 a3 e0 6c 20 83 87 d4 ec 18 b5 56 ae ab 09 aa 53 ea 87 5e 68 b0 05 00 ef 98 db fb 97 fe 9e 73 fb 91 17 cd de e5 f2 4f eb ae d0 f8 03 19 03 19 7e 49 1b 88 96 f7 1a 78 9e 46 e6 ea d6 1b 0a f7 be 61 b6 9e 59 fa 3b ce 1b 50 e4 b5 78 02 84 9c 7a 12 fa e1 41 df 40 a3 3f a7 a2 46 3e f1 13 35 f4 c5 21 4a 93 96 9f 34 72 bc f0 f5 e6 7f 87 9d a7 eb dd c4 f6 fe fe c4 46 5b 36 5f d7 0e c4 c4 9d d3 f4 f9 fc 35 72 5c ae 0c fe 92 d0 0f 0f fa 0a ee 06 a2 6a Data Ascii: DmF*3u4_MY6'nO;jIt7:o ZjQo(\=Mi\|S8OMCp:\|UPl VS^hsO~IxFaY;PxzA@?F>5!J4rF[6_5r\j
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 50 38 d8 29 f1 5f 4f 22 fa 08 14 38 02 f2 a0 db 4e 63 25 71 d8 bd bd f9 08 85 d4 32 37 1a 68 1e 17 12 aa 8e 91 6c 34 38 e2 a1 13 7d bc f4 1c 3e 5b 12 28 70 04 24 d7 67 af c1 36 de 07 b9 d3 be 7d c3 92 70 20 ea 00 9d e1 6c 8f ca 81 29 58 07 18 6e f4 f1 db 93 07 36 42 40 b0 40 21 a7 ba 80 c8 34 7c 10 54 e1 7c 64 ef 94 d5 42 5c 66 df 11 7d 00 7b 00 02 12 34 16 d2 94 9f a7 4d 4c 73 6c 71 b6 87 6a 4e 6a 9c 8f 34 ae a7 fb e1 c1 83 bd ea 21 0f ba 1f 4f 57 3d 8c 05 2b ea 40 f4 01 b0 f0 f3 ba 80 d0 49 4b 85 b4 b9 4a 23 20 83 96 48 24 ad 39 9c eb b5 be 42 7b a7 8d e6 d5 79 52 3b d4 5e 2e fa e8 5b 61 03 32 e7 08 f4 86 0b 09 be 6d bd 8c e8 23 98 80 80 38 27 14 0b 09 9a 2b cb 69 df ed a0 b9 93 49 ea 1f f5 b3 90 96 39 97 a0 1b e4 db e8 ef 4e 21 fa 08 2c 38 02 b2 90 90 Data Ascii: P8)_O"8Nc%q27hl48}>[(p$g6}p l)Xn6B@@!4\|T\|dB\f}{4MLslqjNj4!OW=+@IKJ# H$9B{yR;^.[a2m#8'+iI9N!,8
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: 43 d4 7f 87 f1 d2 20 a0 29 20 26 17 2b ad bc af 39 22 92 8f c9 14 04 57 eb 1d 63 fb 4b 59 f9 a1 3e e7 3c f5 e6 f2 e5 b6 a7 ce 87 00 80 8b 0f c2 07 8b f3 5d 4d 5b 2a 2c a5 eb 86 3b 29 83 85 7e ea 93 77 5c 1a 54 eb 2f 6d f8 85 28 5d 6b 26 f3 31 1a 03 7f bd ca 43 75 87 d7 e3 58 ff 2c 61 9b 0c 0e 97 06 f9 73 f5 41 18 2f 0d 02 01 17 90 7c cc 5b 87 4a ce b0 32 aa 2a 22 74 9d 4c 81 d8 8d c5 a4 de 5a d1 f5 d6 bd 20 20 fa d4 b7 a3 ab 6d 78 69 10 d0 c4 8f 3a 8e dc 34 59 40 ac 3e 99 27 22 95 51 73 44 84 fa 69 45 5a 3c 56 b2 ee 45 5d e5 21 a1 ce de 01 96 d2 fc 79 fa 49 07 7e 69 10 b0 01 d7 ea 4f 60 a8 1a 5f a1 1f 02 b2 a3 88 64 55 d3 0f 32 05 e3 71 71 94 9b b2 92 7c b8 71 92 95 2c 7f 8e 3e e9 6c de bc d0 86 97 06 01 8f 04 24 1f 13 b2 89 46 65 39 db 85 a8 7a 7d a0 94 Data Ascii: C ) &+9"WcKY><]M[,;)~w\T/m(]k&1CuX,asA/\|[J2"tLZ mxi:4Y@>'"QsDiEZ<VE]!yI~iO`_dU2qq\|q,>l$Fe9z}
2024-12-30 15:05:45 UTC	1369	IN	Data Raw: f0 53 4a 74 9d 4e 8a 82 21 5a 7c 47 6f 9d e2 4f 73 52 72 f6 d3 24 3b e4 b2 9c e2 8e 17 85 73 40 20 de eb 3a 7c cb a4 93 5f 39 25 bb 58 6e d5 1b bc 28 0e f3 1d 7c 29 2e 57 c8 a5 46 c2 28 9c 03 40 1d 3f ec 3c 76 bd 18 6d da 52 61 29 d6 b4 b5 7a c6 1b ae 0c 53 1f 9c 63 25 5d 6f 67 86 d7 b7 6a 96 e6 c6 9e 7e 94 fa 79 fd a8 64 98 e3 ce 28 b6 35 43 7d a4 6b bd 63 75 82 fa 62 08 35 e7 eb ed 2e 7c aa 1d 10 88 97 c3 2d 29 8e 41 d7 a6 fd 27 20 cb 83 fc 7e 55 c7 9c 10 33 8e 78 70 49 63 50 6b af 36 c9 17 4c 7d 92 53 16 2a 16 36 db ed ad c8 81 8d 0b 61 14 ce 01 81 20 c3 64 39 9b ac 47 1b 71 54 ad 9f 7c e7 a9 ef b8 f5 49 e3 dd df e9 76 29 61 4f 7b b5 49 d5 a8 cb 9e 76 4d 8a 82 55 59 9b d6 1b eb 3f 84 f1 a9 76 40 30 e8 84 a3 ec d8 86 bd d9 8c d5 09 db 1d 11 3f 15 32 c3 Data Ascii: SJtN!Z\|GoOsRr$;s@ :\|_9%Xn(\|).WF(@?<vmRa)zSc%]ogj~yd(5C}kcub5.\|-)A' ~U3xpIcPk6L}S*6a d9GqT\|Iv)aO{IvMUY?v@0?2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	59443	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:45 UTC	435	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: account.secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:46 UTC	279	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:45 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Thu, 19 Dec 2024 18:38:00 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-30 15:05:46 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-30 15:05:46 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-30 15:05:46 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	59445	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:45 UTC	1238	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw If-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2" If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
2024-12-30 15:05:46 UTC	1322	IN	HTTP/1.1 304 Not Modified Date: Mon, 30 Dec 2024 15:05:46 GMT Connection: close CF-Ray: 8fa2ee0e7ccd7277-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 1394015 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront
2024-12-30 15:05:46 UTC	508	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 71 30 66 35 59 33 33 72 61 77 25 32 46 6c 6b 32 73 48 43 6b 64 62 70 32 51 4b 36 52 33 36 4f 48 6f 43 4d 38 73 37 44 68 6a 56 62 25 32 46 64 75 37 79 64 69 51 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q0f5Y33raw%2Flk2sHCkdbp2QK6R36OHoCM8s7DhjVb%2Fdu7ydiQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	59444	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:45 UTC	946	OUT	GET /favicon.ico HTTP/1.1 Host: account.secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.secured-login.net/pages/8bf720728b56/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:46 UTC	253	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:45 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Thu, 19 Dec 2024 18:39:49 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	59446	35.190.80.1	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:46 UTC	541	OUT	OPTIONS /report/v4?s=erIuv3NLfno%2BSFPthwb2df4aQQl9%2Fg4%2BPeO2HwSKrGtUznqpNckv4UdiYbVT5PZALZRaFwBeL8i8lgMvhcXqJ4F7hs7YMDIKOe7yyJd7PFad9o%2F9s4jdYsmZsW%2FZ05mPI6g%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://cdn2.hubspot.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:46 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 30 Dec 2024 15:05:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	59448	3.88.121.169	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:46 UTC	360	OUT	GET /favicon.ico HTTP/1.1 Host: account.secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:46 UTC	253	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:05:46 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Thu, 19 Dec 2024 18:39:49 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	59449	104.18.87.62	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:46 UTC	653	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=J.bxeqORebl3NfGL3ITssPzVjKAnBCc.1SxmqMRxUao-1735571144-1.0.1.1-QyL.Yx26byd49v3Kq1fSKJx9cVE8YDBAGhwrnhEcn5z.jtMSwbZN3qthZT1IHqIZFsA1KmN0HXC2r3FCKUPpjw If-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2" If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
2024-12-30 15:05:46 UTC	1358	IN	HTTP/1.1 304 Not Modified Date: Mon, 30 Dec 2024 15:05:46 GMT Connection: close CF-Ray: 8fa2ee12ecc9182d-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 1219487 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-12-30 15:05:46 UTC	398	IN	Data Raw: 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 36 58 79 79 50 6b 38 53 35 41 35 79 79 54 58 52 6c 51 6c 37 53 55 65 63 54 39 6c 43 32 77 62 63 61 78 41 64 30 44 77 4f 49 30 6d 4d 64 53 4c 58 62 41 49 44 4b 76 50 6c 71 30 6d 58 7a 45 56 74 31 6f 55 64 51 4b 25 32 42 76 33 33 70 53 6d 4c 77 65 6a 61 54 79 46 6d 33 30 54 46 63 61 4d 51 4d 70 73 6a 44 6b 4b 4d 38 64 31 34 6f 42 75 71 69 48 61 67 38 67 44 43 61 55 70 59 66 53 62 41 48 55 66 25 32 42 6b 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c Data Ascii: X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XyyPk8S5A5yyTXRlQl7SUecT9lC2wbcaxAd0DwOI0mMdSLXbAIDKvPlq0mXzEVt1oUdQK%2Bv33pSmLwejaTyFm30TFcaMQMpsjDkKM8d14oBuqiHag8gDCaUpYfSbAHUf%2Bk%3D"}],"group":"cf-nel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	59450	35.190.80.1	443	6096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:05:46 UTC	482	OUT	POST /report/v4?s=erIuv3NLfno%2BSFPthwb2df4aQQl9%2Fg4%2BPeO2HwSKrGtUznqpNckv4UdiYbVT5PZALZRaFwBeL8i8lgMvhcXqJ4F7hs7YMDIKOe7yyJd7PFad9o%2F9s4jdYsmZsW%2FZ05mPI6g%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 423 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-30 15:05:46 UTC	423	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 32 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 31 38 2e 38 37 2e 36 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 32 2e 68 75 62 73 70 6f 74 2e 6e 65 74 2f 68 75 62 66 73 2f 32 Data Ascii: [{"age":0,"body":{"elapsed_time":624,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":0.01,"server_ip":"104.18.87.62","status_code":200,"type":"ok"},"type":"network-error","url":"https://cdn2.hubspot.net/hubfs/2
2024-12-30 15:05:47 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 30 Dec 2024 15:05:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	10:05:30
Start date:	30/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:05:33
Start date:	30/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2212,i,7014414118843156653,1828310357329428657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:05:39
Start date:	30/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1136_1332418443\sets.json

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior